From 521adad72d8e9677485c4e216bf6b12c63fa4def Mon Sep 17 00:00:00 2001 From: Khalid Ramadan Date: Wed, 16 Feb 2022 12:50:07 +0000 Subject: [PATCH] Send broadcast to SDK verifier. Parse APK info during installing and if SDK send broadcast to invoke SDK verifier. Bug: 216436982 Test: manually install SDK Change-Id: I027c1999685f582c6bce2c4be6169feb5886fdba --- core/api/module-lib-current.txt | 1 + .../android/content/pm/PackageInfoLite.java | 5 +++++ .../android/content/pm/PackageManager.java | 3 ++- .../android/content/pm/parsing/ApkLite.java | 20 ++++++++++++++++--- .../content/pm/parsing/ApkLiteParseUtils.java | 7 ++++++- .../content/pm/parsing/PackageLite.java | 18 +++++++++++++++-- core/res/AndroidManifest.xml | 7 +++++++ .../server/pm/PackageManagerServiceUtils.java | 2 ++ .../android/server/pm/VerificationParams.java | 16 ++++++++++++++- 9 files changed, 71 insertions(+), 8 deletions(-) diff --git a/core/api/module-lib-current.txt b/core/api/module-lib-current.txt index 5bc5bbc08074c..a0c4cf4469bf6 100644 --- a/core/api/module-lib-current.txt +++ b/core/api/module-lib-current.txt @@ -122,6 +122,7 @@ package android.content.pm { public abstract class PackageManager { method @NonNull public String getPermissionControllerPackageName(); method @NonNull public String getSdkSandboxPackageName(); + field public static final String EXTRA_VERIFICATION_ROOT_HASH = "android.content.pm.extra.VERIFICATION_ROOT_HASH"; field public static final int MATCH_STATIC_SHARED_AND_SDK_LIBRARIES = 67108864; // 0x4000000 } diff --git a/core/java/android/content/pm/PackageInfoLite.java b/core/java/android/content/pm/PackageInfoLite.java index 410e106ce5847..148eacc0c4d45 100644 --- a/core/java/android/content/pm/PackageInfoLite.java +++ b/core/java/android/content/pm/PackageInfoLite.java @@ -78,6 +78,11 @@ public class PackageInfoLite implements Parcelable { */ public boolean debuggable; + /** + * Indicates if this apk is a sdk. + */ + public boolean isSdkLibrary; + /** * Specifies the recommended install location. Can be one of * {@link InstallLocationUtils#RECOMMEND_INSTALL_INTERNAL} to install on internal storage, diff --git a/core/java/android/content/pm/PackageManager.java b/core/java/android/content/pm/PackageManager.java index f4bc1616da2b9..24042965ac762 100644 --- a/core/java/android/content/pm/PackageManager.java +++ b/core/java/android/content/pm/PackageManager.java @@ -4251,8 +4251,9 @@ public abstract class PackageManager { * for more details. * @hide */ + @SystemApi(client = SystemApi.Client.MODULE_LIBRARIES) public static final String EXTRA_VERIFICATION_ROOT_HASH = - "android.content.pm.extra.EXTRA_VERIFICATION_ROOT_HASH"; + "android.content.pm.extra.VERIFICATION_ROOT_HASH"; /** * Extra field name for the ID of a intent filter pending verification. diff --git a/core/java/android/content/pm/parsing/ApkLite.java b/core/java/android/content/pm/parsing/ApkLite.java index 5ffb958082fb8..269bec2562820 100644 --- a/core/java/android/content/pm/parsing/ApkLite.java +++ b/core/java/android/content/pm/parsing/ApkLite.java @@ -133,6 +133,11 @@ public class ApkLite { */ private final boolean mHasDeviceAdminReceiver; + /** + * Indicates if this apk is a sdk. + */ + private final boolean mIsSdkLibrary; + public ApkLite(String path, String packageName, String splitName, boolean isFeatureSplit, String configForSplit, String usesSplitName, boolean isSplitRequired, int versionCode, int versionCodeMajor, int revisionCode, int installLocation, @@ -143,7 +148,7 @@ public class ApkLite { String requiredSystemPropertyName, String requiredSystemPropertyValue, int minSdkVersion, int targetSdkVersion, int rollbackDataPolicy, Set requiredSplitTypes, Set splitTypes, - boolean hasDeviceAdminReceiver) { + boolean hasDeviceAdminReceiver, boolean isSdkLibrary) { mPath = path; mPackageName = packageName; mSplitName = splitName; @@ -176,6 +181,7 @@ public class ApkLite { mTargetSdkVersion = targetSdkVersion; mRollbackDataPolicy = rollbackDataPolicy; mHasDeviceAdminReceiver = hasDeviceAdminReceiver; + mIsSdkLibrary = isSdkLibrary; } /** @@ -473,11 +479,19 @@ public class ApkLite { return mHasDeviceAdminReceiver; } + /** + * Indicates if this apk is a sdk. + */ + @DataClass.Generated.Member + public boolean isIsSdkLibrary() { + return mIsSdkLibrary; + } + @DataClass.Generated( - time = 1635266936769L, + time = 1643063342990L, codegenVersion = "1.0.23", sourceFile = "frameworks/base/core/java/android/content/pm/parsing/ApkLite.java", - inputSignatures = "private final @android.annotation.NonNull java.lang.String mPackageName\nprivate final @android.annotation.NonNull java.lang.String mPath\nprivate final @android.annotation.Nullable java.lang.String mSplitName\nprivate final @android.annotation.Nullable java.lang.String mUsesSplitName\nprivate final @android.annotation.Nullable java.lang.String mConfigForSplit\nprivate final @android.annotation.Nullable java.util.Set mRequiredSplitTypes\nprivate final @android.annotation.Nullable java.util.Set mSplitTypes\nprivate final int mVersionCodeMajor\nprivate final int mVersionCode\nprivate final int mRevisionCode\nprivate final int mInstallLocation\nprivate final int mMinSdkVersion\nprivate final int mTargetSdkVersion\nprivate final @android.annotation.NonNull android.content.pm.VerifierInfo[] mVerifiers\nprivate final @android.annotation.NonNull android.content.pm.SigningDetails mSigningDetails\nprivate final boolean mFeatureSplit\nprivate final boolean mIsolatedSplits\nprivate final boolean mSplitRequired\nprivate final boolean mCoreApp\nprivate final boolean mDebuggable\nprivate final boolean mProfileableByShell\nprivate final boolean mMultiArch\nprivate final boolean mUse32bitAbi\nprivate final boolean mExtractNativeLibs\nprivate final boolean mUseEmbeddedDex\nprivate final @android.annotation.Nullable java.lang.String mTargetPackageName\nprivate final boolean mOverlayIsStatic\nprivate final int mOverlayPriority\nprivate final @android.annotation.Nullable java.lang.String mRequiredSystemPropertyName\nprivate final @android.annotation.Nullable java.lang.String mRequiredSystemPropertyValue\nprivate final int mRollbackDataPolicy\nprivate final boolean mHasDeviceAdminReceiver\npublic long getLongVersionCode()\nprivate boolean hasAnyRequiredSplitTypes()\nclass ApkLite extends java.lang.Object implements []\n@com.android.internal.util.DataClass(genConstructor=false, genConstDefs=false)") + inputSignatures = "private final @android.annotation.NonNull java.lang.String mPackageName\nprivate final @android.annotation.NonNull java.lang.String mPath\nprivate final @android.annotation.Nullable java.lang.String mSplitName\nprivate final @android.annotation.Nullable java.lang.String mUsesSplitName\nprivate final @android.annotation.Nullable java.lang.String mConfigForSplit\nprivate final @android.annotation.Nullable java.util.Set mRequiredSplitTypes\nprivate final @android.annotation.Nullable java.util.Set mSplitTypes\nprivate final int mVersionCodeMajor\nprivate final int mVersionCode\nprivate final int mRevisionCode\nprivate final int mInstallLocation\nprivate final int mMinSdkVersion\nprivate final int mTargetSdkVersion\nprivate final @android.annotation.NonNull android.content.pm.VerifierInfo[] mVerifiers\nprivate final @android.annotation.NonNull android.content.pm.SigningDetails mSigningDetails\nprivate final boolean mFeatureSplit\nprivate final boolean mIsolatedSplits\nprivate final boolean mSplitRequired\nprivate final boolean mCoreApp\nprivate final boolean mDebuggable\nprivate final boolean mProfileableByShell\nprivate final boolean mMultiArch\nprivate final boolean mUse32bitAbi\nprivate final boolean mExtractNativeLibs\nprivate final boolean mUseEmbeddedDex\nprivate final @android.annotation.Nullable java.lang.String mTargetPackageName\nprivate final boolean mOverlayIsStatic\nprivate final int mOverlayPriority\nprivate final @android.annotation.Nullable java.lang.String mRequiredSystemPropertyName\nprivate final @android.annotation.Nullable java.lang.String mRequiredSystemPropertyValue\nprivate final int mRollbackDataPolicy\nprivate final boolean mHasDeviceAdminReceiver\nprivate final boolean mIsSdkLibrary\npublic long getLongVersionCode()\nprivate boolean hasAnyRequiredSplitTypes()\nclass ApkLite extends java.lang.Object implements []\n@com.android.internal.util.DataClass(genConstructor=false, genConstDefs=false)") @Deprecated private void __metadata() {} diff --git a/core/java/android/content/pm/parsing/ApkLiteParseUtils.java b/core/java/android/content/pm/parsing/ApkLiteParseUtils.java index 165cae8261875..5680bcd2e2e6a 100644 --- a/core/java/android/content/pm/parsing/ApkLiteParseUtils.java +++ b/core/java/android/content/pm/parsing/ApkLiteParseUtils.java @@ -87,6 +87,7 @@ public class ApkLiteParseUtils { private static final String TAG_USES_SDK = "uses-sdk"; private static final String TAG_USES_SPLIT = "uses-split"; private static final String TAG_MANIFEST = "manifest"; + private static final String TAG_SDK_LIBRARY = "sdk-library"; private static final int SDK_VERSION = Build.VERSION.SDK_INT; private static final String[] SDK_CODENAMES = Build.VERSION.ACTIVE_CODENAMES; @@ -449,6 +450,8 @@ public class ApkLiteParseUtils { boolean hasDeviceAdminReceiver = false; + boolean isSdkLibrary = false; + // Only search the tree when the tag is the direct child of tag int type; final int searchDepth = parser.getDepth() + 1; @@ -506,6 +509,8 @@ public class ApkLiteParseUtils { } else if (TAG_RECEIVER.equals(parser.getName())) { hasDeviceAdminReceiver |= isDeviceAdminReceiver( parser, hasBindDeviceAdminPermission); + } else if (TAG_SDK_LIBRARY.equals(parser.getName())) { + isSdkLibrary = true; } } } else if (TAG_OVERLAY.equals(parser.getName())) { @@ -598,7 +603,7 @@ public class ApkLiteParseUtils { overlayIsStatic, overlayPriority, requiredSystemPropertyName, requiredSystemPropertyValue, minSdkVersion, targetSdkVersion, rollbackDataPolicy, requiredSplitTypes.first, requiredSplitTypes.second, - hasDeviceAdminReceiver)); + hasDeviceAdminReceiver, isSdkLibrary)); } private static boolean isDeviceAdminReceiver( diff --git a/core/java/android/content/pm/parsing/PackageLite.java b/core/java/android/content/pm/parsing/PackageLite.java index 5f5e81253b313..e2789c93516fb 100644 --- a/core/java/android/content/pm/parsing/PackageLite.java +++ b/core/java/android/content/pm/parsing/PackageLite.java @@ -105,6 +105,10 @@ public class PackageLite { * or locally compiled variants. */ private final boolean mUseEmbeddedDex; + /** + * Indicates if this package is a sdk. + */ + private final boolean mIsSdkLibrary; public PackageLite(String path, String baseApkPath, ApkLite baseApk, String[] splitNames, boolean[] isFeatureSplits, String[] usesSplitNames, @@ -131,6 +135,7 @@ public class PackageLite { mRequiredSplitTypes = requiredSplitTypes; mSplitRequired = (baseApk.isSplitRequired() || hasAnyRequiredSplitTypes()); mProfileableByShell = baseApk.isProfileableByShell(); + mIsSdkLibrary = baseApk.isIsSdkLibrary(); mSplitNames = splitNames; mSplitTypes = splitTypes; mIsFeatureSplits = isFeatureSplits; @@ -401,11 +406,20 @@ public class PackageLite { return mUseEmbeddedDex; } + /** + * Indicates if this package is a sdk. + */ + @DataClass.Generated.Member + public boolean isIsSdkLibrary() { + return mIsSdkLibrary; + } + @DataClass.Generated( - time = 1628562559343L, + time = 1643132127068L, codegenVersion = "1.0.23", sourceFile = "frameworks/base/core/java/android/content/pm/parsing/PackageLite.java", - inputSignatures = "private final @android.annotation.NonNull java.lang.String mPackageName\nprivate final @android.annotation.NonNull java.lang.String mPath\nprivate final @android.annotation.NonNull java.lang.String mBaseApkPath\nprivate final @android.annotation.Nullable java.lang.String[] mSplitApkPaths\nprivate final @android.annotation.Nullable java.lang.String[] mSplitNames\nprivate final @android.annotation.Nullable java.lang.String[] mUsesSplitNames\nprivate final @android.annotation.Nullable java.lang.String[] mConfigForSplit\nprivate final @android.annotation.Nullable java.util.Set mBaseRequiredSplitTypes\nprivate final @android.annotation.Nullable java.util.Set[] mRequiredSplitTypes\nprivate final @android.annotation.Nullable java.util.Set[] mSplitTypes\nprivate final int mVersionCodeMajor\nprivate final int mVersionCode\nprivate final int mTargetSdk\nprivate final int mBaseRevisionCode\nprivate final @android.annotation.Nullable int[] mSplitRevisionCodes\nprivate final int mInstallLocation\nprivate final @android.annotation.NonNull android.content.pm.VerifierInfo[] mVerifiers\nprivate final @android.annotation.Nullable boolean[] mIsFeatureSplits\nprivate final boolean mIsolatedSplits\nprivate final boolean mSplitRequired\nprivate final boolean mCoreApp\nprivate final boolean mDebuggable\nprivate final boolean mMultiArch\nprivate final boolean mUse32bitAbi\nprivate final boolean mExtractNativeLibs\nprivate final boolean mProfileableByShell\nprivate final boolean mUseEmbeddedDex\npublic java.util.List getAllApkPaths()\npublic long getLongVersionCode()\nprivate boolean hasAnyRequiredSplitTypes()\nclass PackageLite extends java.lang.Object implements []\n@com.android.internal.util.DataClass(genConstructor=false, genConstDefs=false)") + inputSignatures = + "private final @android.annotation.NonNull java.lang.String mPackageName\nprivate final @android.annotation.NonNull java.lang.String mPath\nprivate final @android.annotation.NonNull java.lang.String mBaseApkPath\nprivate final @android.annotation.Nullable java.lang.String[] mSplitApkPaths\nprivate final @android.annotation.Nullable java.lang.String[] mSplitNames\nprivate final @android.annotation.Nullable java.lang.String[] mUsesSplitNames\nprivate final @android.annotation.Nullable java.lang.String[] mConfigForSplit\nprivate final @android.annotation.Nullable java.util.Set mBaseRequiredSplitTypes\nprivate final @android.annotation.Nullable java.util.Set[] mRequiredSplitTypes\nprivate final @android.annotation.Nullable java.util.Set[] mSplitTypes\nprivate final int mVersionCodeMajor\nprivate final int mVersionCode\nprivate final int mTargetSdk\nprivate final int mBaseRevisionCode\nprivate final @android.annotation.Nullable int[] mSplitRevisionCodes\nprivate final int mInstallLocation\nprivate final @android.annotation.NonNull android.content.pm.VerifierInfo[] mVerifiers\nprivate final @android.annotation.Nullable boolean[] mIsFeatureSplits\nprivate final boolean mIsolatedSplits\nprivate final boolean mSplitRequired\nprivate final boolean mCoreApp\nprivate final boolean mDebuggable\nprivate final boolean mMultiArch\nprivate final boolean mUse32bitAbi\nprivate final boolean mExtractNativeLibs\nprivate final boolean mProfileableByShell\nprivate final boolean mUseEmbeddedDex\nprivate final boolean mIsSdkLibrary\npublic java.util.List getAllApkPaths()\npublic long getLongVersionCode()\nprivate boolean hasAnyRequiredSplitTypes()\nclass PackageLite extends java.lang.Object implements []\n@com.android.internal.util.DataClass(genConstructor=false, genConstDefs=false)") @Deprecated private void __metadata() {} diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml index 434222ae80162..ae01c35e6cd8c 100644 --- a/core/res/AndroidManifest.xml +++ b/core/res/AndroidManifest.xml @@ -6815,6 +6815,13 @@ + + + + + + diff --git a/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java b/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java index 8d3fbf7fc6798..2a1a99068d45d 100644 --- a/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java +++ b/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java @@ -850,6 +850,8 @@ public class PackageManagerServiceUtils { ret.recommendedInstallLocation = recommendedInstallLocation; ret.multiArch = pkg.isMultiArch(); ret.debuggable = pkg.isDebuggable(); + ret.isSdkLibrary = pkg.isIsSdkLibrary(); + return ret; } diff --git a/services/core/java/com/android/server/pm/VerificationParams.java b/services/core/java/com/android/server/pm/VerificationParams.java index 4334cbdce1f2d..5144ccf9eb6e4 100644 --- a/services/core/java/com/android/server/pm/VerificationParams.java +++ b/services/core/java/com/android/server/pm/VerificationParams.java @@ -72,6 +72,7 @@ import android.util.Pair; import android.util.Slog; import com.android.server.DeviceIdleInternal; +import com.android.server.sdksandbox.SdkSandboxManagerLocal; import java.io.File; import java.util.ArrayList; @@ -440,9 +441,22 @@ final class VerificationParams extends HandlerParams { final long verificationTimeout = VerificationUtils.getVerificationTimeout(mPm.mContext, streaming); - final List sufficientVerifiers = matchVerifiers(pkgLite, + List sufficientVerifiers = matchVerifiers(pkgLite, receivers.getList(), verificationState); + // Add broadcastReceiver Component to verify Sdk before run in Sdk sandbox. + if (pkgLite.isSdkLibrary) { + if (sufficientVerifiers == null) { + sufficientVerifiers = new ArrayList<>(); + } + ComponentName sdkSandboxComponentName = new ComponentName("android", + SdkSandboxManagerLocal.VERIFIER_RECEIVER); + sufficientVerifiers.add(sdkSandboxComponentName); + + // Add uid of system_server the same uid for SdkSandboxManagerService + verificationState.addSufficientVerifier(Process.myUid()); + } + DeviceIdleInternal idleController = mPm.mInjector.getLocalService(DeviceIdleInternal.class); final BroadcastOptions options = BroadcastOptions.makeBasic();