Question

I am creating an Android application for a customer which will be pre-installed and distributed together with the handsets. Now the customer asked me to lock down the ROM to prevent the future users from using anything else apart from this one app. I.e. no browsing, no email, nothing which could create any costs etc.

Now after some googling it seems to be relatively straightforward to remove applications from an Android image. But even if I can remove the web browser, email client, the Android Market App etc, how can I make sure that the user will not reinstall those apps via the USB connector? As Android is just Linux I am sure there are ways of denying all users the right to install new applications (or actually denying them pretty much anything apart from using this one app).

If somebody could point me in the right direction it would be much appreciated.

EDIT:
To clarify things a bit, the customer does not want to use the android devices as phones, even though they are phones. With 100€ touch screen phones becoming available, it becomes viable to use those phones for just one specific purpose. In my customers case, the device will be used as something like a POS system: the employee uses the phone to process a certain kind of customer request, and for this the app needs to have a data connection which will accrue costs of course. Now obviously contracts can be set up that will oblige employees to pay any irregular costs themselves, but why make it that complicated?

This is not about taking freedom away from users but rather about using android phones as general purpose touch screen devices with a data connection that employees can use in a business environment without shooting themselves in the foot with unexpected high data connection cost.

Answer 1

There’s not really a whole lot you need to do to make a single-purpose device. If you play your cards right, it should be something you can do without having to tinker with the ROM.

The quick-and-easy route would be to deploy your application as a replacement for the stock launcher, just like any of the other home replacements that are available. Setting that as the default would cover most of the opportunities for casual tampering, since it would leave no other way to launch or install anything else. The only other things I can think of off the top of my head that you’d need to do are snag the search button so it doesn’t bring up the default Android search box atop your app and the green key so the phone app won’t come up.

You would, of course, need a way to get to the original launcher to maintain the device and install new versions of your app. I’d accomplish that using a “Maintenance” menu item somewhere that asks for some form of authentication (e.g., a password), changes the home app back to the original and launches it. When you’re done doing what you need to do, set your app as the default launcher and you’re back in business.

Edit to address MAINERROR (now Octavian Damiean)’s comment:

Any activity in any application can register itself as a home application by adding an intent filter on the android.intent.category.HOME category. It’s literally four lines in the manifest, and you don’t have to write any code to support it. Take a look at lines 77-82 in the stock launcher’s manifest for an example of how this is done. (Ignore the filters on DEFAULT and MONKEY; they’re not necessary.) Once the activity is selected as the default handler for the category, it becomes the first thing launched at boot and what comes up when the Home key is pressed. HTC Sense, aHome, Panda Home, etc. all use this mechanism.

Launching the stock home (or any other application) explicitly is about five lines of code.

Side note: There’s a application on the Market called Home Switcher that lets you launch any of the activities filtering on the HOME category or set one as the default.

Unless the handset manufacturer adds a lot of shovelware, the stuff that runs in the background should be inconsequential and won’t get in the way.