Merge "Set correct storage path for SDK sandbox" into tm-dev

This commit is contained in:
Sanjana Sunil
2022-03-10 16:03:19 +00:00
committed by Android (Google) Code Review
13 changed files with 105 additions and 40 deletions

View File

@@ -868,6 +868,7 @@ public final class ActivityThread extends ClientTransactionHandler
String processName;
@UnsupportedAppUsage
ApplicationInfo appInfo;
String sdkSandboxClientAppPackage;
@UnsupportedAppUsage
List<ProviderInfo> providers;
ComponentName instrumentationName;
@@ -1113,9 +1114,9 @@ public final class ActivityThread extends ClientTransactionHandler
@Override
public final void bindApplication(String processName, ApplicationInfo appInfo,
ProviderInfoList providerList, ComponentName instrumentationName,
ProfilerInfo profilerInfo, Bundle instrumentationArgs,
IInstrumentationWatcher instrumentationWatcher,
String sdkSandboxClientAppPackage, ProviderInfoList providerList,
ComponentName instrumentationName, ProfilerInfo profilerInfo,
Bundle instrumentationArgs, IInstrumentationWatcher instrumentationWatcher,
IUiAutomationConnection instrumentationUiConnection, int debugMode,
boolean enableBinderTracking, boolean trackAllocation,
boolean isRestrictedBackupMode, boolean persistent, Configuration config,
@@ -1155,6 +1156,7 @@ public final class ActivityThread extends ClientTransactionHandler
AppBindData data = new AppBindData();
data.processName = processName;
data.appInfo = appInfo;
data.sdkSandboxClientAppPackage = sdkSandboxClientAppPackage;
data.providers = providerList.getList();
data.instrumentationName = instrumentationName;
data.instrumentationArgs = instrumentationArgs;
@@ -6536,6 +6538,9 @@ public final class ActivityThread extends ClientTransactionHandler
}
data.info = getPackageInfoNoCheck(data.appInfo, data.compatInfo);
if (data.sdkSandboxClientAppPackage != null) {
data.info.setSdkSandboxStorage(data.sdkSandboxClientAppPackage);
}
if (agent != null) {
handleAttachAgent(agent, data.info);

View File

@@ -1998,7 +1998,7 @@ class ContextImpl extends Context {
private boolean bindServiceCommon(Intent service, ServiceConnection conn, int flags,
String instanceName, Handler handler, Executor executor, UserHandle user) {
// Keep this in sync with DevicePolicyManager.bindDeviceAdminServiceAsUser and
// ActivityManagerLocal.bindSupplementalProcessService
// ActivityManagerLocal.bindSdkSandboxService
IServiceConnection sd;
if (conn == null) {
throw new IllegalArgumentException("connection is null");

View File

@@ -72,6 +72,7 @@ oneway interface IApplicationThread {
@UnsupportedAppUsage
void scheduleStopService(IBinder token);
void bindApplication(in String packageName, in ApplicationInfo info,
in String sdkSandboxClientAppPackage,
in ProviderInfoList providerList, in ComponentName testName,
in ProfilerInfo profilerInfo, in Bundle testArguments,
IInstrumentationWatcher testWatcher, IUiAutomationConnection uiAutomationConnection,

View File

@@ -37,6 +37,7 @@ import android.content.res.CompatibilityInfo;
import android.content.res.Resources;
import android.os.Build;
import android.os.Bundle;
import android.os.Environment;
import android.os.FileUtils;
import android.os.GraphicsEnvironment;
import android.os.Handler;
@@ -411,6 +412,26 @@ public final class LoadedApk {
}
}
/** @hide */
void setSdkSandboxStorage(String sdkSandboxClientAppPackage) {
int userId = UserHandle.myUserId();
mDeviceProtectedDataDirFile = Environment
.getDataMiscDeSharedSdkSandboxDirectory(userId, sdkSandboxClientAppPackage)
.getAbsoluteFile();
mCredentialProtectedDataDirFile = Environment
.getDataMiscCeSharedSdkSandboxDirectory(userId, sdkSandboxClientAppPackage)
.getAbsoluteFile();
if ((mApplicationInfo.privateFlags
& ApplicationInfo.PRIVATE_FLAG_DEFAULT_TO_DEVICE_PROTECTED_STORAGE) != 0
&& PackageManager.APPLY_DEFAULT_TO_DEVICE_PROTECTED_STORAGE) {
mDataDirFile = mDeviceProtectedDataDirFile;
} else {
mDataDirFile = mCredentialProtectedDataDirFile;
}
mDataDir = mDataDirFile.getAbsolutePath();
}
public static void makePaths(ActivityThread activityThread,
ApplicationInfo aInfo,
List<String> outZipPaths) {

View File

@@ -477,11 +477,21 @@ public class Environment {
return buildPath(getDataDirectory(), "misc_ce", String.valueOf(userId));
}
/** {@hide} */
public static File getDataMiscCeSharedSdkSandboxDirectory(int userId, String packageName) {
return buildPath(getDataMiscCeDirectory(userId), "sdksandbox", packageName, "shared");
}
/** {@hide} */
public static File getDataMiscDeDirectory(int userId) {
return buildPath(getDataDirectory(), "misc_de", String.valueOf(userId));
}
/** {@hide} */
public static File getDataMiscDeSharedSdkSandboxDirectory(int userId, String packageName) {
return buildPath(getDataMiscDeDirectory(userId), "sdksandbox", packageName, "shared");
}
private static File getDataProfilesDeDirectory(int userId) {
return buildPath(getDataDirectory(), "misc", "profiles", "cur", String.valueOf(userId));
}

View File

@@ -424,6 +424,7 @@ public class TransactionParcelTests {
@Override
public void bindApplication(String s, ApplicationInfo applicationInfo,
String sdkSandboxClientAppPackage,
ProviderInfoList list, ComponentName componentName, ProfilerInfo profilerInfo,
Bundle bundle, IInstrumentationWatcher iInstrumentationWatcher,
IUiAutomationConnection iUiAutomationConnection, int i, boolean b, boolean b1,

View File

@@ -38,7 +38,7 @@ package com.android.server {
package com.android.server.am {
public interface ActivityManagerLocal {
method public boolean bindSdkSandboxService(@NonNull android.content.Intent, @NonNull android.content.ServiceConnection, int, @NonNull String, int) throws android.os.RemoteException;
method public boolean bindSdkSandboxService(@NonNull android.content.Intent, @NonNull android.content.ServiceConnection, int, @NonNull String, @NonNull String, int) throws android.os.RemoteException;
method public boolean canStartForegroundService(int, int, @NonNull String);
}

View File

@@ -2722,7 +2722,7 @@ public final class ActiveServices {
int bindServiceLocked(IApplicationThread caller, IBinder token, Intent service,
String resolvedType, final IServiceConnection connection, int flags,
String instanceName, boolean isSdkSandboxService, int sdkSandboxClientAppUid,
String callingPackage, final int userId)
String sdkSandboxClientAppPackage, String callingPackage, final int userId)
throws TransactionTooLargeException {
if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "bindService: " + service
+ " type=" + resolvedType + " conn=" + connection.asBinder()
@@ -2807,8 +2807,9 @@ public final class ActiveServices {
final boolean allowInstant = (flags & Context.BIND_ALLOW_INSTANT) != 0;
ServiceLookupResult res = retrieveServiceLocked(service, instanceName,
isSdkSandboxService, sdkSandboxClientAppUid, resolvedType, callingPackage,
callingPid, callingUid, userId, true, callerFg, isBindExternal, allowInstant);
isSdkSandboxService, sdkSandboxClientAppUid, sdkSandboxClientAppPackage,
resolvedType, callingPackage, callingPid, callingUid, userId, true, callerFg,
isBindExternal, allowInstant);
if (res == null) {
return 0;
}
@@ -3228,14 +3229,14 @@ public final class ActiveServices {
int callingPid, int callingUid, int userId,
boolean createIfNeeded, boolean callingFromFg, boolean isBindExternal,
boolean allowInstant) {
return retrieveServiceLocked(service, instanceName, false, 0, resolvedType, callingPackage,
callingPid, callingUid, userId, createIfNeeded, callingFromFg, isBindExternal,
allowInstant);
return retrieveServiceLocked(service, instanceName, false, 0, null, resolvedType,
callingPackage, callingPid, callingUid, userId, createIfNeeded, callingFromFg,
isBindExternal, allowInstant);
}
private ServiceLookupResult retrieveServiceLocked(Intent service,
String instanceName, boolean isSdkSandboxService, int sdkSandboxClientAppUid,
String resolvedType,
String sdkSandboxClientAppPackage, String resolvedType,
String callingPackage, int callingPid, int callingUid, int userId,
boolean createIfNeeded, boolean callingFromFg, boolean isBindExternal,
boolean allowInstant) {
@@ -3416,7 +3417,8 @@ public final class ActiveServices {
: null;
r = new ServiceRecord(mAm, className, name, definingPackageName,
definingUid, filter, sInfo, callingFromFg, res,
sdkSandboxProcessName, sdkSandboxClientAppUid);
sdkSandboxProcessName, sdkSandboxClientAppUid,
sdkSandboxClientAppPackage);
res.setService(r);
smap.mServicesByInstanceName.put(name, r);
smap.mServicesByIntent.put(filter, r);
@@ -4195,7 +4197,7 @@ public final class ActiveServices {
if (r.isSdkSandbox) {
final int uid = Process.toSdkSandboxUid(r.sdkSandboxClientAppUid);
app = mAm.startSdkSandboxProcessLocked(procName, r.appInfo, true, intentFlags,
hostingRecord, ZYGOTE_POLICY_FLAG_EMPTY, uid);
hostingRecord, ZYGOTE_POLICY_FLAG_EMPTY, uid, r.sdkSandboxClientAppPackage);
r.isolationHostProc = app;
} else {
app = mAm.startProcessLocked(procName, r.appInfo, true, intentFlags,

View File

@@ -74,6 +74,8 @@ public interface ActivityManagerLocal {
* @param conn Receives information as the service is started and stopped.
* This must be a valid ServiceConnection object; it must not be null.
* @param clientAppUid Uid of the app for which the sdk sandbox process needs to be spawned.
* @param clientAppPackage Package of the app for which the sdk sandbox process needs to
* be spawned. This package must belong to the clientAppUid.
* @param processName Unique identifier for the service instance. Each unique name here will
* result in a different service instance being created. Identifiers must only contain
* ASCII letters, digits, underscores, and periods.
@@ -87,6 +89,7 @@ public interface ActivityManagerLocal {
*/
@SuppressLint("RethrowRemoteException")
boolean bindSdkSandboxService(@NonNull Intent service, @NonNull ServiceConnection conn,
int clientAppUid, @NonNull String processName, @Context.BindServiceFlags int flags)
int clientAppUid, @NonNull String clientAppPackage, @NonNull String processName,
@Context.BindServiceFlags int flags)
throws RemoteException;
}

View File

@@ -36,6 +36,7 @@ import static android.app.ActivityManager.PROCESS_STATE_TOP;
import static android.app.ActivityManager.StopUserOnSwitch;
import static android.app.ActivityManagerInternal.ALLOW_FULL_ONLY;
import static android.app.ActivityManagerInternal.ALLOW_NON_FULL;
import static android.app.AppOpsManager.MODE_ALLOWED;
import static android.app.AppOpsManager.OP_NONE;
import static android.content.pm.ApplicationInfo.HIDDEN_API_ENFORCEMENT_DEFAULT;
import static android.content.pm.PackageManager.GET_SHARED_LIBRARY_FILES;
@@ -1895,6 +1896,7 @@ public class ActivityManagerService extends IActivityManager.Stub
0,
false,
0,
null,
new HostingRecord("system"));
app.setPersistent(true);
app.setPid(MY_PID);
@@ -2783,7 +2785,8 @@ public class ActivityManagerService extends IActivityManager.Stub
false /* knownToBeDead */, 0 /* intentFlags */,
sNullHostingRecord /* hostingRecord */, ZYGOTE_POLICY_FLAG_EMPTY,
true /* allowWhileBooting */, true /* isolated */,
uid, false /* supplemental */, 0 /* supplementalUid */,
uid, false /* isSdkSandbox */, 0 /* sdkSandboxUid */,
null /* sdkSandboxClientAppPackage */,
abiOverride, entryPoint, entryPointArgs, crashHandler);
return proc != null;
}
@@ -2792,11 +2795,12 @@ public class ActivityManagerService extends IActivityManager.Stub
@GuardedBy("this")
final ProcessRecord startSdkSandboxProcessLocked(String processName,
ApplicationInfo info, boolean knownToBeDead, int intentFlags,
HostingRecord hostingRecord, int zygotePolicyFlags, int sdkSandboxUid) {
HostingRecord hostingRecord, int zygotePolicyFlags, int sdkSandboxUid,
String sdkSandboxClientAppPackage) {
return mProcessList.startProcessLocked(processName, info, knownToBeDead, intentFlags,
hostingRecord, zygotePolicyFlags, false /* allowWhileBooting */,
false /* isolated */, 0 /* isolatedUid */,
true /* isSdkSandbox */, sdkSandboxUid,
true /* isSdkSandbox */, sdkSandboxUid, sdkSandboxClientAppPackage,
null /* ABI override */, null /* entryPoint */,
null /* entryPointArgs */, null /* crashHandler */);
}
@@ -2808,7 +2812,8 @@ public class ActivityManagerService extends IActivityManager.Stub
boolean isolated) {
return mProcessList.startProcessLocked(processName, info, knownToBeDead, intentFlags,
hostingRecord, zygotePolicyFlags, allowWhileBooting, isolated, 0 /* isolatedUid */,
false /* isSdkSandbox */, 0 /* sdkSandboxClientdAppUid */,
false /* isSdkSandbox */, 0 /* sdkSandboxClientAppUid */,
null /* sdkSandboxClientAppPackage */,
null /* ABI override */, null /* entryPoint */,
null /* entryPointArgs */, null /* crashHandler */);
}
@@ -4773,7 +4778,8 @@ public class ActivityManagerService extends IActivityManager.Stub
thread.runIsolatedEntryPoint(
app.getIsolatedEntryPoint(), app.getIsolatedEntryPointArgs());
} else if (instr2 != null) {
thread.bindApplication(processName, appInfo, providerList,
thread.bindApplication(processName, appInfo, app.sdkSandboxClientAppPackage,
providerList,
instr2.mClass,
profilerInfo, instr2.mArguments,
instr2.mWatcher,
@@ -4787,8 +4793,8 @@ public class ActivityManagerService extends IActivityManager.Stub
app.getDisabledCompatChanges(), serializedSystemFontMap,
app.getStartElapsedTime(), app.getStartUptime());
} else {
thread.bindApplication(processName, appInfo, providerList, null, profilerInfo,
null, null, null, testMode,
thread.bindApplication(processName, appInfo, app.sdkSandboxClientAppPackage,
providerList, null, profilerInfo, null, null, null, testMode,
mBinderTransactionTrackingEnabled, enableTrackAllocation,
isRestrictedBackupMode || !normalMode, app.isPersistent(),
new Configuration(app.getWindowProcessController().getConfiguration()),
@@ -6553,7 +6559,7 @@ public class ActivityManagerService extends IActivityManager.Stub
if (app == null) {
app = mProcessList.newProcessRecordLocked(info, customProcess, isolated, 0,
false, 0,
false, 0, null,
new HostingRecord("added application",
customProcess != null ? customProcess : info.processName));
updateLruProcessLocked(app, false, null);
@@ -12395,13 +12401,13 @@ public class ActivityManagerService extends IActivityManager.Stub
String resolvedType, IServiceConnection connection, int flags, String instanceName,
String callingPackage, int userId) throws TransactionTooLargeException {
return bindServiceInstance(caller, token, service, resolvedType, connection, flags,
instanceName, false, 0, callingPackage, userId);
instanceName, false, 0, null, callingPackage, userId);
}
private int bindServiceInstance(IApplicationThread caller, IBinder token, Intent service,
String resolvedType, IServiceConnection connection, int flags, String instanceName,
boolean isSdkSandboxService, int sdkSandboxClientdAppUid, String callingPackage,
int userId)
boolean isSdkSandboxService, int sdkSandboxClientAppUid,
String sdkSandboxClientAppPackage, String callingPackage, int userId)
throws TransactionTooLargeException {
enforceNotIsolatedCaller("bindService");
@@ -12438,8 +12444,8 @@ public class ActivityManagerService extends IActivityManager.Stub
}
synchronized (this) {
return mServices.bindServiceLocked(caller, token, service, resolvedType, connection,
flags, instanceName, isSdkSandboxService, sdkSandboxClientdAppUid,
callingPackage, userId);
flags, instanceName, isSdkSandboxService, sdkSandboxClientAppUid,
sdkSandboxClientAppPackage, callingPackage, userId);
}
} finally {
Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
@@ -16022,22 +16028,29 @@ public class ActivityManagerService extends IActivityManager.Stub
@Override
public boolean bindSdkSandboxService(Intent service, ServiceConnection conn,
int userAppUid, String processName, int flags) throws RemoteException {
int clientAppUid, String clientAppPackage, String processName, int flags)
throws RemoteException {
if (service == null) {
throw new IllegalArgumentException("intent is null");
}
if (conn == null) {
throw new IllegalArgumentException("connection is null");
}
if (clientAppPackage == null) {
throw new IllegalArgumentException("clientAppPackage is null");
}
if (processName == null) {
throw new IllegalArgumentException("processName is null");
}
if (service.getComponent() == null) {
throw new IllegalArgumentException("service must specify explicit component");
}
if (!UserHandle.isApp(userAppUid)) {
if (!UserHandle.isApp(clientAppUid)) {
throw new IllegalArgumentException("uid is not within application range");
}
if (mAppOpsService.checkPackage(clientAppUid, clientAppPackage) != MODE_ALLOWED) {
throw new IllegalArgumentException("uid does not belong to provided package");
}
Handler handler = mContext.getMainThreadHandler();
@@ -16046,8 +16059,8 @@ public class ActivityManagerService extends IActivityManager.Stub
return ActivityManagerService.this.bindServiceInstance(
mContext.getIApplicationThread(), mContext.getActivityToken(), service,
service.resolveTypeIfNeeded(mContext.getContentResolver()), sd, flags,
processName, /*isSupplementalProcessService*/ true, userAppUid,
mContext.getOpPackageName(), UserHandle.getUserId(userAppUid)) != 0;
processName, /*isSdkSandboxService*/ true, clientAppUid, clientAppPackage,
mContext.getOpPackageName(), UserHandle.getUserId(clientAppUid)) != 0;
}
@Override

View File

@@ -2365,7 +2365,7 @@ public final class ProcessList {
ProcessRecord startProcessLocked(String processName, ApplicationInfo info,
boolean knownToBeDead, int intentFlags, HostingRecord hostingRecord,
int zygotePolicyFlags, boolean allowWhileBooting, boolean isolated, int isolatedUid,
boolean isSdkSandbox, int sdkSandboxUid,
boolean isSdkSandbox, int sdkSandboxUid, String sdkSandboxClientAppPackage,
String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) {
long startTime = SystemClock.uptimeMillis();
ProcessRecord app;
@@ -2460,7 +2460,7 @@ public final class ProcessList {
if (app == null) {
checkSlow(startTime, "startProcess: creating new process record");
app = newProcessRecordLocked(info, processName, isolated, isolatedUid, isSdkSandbox,
sdkSandboxUid, hostingRecord);
sdkSandboxUid, sdkSandboxClientAppPackage, hostingRecord);
if (app == null) {
Slog.w(TAG, "Failed making new process record for "
+ processName + "/" + info.uid + " isolated=" + isolated);
@@ -2956,7 +2956,7 @@ public final class ProcessList {
@GuardedBy("mService")
ProcessRecord newProcessRecordLocked(ApplicationInfo info, String customProcess,
boolean isolated, int isolatedUid, boolean isSdkSandbox, int sdkSandboxUid,
HostingRecord hostingRecord) {
String sdkSandboxClientAppPackage, HostingRecord hostingRecord) {
String proc = customProcess != null ? customProcess : info.processName;
final int userId = UserHandle.getUserId(info.uid);
int uid = info.uid;
@@ -2992,6 +2992,7 @@ public final class ProcessList {
FrameworkStatsLog.ISOLATED_UID_CHANGED__EVENT__CREATED);
}
final ProcessRecord r = new ProcessRecord(mService, info, proc, uid,
sdkSandboxClientAppPackage,
hostingRecord.getDefiningUid(), hostingRecord.getDefiningProcessName());
final ProcessStateRecord state = r.mState;

View File

@@ -84,6 +84,8 @@ class ProcessRecord implements WindowProcessListener {
final int uid; // uid of process; may be different from 'info' if isolated
final int userId; // user of process.
final String processName; // name of the process
final String sdkSandboxClientAppPackage; // if this is an sdk sandbox process, name of the
// app package for which it is running
/**
* Overall state of process's uid.
@@ -493,11 +495,12 @@ class ProcessRecord implements WindowProcessListener {
ProcessRecord(ActivityManagerService _service, ApplicationInfo _info, String _processName,
int _uid) {
this(_service, _info, _processName, _uid, -1, null);
this(_service, _info, _processName, _uid, null, -1, null);
}
ProcessRecord(ActivityManagerService _service, ApplicationInfo _info, String _processName,
int _uid, int _definingUid, String _definingProcessName) {
int _uid, String _sdkSandboxClientAppPackage, int _definingUid,
String _definingProcessName) {
mService = _service;
mProcLock = _service.mProcLock;
info = _info;
@@ -530,6 +533,7 @@ class ProcessRecord implements WindowProcessListener {
uid = _uid;
userId = UserHandle.getUserId(_uid);
processName = _processName;
sdkSandboxClientAppPackage = _sdkSandboxClientAppPackage;
mPersistent = false;
mRemoved = false;
mProfile = new ProcessProfileRecord(this);

View File

@@ -96,6 +96,8 @@ final class ServiceRecord extends Binder implements ComponentName.WithComponentN
final long createRealTime; // when this service was created
final boolean isSdkSandbox; // whether this is a sdk sandbox service
final int sdkSandboxClientAppUid; // the app uid for which this sdk sandbox service is running
final String sdkSandboxClientAppPackage; // the app package for which this sdk sandbox service
// is running
final ArrayMap<Intent.FilterComparison, IntentBindRecord> bindings
= new ArrayMap<Intent.FilterComparison, IntentBindRecord>();
// All active bindings to the service.
@@ -573,13 +575,14 @@ final class ServiceRecord extends Binder implements ComponentName.WithComponentN
Intent.FilterComparison intent, ServiceInfo sInfo, boolean callerIsFg,
Runnable restarter) {
this(ams, name, instanceName, definingPackageName, definingUid, intent, sInfo, callerIsFg,
restarter, null, 0);
restarter, null, 0, null);
}
ServiceRecord(ActivityManagerService ams, ComponentName name,
ComponentName instanceName, String definingPackageName, int definingUid,
Intent.FilterComparison intent, ServiceInfo sInfo, boolean callerIsFg,
Runnable restarter, String sdkSandboxProcessName, int sdkSandboxClientAppUid) {
Runnable restarter, String sdkSandboxProcessName, int sdkSandboxClientAppUid,
String sdkSandboxClientAppPackage) {
this.ams = ams;
this.name = name;
this.instanceName = instanceName;
@@ -590,8 +593,9 @@ final class ServiceRecord extends Binder implements ComponentName.WithComponentN
serviceInfo = sInfo;
appInfo = sInfo.applicationInfo;
packageName = sInfo.applicationInfo.packageName;
isSdkSandbox = sdkSandboxProcessName != null;
this.isSdkSandbox = sdkSandboxProcessName != null;
this.sdkSandboxClientAppUid = sdkSandboxClientAppUid;
this.sdkSandboxClientAppPackage = sdkSandboxClientAppPackage;
if ((sInfo.flags & ServiceInfo.FLAG_ISOLATED_PROCESS) != 0) {
processName = sInfo.processName + ":" + instanceName.getClassName();
} else if (sdkSandboxProcessName != null) {