From 4055ce5313a1b1cbcafbe1fc4a619459a1d53cdc Mon Sep 17 00:00:00 2001
From: Inseob Kim <inseob@google.com>
Date: Thu, 29 Apr 2021 13:01:02 +0900
Subject: [PATCH] Add an api for platform sepolicy version to vintf

PLATFORM_SEPOLICY_VERSION will be the latest version in system's
compatibility matrix. This change adds a function
getPlatformSepolicyVersion, which ultimately gets
PLATFORM_SEPOLICY_VERSION, just like getSepolicyVersion for vendor.

This will be used from the SELinux CTS.

Bug: 186596569
Test: atest CtsSecurityHostTestCases:android.security.cts.SELinuxNeverallowRulesTest
Change-Id: Ic7863ece9413b9a6a4a91ff42d3121935823fe8b
---
 core/api/test-current.txt             |  1 +
 core/java/android/os/VintfObject.java | 10 +++++++
 core/jni/android_os_VintfObject.cpp   | 41 +++++++++++++++++++++++----
 3 files changed, 46 insertions(+), 6 deletions(-)

diff --git a/core/api/test-current.txt b/core/api/test-current.txt
index e2975ad85ff82..81b9428d162a5 100644
--- a/core/api/test-current.txt
+++ b/core/api/test-current.txt
@@ -1191,6 +1191,7 @@ package android.os {
 
   public class VintfObject {
     method public static String[] getHalNamesAndVersions();
+    method @NonNull public static String getPlatformSepolicyVersion();
     method public static String getSepolicyVersion();
     method public static Long getTargetFrameworkCompatibilityMatrixVersion();
     method public static java.util.Map<java.lang.String,java.lang.String[]> getVndkSnapshots();
diff --git a/core/java/android/os/VintfObject.java b/core/java/android/os/VintfObject.java
index 7af8f71aa4aa1..bf0b655fe5749 100644
--- a/core/java/android/os/VintfObject.java
+++ b/core/java/android/os/VintfObject.java
@@ -16,6 +16,7 @@
 
 package android.os;
 
+import android.annotation.NonNull;
 import android.annotation.TestApi;
 import android.util.Slog;
 
@@ -111,6 +112,15 @@ public class VintfObject {
     @TestApi
     public static native String getSepolicyVersion();
 
+    /**
+     * @return the PLATFORM_SEPOLICY_VERSION build flag available in framework
+     * compatibility matrix.
+     *
+     * @hide
+     */
+    @TestApi
+    public static native @NonNull String getPlatformSepolicyVersion();
+
     /**
      * @return a list of VNDK snapshots supported by the framework, as
      * specified in framework manifest. For example,
diff --git a/core/jni/android_os_VintfObject.cpp b/core/jni/android_os_VintfObject.cpp
index 4bd33a9cbd3bc..1baea2aecc3c8 100644
--- a/core/jni/android_os_VintfObject.cpp
+++ b/core/jni/android_os_VintfObject.cpp
@@ -37,11 +37,13 @@ static jmethodID gLongValueOf;
 
 namespace android {
 
+using vintf::CompatibilityMatrix;
 using vintf::HalManifest;
 using vintf::Level;
 using vintf::SchemaType;
 using vintf::to_string;
 using vintf::toXml;
+using vintf::Version;
 using vintf::VintfObject;
 using vintf::Vndk;
 
@@ -119,6 +121,28 @@ static jstring android_os_VintfObject_getSepolicyVersion(JNIEnv* env, jclass) {
     return env->NewStringUTF(cString.c_str());
 }
 
+static jstring android_os_VintfObject_getPlatformSepolicyVersion(JNIEnv* env, jclass) {
+    std::shared_ptr<const CompatibilityMatrix> matrix =
+            VintfObject::GetFrameworkCompatibilityMatrix();
+    if (matrix == nullptr || matrix->type() != SchemaType::FRAMEWORK) {
+        jniThrowRuntimeException(env, "Cannot get framework compatibility matrix");
+        return nullptr;
+    }
+
+    auto versions = matrix->getSepolicyVersions();
+    if (versions.empty()) {
+        jniThrowRuntimeException(env,
+                                 "sepolicy_version in framework compatibility matrix is empty");
+        return nullptr;
+    }
+
+    Version latest;
+    for (const auto& range : versions) {
+        latest = std::max(latest, range.maxVer());
+    }
+    return env->NewStringUTF(to_string(latest).c_str());
+}
+
 static jobject android_os_VintfObject_getVndkSnapshots(JNIEnv* env, jclass) {
     std::shared_ptr<const HalManifest> manifest = VintfObject::GetFrameworkHalManifest();
     if (manifest == nullptr || manifest->type() != SchemaType::FRAMEWORK) {
@@ -145,12 +169,17 @@ static jobject android_os_VintfObject_getTargetFrameworkCompatibilityMatrixVersi
 // ----------------------------------------------------------------------------
 
 static const JNINativeMethod gVintfObjectMethods[] = {
-    {"report", "()[Ljava/lang/String;", (void*)android_os_VintfObject_report},
-    {"verifyWithoutAvb", "()I", (void*)android_os_VintfObject_verifyWithoutAvb},
-    {"getHalNamesAndVersions", "()[Ljava/lang/String;", (void*)android_os_VintfObject_getHalNamesAndVersions},
-    {"getSepolicyVersion", "()Ljava/lang/String;", (void*)android_os_VintfObject_getSepolicyVersion},
-    {"getVndkSnapshots", "()Ljava/util/Map;", (void*)android_os_VintfObject_getVndkSnapshots},
-    {"getTargetFrameworkCompatibilityMatrixVersion", "()Ljava/lang/Long;", (void*)android_os_VintfObject_getTargetFrameworkCompatibilityMatrixVersion},
+        {"report", "()[Ljava/lang/String;", (void*)android_os_VintfObject_report},
+        {"verifyWithoutAvb", "()I", (void*)android_os_VintfObject_verifyWithoutAvb},
+        {"getHalNamesAndVersions", "()[Ljava/lang/String;",
+         (void*)android_os_VintfObject_getHalNamesAndVersions},
+        {"getSepolicyVersion", "()Ljava/lang/String;",
+         (void*)android_os_VintfObject_getSepolicyVersion},
+        {"getPlatformSepolicyVersion", "()Ljava/lang/String;",
+         (void*)android_os_VintfObject_getPlatformSepolicyVersion},
+        {"getVndkSnapshots", "()Ljava/util/Map;", (void*)android_os_VintfObject_getVndkSnapshots},
+        {"getTargetFrameworkCompatibilityMatrixVersion", "()Ljava/lang/Long;",
+         (void*)android_os_VintfObject_getTargetFrameworkCompatibilityMatrixVersion},
 };
 
 const char* const kVintfObjectPathName = "android/os/VintfObject";