Security patch levels
System, Vendor and Boot patch settings share policy_state_v2.json with the other Identity settings. Use the WebUI to keep the policy and app assignments consistent.
Where to find it: Identity > Security Patch. Where is each feature?
What to do
- Enable Security Patch under Dashboard > Identity Engine.
- Open Identity > Security Patch, choose System, Vendor and Boot modes, then save. Manual dates use
YYYY-MM-DD. - With Global Identity off, assign apps in Profiles and restart those apps. If enabling the optional Zygisk payload reports a pending reboot, reboot once first.
- Use Resolve for an app to compare captured, configured and effective values.
Patch policy also controls selected apps' Build.VERSION.SECURITY_PATCH and system/vendor/boot property views through Zygisk, independently of Build Identity. Device Default and Omit preserve genuine properties; Omit removes only certificate tags. Automatic properties use the ROM date; certificate resolution prefers captured attestation values. Age decisions are recalculated for each calendar date. While enabled, component patch policies take precedence over Custom Properties for patch fields.
Details and limits
It provides independent rules for the operating system, vendor image, and boot image fields.
Shared Identity policy
System, Vendor and Boot settings are stored in the shared Identity policy. Profiles can override each component for assigned apps. Saving patch settings keeps the other Identity settings and app assignments intact.
Use Identity > Security Patch to configure dates. The separate legacy text configuration is retired; users who previously edited that file should set their intended values in Identity.
Limits
Patch rules modify selected-app property views and supported certificate fields. They do not install security updates, change kernel code, repair vendor firmware, or make a device current. Use values that match the environment being tested and understand that a remote verifier can consider other evidence.
Independent patch policies
System, Vendor, and Boot patch levels are resolved independently. Each component supports Device, Property, Manual, Automatic, and Omit modes. Device preserves the genuine authorization value. Property reads the matching Android property for that component. Manual accepts a strictly validated calendar date.
Automatic evaluates the corresponding captured value first and then the corresponding property when no captured value is available. Omit removes only the selected component.
Automatic mode uses calendar arithmetic. The default age threshold is six months. A stale source resolves to day five of the previous calendar month. A recent captured value remains genuine. January correctly resolves through the previous December and leap year calendar rules are handled by the platform date API.
The result is live reload compatible and cached by source date, current calendar date, and threshold.
Captured means the genuine authorization value observed from Android attestation. Configured means the selected policy. Effective means the value that the runtime resolver will expose. An unrelated certificate modification preserves genuine System, Vendor, and Boot authorization tags, including their original software or TEE authorization list location.
Malformed authorization layouts fail closed.
When no patch override is active, genuine patch values remain untouched.