From 6c60c5c7c1cf671066838413c6d799e9df244bc0 Mon Sep 17 00:00:00 2001
From: Michael Groover <mpgroover@google.com>
Date: Mon, 9 Aug 2021 19:50:56 -0700
Subject: [PATCH] Create new instance of shared lineage signers to preserve
 capabilities

When the platform writes package signatures to packages.xml the first
instance of a shared signature is written with the hex value of the
ANS.1 DER encoding and an index; subsequent instances of the same
signature just reference it via the index value. When writing a
previous signer in the lineage a flags attribute is also written
containing the capabilities of this previous signer in the lineage.
During boot the platform will read the packages and signatures from
the packages.xml, but when a shared signer is read the initial
instance of the signature is used for all packages that share this
same signer even if the signer is a previous signer with its own
capabilities. This causes the platform to lose the unique
capabilities granted to each signing lineage that use the same
signatures and can prevent apps from being able to join a
sharedUserId if another app with a lineage has revoked this
capability from its own signer. This commit creates a new signature
for each shared signature used as a previous signer in the
lineage to ensure these unique capabilities are maintained.

Bug: 195789348
Test: atest PkgInstallSignatureVerificationTest#
  testSharedKeyInSeparateLineageRetainsDeclaredCapabilities
Change-Id: I0f763a1b1b004c6e6e4f80d0e401ad5d4c4fab34
---
 .../java/com/android/server/pm/PackageSignatures.java | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/services/core/java/com/android/server/pm/PackageSignatures.java b/services/core/java/com/android/server/pm/PackageSignatures.java
index 394cdee8f9179..83f54f1567509 100644
--- a/services/core/java/com/android/server/pm/PackageSignatures.java
+++ b/services/core/java/com/android/server/pm/PackageSignatures.java
@@ -174,7 +174,16 @@ class PackageSignatures {
                                 if (index >= 0 && index < readSignatures.size()) {
                                     Signature sig = readSignatures.get(index);
                                     if (sig != null) {
-                                        signatures.add(sig);
+                                        // An app using a shared signature in its signing lineage
+                                        // can have unique capabilities assigned to this previous
+                                        // signer; create a new instance of this Signature to ensure
+                                        // its flags do not overwrite those of the instance from
+                                        // readSignatures.
+                                        if (isPastSigs) {
+                                            signatures.add(new Signature(sig));
+                                        } else {
+                                            signatures.add(sig);
+                                        }
                                         signatureParsed = true;
                                     } else {
                                         PackageManagerService.reportSettingsProblem(Log.WARN,