From 3101269f2de11e4aa8b4d22fe73bb64b94415f66 Mon Sep 17 00:00:00 2001 From: Khaled Abdelmohsen Date: Wed, 2 Oct 2019 17:54:47 +0100 Subject: [PATCH] Define rule structure Defines a model for the structure of rules to be represented in storage and in the rule evaluation engine. Bug: 141979167 Test: N/A Change-Id: I1f80b5c53e8e6cf900b211cab31758e0656db133 --- .../engine/RuleEvaluationEngine.java | 4 +- .../server/integrity/engine/RuleLoader.java | 10 +- .../{engine => model}/AppInstallMetadata.java | 4 +- .../android/server/integrity/model/Rule.java | 128 ++++++++++++++++++ 4 files changed, 139 insertions(+), 7 deletions(-) rename services/core/java/com/android/server/integrity/{engine => model}/AppInstallMetadata.java (92%) create mode 100644 services/core/java/com/android/server/integrity/model/Rule.java diff --git a/services/core/java/com/android/server/integrity/engine/RuleEvaluationEngine.java b/services/core/java/com/android/server/integrity/engine/RuleEvaluationEngine.java index 609198acd7a93..fc4430640b900 100644 --- a/services/core/java/com/android/server/integrity/engine/RuleEvaluationEngine.java +++ b/services/core/java/com/android/server/integrity/engine/RuleEvaluationEngine.java @@ -16,6 +16,8 @@ package com.android.server.integrity.engine; +import com.android.server.integrity.model.Rule; + import java.util.ArrayList; import java.util.List; @@ -34,7 +36,7 @@ public final class RuleEvaluationEngine { // The subset of rules loaded to be used to evaluate an app install request. // TODO: Load rules relevant to app installs. - private List mRules; + private List mRules; private RuleEvaluationEngine() { // Initialize rules with the empty rule set. diff --git a/services/core/java/com/android/server/integrity/engine/RuleLoader.java b/services/core/java/com/android/server/integrity/engine/RuleLoader.java index 567d7e95dd93e..af24d7a21dc84 100644 --- a/services/core/java/com/android/server/integrity/engine/RuleLoader.java +++ b/services/core/java/com/android/server/integrity/engine/RuleLoader.java @@ -16,6 +16,8 @@ package com.android.server.integrity.engine; +import com.android.server.integrity.model.Rule; + import java.util.ArrayList; import java.util.List; @@ -37,22 +39,22 @@ import java.util.List; */ final class RuleLoader { - List loadRulesByPackageName(String packageName) { + List loadRulesByPackageName(String packageName) { // TODO: Add logic based on rule storage. return new ArrayList<>(); } - List loadRulesByAppCertificate(String appCertificate) { + List loadRulesByAppCertificate(String appCertificate) { // TODO: Add logic based on rule storage. return new ArrayList<>(); } - List loadRulesByInstallerName(String installerName) { + List loadRulesByInstallerName(String installerName) { // TODO: Add logic based on rule storage. return new ArrayList<>(); } - List loadRulesByInstallerCertificate(String installerCertificate) { + List loadRulesByInstallerCertificate(String installerCertificate) { // TODO: Add logic based on rule storage. return new ArrayList<>(); } diff --git a/services/core/java/com/android/server/integrity/engine/AppInstallMetadata.java b/services/core/java/com/android/server/integrity/model/AppInstallMetadata.java similarity index 92% rename from services/core/java/com/android/server/integrity/engine/AppInstallMetadata.java rename to services/core/java/com/android/server/integrity/model/AppInstallMetadata.java index c2ed3df0ffff6..814b8e1d783bb 100644 --- a/services/core/java/com/android/server/integrity/engine/AppInstallMetadata.java +++ b/services/core/java/com/android/server/integrity/model/AppInstallMetadata.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package com.android.server.integrity.engine; +package com.android.server.integrity.model; /** * The app install metadata. @@ -32,7 +32,7 @@ public final class AppInstallMetadata { final int mVersionCode; final boolean mIsPreInstalled; - AppInstallMetadata(String packageName, String appCertificate, String installerName, + public AppInstallMetadata(String packageName, String appCertificate, String installerName, String installerCertificate, int versionCode, boolean isPreInstalled) { this.mPackageName = packageName; this.mAppCertificate = appCertificate; diff --git a/services/core/java/com/android/server/integrity/model/Rule.java b/services/core/java/com/android/server/integrity/model/Rule.java new file mode 100644 index 0000000000000..c227aea053999 --- /dev/null +++ b/services/core/java/com/android/server/integrity/model/Rule.java @@ -0,0 +1,128 @@ +/* + * Copyright (C) 2019 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.android.server.integrity.model; + +import android.annotation.Nullable; + +/** + * Represent rules to be used in the rule evaluation engine to match against app installs. + */ +public final class Rule { + + enum Key { + PACKAGE_NAME, + APP_CERTIFICATE, + INSTALLER_NAME, + INSTALLER_CERTIFICATE, + VERSION_CODE, + PRE_INSTALLED + } + + enum Effect { + DENY + } + + enum Operator { + EQ, + LT, + LE, + GT, + GE + } + + enum Connector { + AND, + OR, + NOT + } + + final Formula mFormula; + final Effect mEffect; + + public Rule(Formula formula, Effect effect) { + this.mFormula = formula; + this.mEffect = effect; + } + + /** + * Represents a rule logic/content. + */ + abstract class Formula { + + } + + /** + * Represents a simple formula consisting of an app install metadata field and a value. + */ + public final class AtomicFormula extends Formula { + + final Key mKey; + final Operator mOperator; + + // The value of a key can take either 1 of 3 forms: String, Integer, or Boolean. + // It cannot have multiple values. + @Nullable + final String mStringValue; + @Nullable + final Integer mIntValue; + @Nullable + final Boolean mBoolValue; + + public AtomicFormula(Key key, Operator operator, String stringValue) { + // TODO: Add validators + this.mKey = key; + this.mOperator = operator; + this.mStringValue = stringValue; + this.mIntValue = null; + this.mBoolValue = null; + } + + public AtomicFormula(Key key, Operator operator, Integer intValue) { + // TODO: Add validators + this.mKey = key; + this.mOperator = operator; + this.mStringValue = null; + this.mIntValue = intValue; + this.mBoolValue = null; + } + + public AtomicFormula(Key key, Operator operator, Boolean boolValue) { + // TODO: Add validators + this.mKey = key; + this.mOperator = operator; + this.mStringValue = null; + this.mIntValue = null; + this.mBoolValue = boolValue; + } + } + + /** + * Represents a complex formula consisting of other simple and complex formulas. + */ + public final class OpenFormula extends Formula { + + final Connector mConnector; + final Formula mMainFormula; + final Formula mAuxiliaryFormula; + + public OpenFormula(Connector connector, Formula mainFormula, Formula auxiliaryFormula) { + this.mConnector = connector; + this.mMainFormula = mainFormula; + this.mAuxiliaryFormula = auxiliaryFormula; + } + } +}