Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "[automerge] [DO NOT MERGE]Revert "Relax minimum signatur..."

Browse Source 
Revert "[DO NOT MERGE]Revert "Relax minimum signature scheme ver..."

Revert submission 16943318-presubmit-am-bc566b73c1674298b82a1153c03313a1

Reason for revert: This change breaks Better Bug.
Reverted Changes:
I32a2db8c7:[automerge] [DO NOT MERGE]Revert "Relax minimum si...
Ic53d2a361:[DO NOT MERGE]Revert "Relax minimum signature sche...

Change-Id: I847740b01073d4a7adde1e7b80243cd98cf2e722
This commit is contained in:
Michael Groover
2022-03-07 22:15:46 +00:00
parent 659d441a9c
commit 26e383f664
3 changed files with 19 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
core/java/android/content/pm/PackageParser.java
View File

@@ -1401,9 +1401,11 @@ public class PackageParser {
} }
SigningDetails verified; SigningDetails verified;
if (skipVerify) { if (skipVerify) {
// systemDir APKs are already trusted, save time by not verifying // systemDir APKs are already trusted, save time by not verifying; since the signature
// is not verified and some system apps can have their V2+ signatures stripped allow
// pulling the certs from the jar signature.
verified = ApkSignatureVerifier.unsafeGetCertsWithoutVerification( verified = ApkSignatureVerifier.unsafeGetCertsWithoutVerification(
apkPath, minSignatureScheme); apkPath, SigningDetails.SignatureSchemeVersion.JAR);
} else { } else {
verified = ApkSignatureVerifier.verify(apkPath, minSignatureScheme); verified = ApkSignatureVerifier.verify(apkPath, minSignatureScheme);
} }

6
core/java/android/content/pm/parsing/ParsingPackageUtils.java
View File

@@ -3038,9 +3038,11 @@ public class ParsingPackageUtils {
SigningDetails verified; SigningDetails verified;
try { try {
if (skipVerify) { if (skipVerify) {
// systemDir APKs are already trusted, save time by not verifying // systemDir APKs are already trusted, save time by not verifying; since the
// signature is not verified and some system apps can have their V2+ signatures
// stripped allow pulling the certs from the jar signature.
verified = ApkSignatureVerifier.unsafeGetCertsWithoutVerification( verified = ApkSignatureVerifier.unsafeGetCertsWithoutVerification(
baseCodePath, minSignatureScheme); baseCodePath, SigningDetails.SignatureSchemeVersion.JAR);
} else { } else {
verified = ApkSignatureVerifier.verify(baseCodePath, minSignatureScheme); verified = ApkSignatureVerifier.verify(baseCodePath, minSignatureScheme);
} }

20
services/core/java/com/android/server/pm/PackageManagerService.java
View File

@@ -15175,15 +15175,17 @@ public class PackageManagerService extends IPackageManager.Stub
} }
} }
// Ensure the package is signed with at least the minimum signature scheme version // If the package is not on a system partition ensure it is signed with at least the
// required for its target SDK. // minimum signature scheme version required for its target SDK.
int minSignatureSchemeVersion = if ((parseFlags & ParsingPackageUtils.PARSE_IS_SYSTEM_DIR) == 0) {
ApkSignatureVerifier.getMinimumSignatureSchemeVersionForTargetSdk( int minSignatureSchemeVersion =
pkg.getTargetSdkVersion()); ApkSignatureVerifier.getMinimumSignatureSchemeVersionForTargetSdk(
if (pkg.getSigningDetails().signatureSchemeVersion < minSignatureSchemeVersion) { pkg.getTargetSdkVersion());
throw new PackageManagerException(INSTALL_PARSE_FAILED_NO_CERTIFICATES, if (pkg.getSigningDetails().signatureSchemeVersion < minSignatureSchemeVersion) {
"No signature found in package of version " + minSignatureSchemeVersion throw new PackageManagerException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+ " or newer for package " + pkg.getPackageName()); "No signature found in package of version " + minSignatureSchemeVersion
+ " or newer for package " + pkg.getPackageName());
}
} }
} }
} }