From 7ac9a05dbe9fa7be060ccc2d320ab1f8b8403b53 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bram=20Bonn=C3=A9?= Date: Fri, 9 Jul 2021 09:30:33 +0200 Subject: [PATCH] Map SELINUX_LATEST_CHANGES to Build.CUR_DEVELOPMENT The SELINUX_LATEST_CHANGES AppCompat flag should always put the app in the SELinux domain targeting the current release. Fixing its target SDK to CUR_DEVELOPMENT ensures that it always gets added to the latest SELinux domain. Bug: 193151214 Bug: 171572148 Test: atest CtsSelinuxTargetSdkCurrentTestCases Test: atest CtsSelinuxTargetSdk30TestCases Test: atest CtsSelinuxTargetSdk29TestCases Test: atest CtsSelinuxTargetSdk28TestCases Test: atest CtsSelinuxTargetSdk27TestCases Test: atest CompatChangesSelinuxTest Change-Id: I643a65e79e076518c27c31d05229ee509fa35ec5 --- services/core/java/com/android/server/pm/SELinuxMMAC.java | 8 +++++--- .../src/com/android/server/pm/SELinuxMMACTest.java | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/services/core/java/com/android/server/pm/SELinuxMMAC.java b/services/core/java/com/android/server/pm/SELinuxMMAC.java index 4ba73688fa806..4a913e4edd712 100644 --- a/services/core/java/com/android/server/pm/SELinuxMMAC.java +++ b/services/core/java/com/android/server/pm/SELinuxMMAC.java @@ -17,6 +17,7 @@ package com.android.server.pm; import android.compat.annotation.ChangeId; +import android.compat.annotation.Disabled; import android.compat.annotation.EnabledAfter; import android.content.pm.ApplicationInfo; import android.content.pm.PackageParser.SigningDetails; @@ -79,13 +80,13 @@ public final class SELinuxMMAC { /** * Allows opt-in to the latest targetSdkVersion enforced changes without changing target SDK. - * Turning this change off for an app targeting the latest SDK or higher is a no-op. + * Turning this change on for an app targeting the latest SDK or higher is a no-op. * *

Has no effect for apps using shared user id. * * TODO(b/143539591): Update description with relevant SELINUX changes this opts in to. */ - @EnabledAfter(targetSdkVersion = android.os.Build.VERSION_CODES.R) + @Disabled @ChangeId static final long SELINUX_LATEST_CHANGES = 143539591L; @@ -364,7 +365,8 @@ public final class SELinuxMMAC { } final ApplicationInfo appInfo = pkg.toAppInfoWithoutState(); if (compatibility.isChangeEnabledInternal(SELINUX_LATEST_CHANGES, appInfo)) { - return Math.max(android.os.Build.VERSION_CODES.S, pkg.getTargetSdkVersion()); + return Math.max( + android.os.Build.VERSION_CODES.CUR_DEVELOPMENT, pkg.getTargetSdkVersion()); } else if (compatibility.isChangeEnabledInternal(SELINUX_R_CHANGES, appInfo)) { return Math.max(android.os.Build.VERSION_CODES.R, pkg.getTargetSdkVersion()); } diff --git a/services/tests/servicestests/src/com/android/server/pm/SELinuxMMACTest.java b/services/tests/servicestests/src/com/android/server/pm/SELinuxMMACTest.java index cee4cda99e468..901b200417c94 100644 --- a/services/tests/servicestests/src/com/android/server/pm/SELinuxMMACTest.java +++ b/services/tests/servicestests/src/com/android/server/pm/SELinuxMMACTest.java @@ -44,7 +44,7 @@ import org.mockito.junit.MockitoJUnitRunner; public class SELinuxMMACTest { private static final String PACKAGE_NAME = "my.package"; - private static final int LATEST_OPT_IN_VERSION = Build.VERSION_CODES.S; + private static final int LATEST_OPT_IN_VERSION = Build.VERSION_CODES.CUR_DEVELOPMENT; private static final int R_OPT_IN_VERSION = Build.VERSION_CODES.R; @Mock