Shulou(Shulou.com)05/31 Report--

Fragmentation of Android is one of Google's biggest challenges. While the Google Pixel smartphone market is the most secure with the help of Pixel and AOSP engineers, many other smartphones are vulnerable because they run outdated operating system versions or outdated security patch levels. According to the latest report from Gartner, Android 9 Pie is a very secure operating system, but only about 10% of smartphones are released.

Google is solving version fragmentation issues through projects, such as Android's major rearchitecture of Project Treble, which leads to the separation of Android operating system framework components from vendor HAL components, the LTS extension of the Linux kernel, the mandatory update of 2-year security patches, and recommendations from Android enterprises. At Google Iamp O in 2019, the company unveiled its latest move to speed up security updates: the Android Q project mainline.

Main line of the project: update the Android Q module through Google Play.

Over the past few months, we've been tracking something called "APEX" on AOSP. APEX or Android Pony EXpress is a new package type similar to APK. But APEX is not designed to accommodate Android applications, but is local or library precompiled code that can be called by Android applications, hardware abstraction layer (HAL) and Android runtime (ART). Like APK, APEX packages can be made available to users through the traditional package installation in Android: Google Play Store / package Manager or ADB.

APEX modules can be used earlier than APK-based modules during startup, and they are also supported by dm-verity and Android Verified Boot to improve security. Loading the payload image into the APEX package requires a circular driver of the Linux kernel, so the device requires version 4.9 of the Linux kernel. Managing the APEX package requires Android Q to introduce a new APEX daemon, and while devices upgraded from Linux kernel 4.4 to Android Q can support APEX (such as Google Pixel 3), the original device manufacturer needs to integrate other patches to work properly. In most cases, the project mainline is only supported by devices that support Android Q.

GNU/Linux distributions have long been able to update system components independently of complete system updates, but Android always requires a system update to update. Google chose not to use traditional Linux package management systems such as dpkg and rpm to distribute these packages because they do not use dm-verity to protect installed packages.

Because it takes a long time for equipment manufacturers to introduce updates, many devices may use outdated system components within days, weeks, or even months. By distributing these components as APEX packages, Google can avoid waiting a long time for OEMs to launch system updates.

However, Google does not have complete control over all the system components. The company works with OEM partners to select a set of system applications (such as APK) and system components (as APEX software packages) for modularization to improve security, privacy and consistency for all users through Android Q-enabled devices. Although Google did not elaborate on how they proposed the initial system components, they provided us with a list of system components on devices starting with Android Q, which Google will update:

Security: media codecs, media framework components, DNS parsers, Conscrypt.

Privacy: document user interface, rights controller, external services.

Consistency: time zone data, ANGLE (developer choice), module metadata, network components, forced entry login, network permission configuration.

Instant updates to Conscrypt, Java security libraries and media components (accounting for nearly 40 per cent of recent fixes) will make Android devices more secure. Updating the permissions controller will improve privacy. When deciding to change the time zone, standardizing the time zone data helps put Android devices on the same page. In addition, game developers will benefit from ANGLE standardization.

Google is starting to use these components, but may add more to future Android versions. Of the 13 components, Conscrypt, Timezone data, media codecs, and media framework components will be available as APEX packages. The other nine components are the APK system. Although APEX and APK can be delivered through Google Games, updating the APEX package requires a restart. Google hasn't shared the UI process yet, but once the device starts using Android Q, we may learn more about Project Mainline and APEX packages.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.