Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Migrate DynamicSystemService to @EnforcePermission" am: b845dbac21

Browse Source 
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1946229

Change-Id: If384a009855a7d26bf4f7bc429f250c351dd5501
This commit is contained in:
Thiébaud Weksteen
2022-02-09 05:34:02 +00:00
committed by Automerger Merge Worker
parent 8b2b5eb434 b845dbac21
commit 746cfb436c
2 changed files with 32 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
core/java/android/os/image/IDynamicSystemService.aidl
View File

@@ -26,6 +26,7 @@ interface IDynamicSystemService
* @param dsuSlot Name used to identify this installation * @param dsuSlot Name used to identify this installation
* @return true if the call succeeds * @return true if the call succeeds
*/ */
@EnforcePermission("MANAGE_DYNAMIC_SYSTEM")
boolean startInstallation(@utf8InCpp String dsuSlot); boolean startInstallation(@utf8InCpp String dsuSlot);
/** /**
@@ -36,6 +37,7 @@ interface IDynamicSystemService
* @param readOnly True if this partition is readOnly * @param readOnly True if this partition is readOnly
* @return true if the call succeeds * @return true if the call succeeds
*/ */
@EnforcePermission("MANAGE_DYNAMIC_SYSTEM")
boolean createPartition(@utf8InCpp String name, long size, boolean readOnly); boolean createPartition(@utf8InCpp String name, long size, boolean readOnly);
/** /**
@@ -43,12 +45,14 @@ interface IDynamicSystemService
* *
* @return true if the partition installation completes without error. * @return true if the partition installation completes without error.
*/ */
@EnforcePermission("MANAGE_DYNAMIC_SYSTEM")
boolean closePartition(); boolean closePartition();
/** /**
* Finish a previously started installation. Installations without * Finish a previously started installation. Installations without
* a cooresponding finishInstallation() will be cleaned up during device boot. * a cooresponding finishInstallation() will be cleaned up during device boot.
*/ */
@EnforcePermission("MANAGE_DYNAMIC_SYSTEM")
boolean finishInstallation(); boolean finishInstallation();
/** /**
@@ -57,6 +61,7 @@ interface IDynamicSystemService
* *
* @return GsiProgress * @return GsiProgress
*/ */
@EnforcePermission("MANAGE_DYNAMIC_SYSTEM")
GsiProgress getInstallationProgress(); GsiProgress getInstallationProgress();
/** /**
@@ -66,21 +71,25 @@ interface IDynamicSystemService
* *
* @return true if the call succeeds * @return true if the call succeeds
*/ */
@EnforcePermission("MANAGE_DYNAMIC_SYSTEM")
boolean abort(); boolean abort();
/** /**
* @return true if the device is running an DynamicAnroid image * @return true if the device is running an DynamicAnroid image
*/ */
@RequiresNoPermission
boolean isInUse(); boolean isInUse();
/** /**
* @return true if the device has an DynamicSystem image installed * @return true if the device has an DynamicSystem image installed
*/ */
@RequiresNoPermission
boolean isInstalled(); boolean isInstalled();
/** /**
* @return true if the device has an DynamicSystem image enabled * @return true if the device has an DynamicSystem image enabled
*/ */
@EnforcePermission("MANAGE_DYNAMIC_SYSTEM")
boolean isEnabled(); boolean isEnabled();
/** /**
@@ -88,6 +97,7 @@ interface IDynamicSystemService
* *
* @return true if the call succeeds * @return true if the call succeeds
*/ */
@EnforcePermission("MANAGE_DYNAMIC_SYSTEM")
boolean remove(); boolean remove();
/** /**
@@ -97,6 +107,7 @@ interface IDynamicSystemService
* *
* @return true if the call succeeds * @return true if the call succeeds
*/ */
@EnforcePermission("MANAGE_DYNAMIC_SYSTEM")
boolean setEnable(boolean enable, boolean oneShot); boolean setEnable(boolean enable, boolean oneShot);
/** /**
@@ -106,6 +117,7 @@ interface IDynamicSystemService
* @param fd fd that points to a ashmem * @param fd fd that points to a ashmem
* @param size size of the ashmem file * @param size size of the ashmem file
*/ */
@EnforcePermission("MANAGE_DYNAMIC_SYSTEM")
boolean setAshmem(in ParcelFileDescriptor fd, long size); boolean setAshmem(in ParcelFileDescriptor fd, long size);
/** /**
@@ -115,6 +127,7 @@ interface IDynamicSystemService
* @param bytes number of bytes that can be read from stream. * @param bytes number of bytes that can be read from stream.
* @return true on success, false otherwise. * @return true on success, false otherwise.
*/ */
@EnforcePermission("MANAGE_DYNAMIC_SYSTEM")
boolean submitFromAshmem(long bytes); boolean submitFromAshmem(long bytes);
/** /**
@@ -124,10 +137,12 @@ interface IDynamicSystemService
* @return true on success, false if partition doesn't have a * @return true on success, false if partition doesn't have a
* valid VBMeta block to retrieve the AVB key from. * valid VBMeta block to retrieve the AVB key from.
*/ */
@EnforcePermission("MANAGE_DYNAMIC_SYSTEM")
boolean getAvbPublicKey(out AvbPublicKey dst); boolean getAvbPublicKey(out AvbPublicKey dst);
/** /**
* Returns the suggested scratch partition size for overlayFS. * Returns the suggested scratch partition size for overlayFS.
*/ */
@EnforcePermission("MANAGE_DYNAMIC_SYSTEM")
long suggestScratchSize(); long suggestScratchSize();
} }

26
services/core/java/com/android/server/DynamicSystemService.java
View File

@@ -16,8 +16,9 @@
package com.android.server; package com.android.server;
import android.annotation.EnforcePermission;
import android.annotation.RequiresNoPermission;
import android.content.Context; import android.content.Context;
import android.content.pm.PackageManager;
import android.gsi.AvbPublicKey; import android.gsi.AvbPublicKey;
import android.gsi.GsiProgress; import android.gsi.GsiProgress;
import android.gsi.IGsiService; import android.gsi.IGsiService;
@@ -53,20 +54,12 @@ public class DynamicSystemService extends IDynamicSystemService.Stub {
} }
private IGsiService getGsiService() { private IGsiService getGsiService() {
checkPermission();
if (mGsiService != null) { if (mGsiService != null) {
return mGsiService; return mGsiService;
} }
return IGsiService.Stub.asInterface(ServiceManager.waitForService("gsiservice")); return IGsiService.Stub.asInterface(ServiceManager.waitForService("gsiservice"));
} }
private void checkPermission() {
if (mContext.checkCallingOrSelfPermission(android.Manifest.permission.MANAGE_DYNAMIC_SYSTEM)
!= PackageManager.PERMISSION_GRANTED) {
throw new SecurityException("Requires MANAGE_DYNAMIC_SYSTEM permission");
}
}
class GsiServiceCallback extends IGsiServiceCallback.Stub { class GsiServiceCallback extends IGsiServiceCallback.Stub {
// 0 for success // 0 for success
private int mResult = -1; private int mResult = -1;
@@ -82,6 +75,7 @@ public class DynamicSystemService extends IDynamicSystemService.Stub {
} }
@Override @Override
@EnforcePermission(android.Manifest.permission.MANAGE_DYNAMIC_SYSTEM)
public boolean startInstallation(String dsuSlot) throws RemoteException { public boolean startInstallation(String dsuSlot) throws RemoteException {
IGsiService service = getGsiService(); IGsiService service = getGsiService();
mGsiService = service; mGsiService = service;
@@ -124,6 +118,7 @@ public class DynamicSystemService extends IDynamicSystemService.Stub {
} }
@Override @Override
@EnforcePermission(android.Manifest.permission.MANAGE_DYNAMIC_SYSTEM)
public boolean createPartition(String name, long size, boolean readOnly) public boolean createPartition(String name, long size, boolean readOnly)
throws RemoteException { throws RemoteException {
IGsiService service = getGsiService(); IGsiService service = getGsiService();
@@ -135,6 +130,7 @@ public class DynamicSystemService extends IDynamicSystemService.Stub {
} }
@Override @Override
@EnforcePermission(android.Manifest.permission.MANAGE_DYNAMIC_SYSTEM)
public boolean closePartition() throws RemoteException { public boolean closePartition() throws RemoteException {
IGsiService service = getGsiService(); IGsiService service = getGsiService();
if (service.closePartition() != 0) { if (service.closePartition() != 0) {
@@ -145,6 +141,7 @@ public class DynamicSystemService extends IDynamicSystemService.Stub {
} }
@Override @Override
@EnforcePermission(android.Manifest.permission.MANAGE_DYNAMIC_SYSTEM)
public boolean finishInstallation() throws RemoteException { public boolean finishInstallation() throws RemoteException {
IGsiService service = getGsiService(); IGsiService service = getGsiService();
if (service.closeInstall() != 0) { if (service.closeInstall() != 0) {
@@ -155,21 +152,25 @@ public class DynamicSystemService extends IDynamicSystemService.Stub {
} }
@Override @Override
@EnforcePermission(android.Manifest.permission.MANAGE_DYNAMIC_SYSTEM)
public GsiProgress getInstallationProgress() throws RemoteException { public GsiProgress getInstallationProgress() throws RemoteException {
return getGsiService().getInstallProgress(); return getGsiService().getInstallProgress();
} }
@Override @Override
@EnforcePermission(android.Manifest.permission.MANAGE_DYNAMIC_SYSTEM)
public boolean abort() throws RemoteException { public boolean abort() throws RemoteException {
return getGsiService().cancelGsiInstall(); return getGsiService().cancelGsiInstall();
} }
@Override @Override
@RequiresNoPermission
public boolean isInUse() { public boolean isInUse() {
return SystemProperties.getBoolean("ro.gsid.image_running", false); return SystemProperties.getBoolean("ro.gsid.image_running", false);
} }
@Override @Override
@RequiresNoPermission
public boolean isInstalled() { public boolean isInstalled() {
boolean installed = SystemProperties.getBoolean("gsid.image_installed", false); boolean installed = SystemProperties.getBoolean("gsid.image_installed", false);
Slog.i(TAG, "isInstalled(): " + installed); Slog.i(TAG, "isInstalled(): " + installed);
@@ -177,11 +178,13 @@ public class DynamicSystemService extends IDynamicSystemService.Stub {
} }
@Override @Override
@EnforcePermission(android.Manifest.permission.MANAGE_DYNAMIC_SYSTEM)
public boolean isEnabled() throws RemoteException { public boolean isEnabled() throws RemoteException {
return getGsiService().isGsiEnabled(); return getGsiService().isGsiEnabled();
} }
@Override @Override
@EnforcePermission(android.Manifest.permission.MANAGE_DYNAMIC_SYSTEM)
public boolean remove() throws RemoteException { public boolean remove() throws RemoteException {
try { try {
GsiServiceCallback callback = new GsiServiceCallback(); GsiServiceCallback callback = new GsiServiceCallback();
@@ -197,6 +200,7 @@ public class DynamicSystemService extends IDynamicSystemService.Stub {
} }
@Override @Override
@EnforcePermission(android.Manifest.permission.MANAGE_DYNAMIC_SYSTEM)
public boolean setEnable(boolean enable, boolean oneShot) throws RemoteException { public boolean setEnable(boolean enable, boolean oneShot) throws RemoteException {
IGsiService gsiService = getGsiService(); IGsiService gsiService = getGsiService();
if (enable) { if (enable) {
@@ -220,6 +224,7 @@ public class DynamicSystemService extends IDynamicSystemService.Stub {
} }
@Override @Override
@EnforcePermission(android.Manifest.permission.MANAGE_DYNAMIC_SYSTEM)
public boolean setAshmem(ParcelFileDescriptor ashmem, long size) { public boolean setAshmem(ParcelFileDescriptor ashmem, long size) {
try { try {
return getGsiService().setGsiAshmem(ashmem, size); return getGsiService().setGsiAshmem(ashmem, size);
@@ -229,6 +234,7 @@ public class DynamicSystemService extends IDynamicSystemService.Stub {
} }
@Override @Override
@EnforcePermission(android.Manifest.permission.MANAGE_DYNAMIC_SYSTEM)
public boolean submitFromAshmem(long size) { public boolean submitFromAshmem(long size) {
try { try {
return getGsiService().commitGsiChunkFromAshmem(size); return getGsiService().commitGsiChunkFromAshmem(size);
@@ -238,6 +244,7 @@ public class DynamicSystemService extends IDynamicSystemService.Stub {
} }
@Override @Override
@EnforcePermission(android.Manifest.permission.MANAGE_DYNAMIC_SYSTEM)
public boolean getAvbPublicKey(AvbPublicKey dst) { public boolean getAvbPublicKey(AvbPublicKey dst) {
try { try {
return getGsiService().getAvbPublicKey(dst) == 0; return getGsiService().getAvbPublicKey(dst) == 0;
@@ -247,6 +254,7 @@ public class DynamicSystemService extends IDynamicSystemService.Stub {
} }
@Override @Override
@EnforcePermission(android.Manifest.permission.MANAGE_DYNAMIC_SYSTEM)
public long suggestScratchSize() throws RemoteException { public long suggestScratchSize() throws RemoteException {
return getGsiService().suggestScratchSize(); return getGsiService().suggestScratchSize();
} }