Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Allow app's targetSDK to overwrite SELINUX_LATEST_CHANGES SDK"

Browse Source
This commit is contained in:
Bram Bonné
2021-06-17 09:42:31 +00:00
committed by Gerrit Code Review
parent e98c98156c 98253dfa98
commit 32d031336d
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
services/core/java/com/android/server/pm/SELinuxMMAC.java
View File

@@ -79,7 +79,7 @@ public final class SELinuxMMAC {
/** /**
* Allows opt-in to the latest targetSdkVersion enforced changes without changing target SDK. * Allows opt-in to the latest targetSdkVersion enforced changes without changing target SDK.
* Turning this change off for an app targeting the latest SDK is a no-op. * Turning this change off for an app targeting >= the latest SDK is a no-op.
* *
* <p>Has no effect for apps using shared user id. * <p>Has no effect for apps using shared user id.
* *
@@ -92,7 +92,7 @@ public final class SELinuxMMAC {
/** /**
* This change gates apps access to untrusted_app_R-targetSDK SELinux domain. Allows opt-in * This change gates apps access to untrusted_app_R-targetSDK SELinux domain. Allows opt-in
* to R targetSdkVersion enforced changes without changing target SDK. Turning this change * to R targetSdkVersion enforced changes without changing target SDK. Turning this change
* off for an app targeting S is a no-op. * off for an app targeting >= S is a no-op.
* *
* <p>Has no effect for apps using shared user id. * <p>Has no effect for apps using shared user id.
* *
@@ -364,7 +364,7 @@ public final class SELinuxMMAC {
} }
final ApplicationInfo appInfo = pkg.toAppInfoWithoutState(); final ApplicationInfo appInfo = pkg.toAppInfoWithoutState();
if (compatibility.isChangeEnabledInternal(SELINUX_LATEST_CHANGES, appInfo)) { if (compatibility.isChangeEnabledInternal(SELINUX_LATEST_CHANGES, appInfo)) {
return android.os.Build.VERSION_CODES.S; return Math.max(android.os.Build.VERSION_CODES.S, pkg.getTargetSdkVersion());
} else if (compatibility.isChangeEnabledInternal(SELINUX_R_CHANGES, appInfo)) { } else if (compatibility.isChangeEnabledInternal(SELINUX_R_CHANGES, appInfo)) {
return Math.max(android.os.Build.VERSION_CODES.R, pkg.getTargetSdkVersion()); return Math.max(android.os.Build.VERSION_CODES.R, pkg.getTargetSdkVersion());
} }

10
services/tests/servicestests/src/com/android/server/pm/SELinuxMMACTest.java
View File

@@ -90,6 +90,16 @@ public class SELinuxMMACTest {
is("default:targetSdkVersion=" + LATEST_OPT_IN_VERSION)); is("default:targetSdkVersion=" + LATEST_OPT_IN_VERSION));
} }
@Test
public void getSeInfoTargetingCurDevelopment() {
AndroidPackage pkg = makePackage(Build.VERSION_CODES.CUR_DEVELOPMENT);
when(mMockCompatibility.isChangeEnabledInternal(eq(SELinuxMMAC.SELINUX_LATEST_CHANGES),
argThat(argument -> argument.packageName.equals(pkg.getPackageName()))))
.thenReturn(true);
assertThat(SELinuxMMAC.getSeInfo(pkg, null, mMockCompatibility),
is("default:targetSdkVersion=" + Build.VERSION_CODES.CUR_DEVELOPMENT));
}
@Test @Test
public void getSeInfoNoOptInButAlreadyR() { public void getSeInfoNoOptInButAlreadyR() {
AndroidPackage pkg = makePackage(R_OPT_IN_VERSION); AndroidPackage pkg = makePackage(R_OPT_IN_VERSION);