From 7fbbe85a8eecc0e429bc71ed18888aaddb653ae9 Mon Sep 17 00:00:00 2001 From: Patrick Baumann Date: Wed, 29 Mar 2023 21:51:53 +0000 Subject: [PATCH] App may trigger bypass of update owner enforcement This change modifies the logic for enforcement of update ownership to allow the package being updated to bypass when it has its allowUpdateOwnership attribute set to false. Bug: 274120016 Test: atest UpdateOwnershipEnforcementTest SilentUpdateHostsideTests Change-Id: I5e9ccb8892a83f7d718f6c8dce7ddb4b8934d186 --- .../android/content/pm/parsing/ApkLite.java | 23 ++++++++-- .../content/pm/parsing/ApkLiteParseUtils.java | 10 +++-- .../content/pm/parsing/PackageLite.java | 22 ++++++++-- .../server/pm/PackageInstallerSession.java | 44 +++++++++---------- .../server/pm/PackageManagerShellCommand.java | 2 +- .../server/pm/dex/DexMetadataHelperTest.java | 3 +- 6 files changed, 68 insertions(+), 36 deletions(-) diff --git a/core/java/android/content/pm/parsing/ApkLite.java b/core/java/android/content/pm/parsing/ApkLite.java index 269bec2562820..408f7ed9f7664 100644 --- a/core/java/android/content/pm/parsing/ApkLite.java +++ b/core/java/android/content/pm/parsing/ApkLite.java @@ -138,6 +138,11 @@ public class ApkLite { */ private final boolean mIsSdkLibrary; + /** + * Indicates if this package allows an installer to declare update ownership of it. + */ + private final boolean mAllowUpdateOwnership; + public ApkLite(String path, String packageName, String splitName, boolean isFeatureSplit, String configForSplit, String usesSplitName, boolean isSplitRequired, int versionCode, int versionCodeMajor, int revisionCode, int installLocation, @@ -148,7 +153,7 @@ public class ApkLite { String requiredSystemPropertyName, String requiredSystemPropertyValue, int minSdkVersion, int targetSdkVersion, int rollbackDataPolicy, Set requiredSplitTypes, Set splitTypes, - boolean hasDeviceAdminReceiver, boolean isSdkLibrary) { + boolean hasDeviceAdminReceiver, boolean isSdkLibrary, boolean allowUpdateOwnership) { mPath = path; mPackageName = packageName; mSplitName = splitName; @@ -182,6 +187,7 @@ public class ApkLite { mRollbackDataPolicy = rollbackDataPolicy; mHasDeviceAdminReceiver = hasDeviceAdminReceiver; mIsSdkLibrary = isSdkLibrary; + mAllowUpdateOwnership = allowUpdateOwnership; } /** @@ -474,6 +480,9 @@ public class ApkLite { return mRollbackDataPolicy; } + /** + * Indicates if this app contains a {@link android.app.admin.DeviceAdminReceiver}. + */ @DataClass.Generated.Member public boolean isHasDeviceAdminReceiver() { return mHasDeviceAdminReceiver; @@ -487,11 +496,19 @@ public class ApkLite { return mIsSdkLibrary; } + /** + * Indicates if this package allows an installer to declare update ownership of it. + */ + @DataClass.Generated.Member + public boolean isAllowUpdateOwnership() { + return mAllowUpdateOwnership; + } + @DataClass.Generated( - time = 1643063342990L, + time = 1680122754650L, codegenVersion = "1.0.23", sourceFile = "frameworks/base/core/java/android/content/pm/parsing/ApkLite.java", - inputSignatures = "private final @android.annotation.NonNull java.lang.String mPackageName\nprivate final @android.annotation.NonNull java.lang.String mPath\nprivate final @android.annotation.Nullable java.lang.String mSplitName\nprivate final @android.annotation.Nullable java.lang.String mUsesSplitName\nprivate final @android.annotation.Nullable java.lang.String mConfigForSplit\nprivate final @android.annotation.Nullable java.util.Set mRequiredSplitTypes\nprivate final @android.annotation.Nullable java.util.Set mSplitTypes\nprivate final int mVersionCodeMajor\nprivate final int mVersionCode\nprivate final int mRevisionCode\nprivate final int mInstallLocation\nprivate final int mMinSdkVersion\nprivate final int mTargetSdkVersion\nprivate final @android.annotation.NonNull android.content.pm.VerifierInfo[] mVerifiers\nprivate final @android.annotation.NonNull android.content.pm.SigningDetails mSigningDetails\nprivate final boolean mFeatureSplit\nprivate final boolean mIsolatedSplits\nprivate final boolean mSplitRequired\nprivate final boolean mCoreApp\nprivate final boolean mDebuggable\nprivate final boolean mProfileableByShell\nprivate final boolean mMultiArch\nprivate final boolean mUse32bitAbi\nprivate final boolean mExtractNativeLibs\nprivate final boolean mUseEmbeddedDex\nprivate final @android.annotation.Nullable java.lang.String mTargetPackageName\nprivate final boolean mOverlayIsStatic\nprivate final int mOverlayPriority\nprivate final @android.annotation.Nullable java.lang.String mRequiredSystemPropertyName\nprivate final @android.annotation.Nullable java.lang.String mRequiredSystemPropertyValue\nprivate final int mRollbackDataPolicy\nprivate final boolean mHasDeviceAdminReceiver\nprivate final boolean mIsSdkLibrary\npublic long getLongVersionCode()\nprivate boolean hasAnyRequiredSplitTypes()\nclass ApkLite extends java.lang.Object implements []\n@com.android.internal.util.DataClass(genConstructor=false, genConstDefs=false)") + inputSignatures = "private final @android.annotation.NonNull java.lang.String mPackageName\nprivate final @android.annotation.NonNull java.lang.String mPath\nprivate final @android.annotation.Nullable java.lang.String mSplitName\nprivate final @android.annotation.Nullable java.lang.String mUsesSplitName\nprivate final @android.annotation.Nullable java.lang.String mConfigForSplit\nprivate final @android.annotation.Nullable java.util.Set mRequiredSplitTypes\nprivate final @android.annotation.Nullable java.util.Set mSplitTypes\nprivate final int mVersionCodeMajor\nprivate final int mVersionCode\nprivate final int mRevisionCode\nprivate final int mInstallLocation\nprivate final int mMinSdkVersion\nprivate final int mTargetSdkVersion\nprivate final @android.annotation.NonNull android.content.pm.VerifierInfo[] mVerifiers\nprivate final @android.annotation.NonNull android.content.pm.SigningDetails mSigningDetails\nprivate final boolean mFeatureSplit\nprivate final boolean mIsolatedSplits\nprivate final boolean mSplitRequired\nprivate final boolean mCoreApp\nprivate final boolean mDebuggable\nprivate final boolean mProfileableByShell\nprivate final boolean mMultiArch\nprivate final boolean mUse32bitAbi\nprivate final boolean mExtractNativeLibs\nprivate final boolean mUseEmbeddedDex\nprivate final @android.annotation.Nullable java.lang.String mTargetPackageName\nprivate final boolean mOverlayIsStatic\nprivate final int mOverlayPriority\nprivate final @android.annotation.Nullable java.lang.String mRequiredSystemPropertyName\nprivate final @android.annotation.Nullable java.lang.String mRequiredSystemPropertyValue\nprivate final int mRollbackDataPolicy\nprivate final boolean mHasDeviceAdminReceiver\nprivate final boolean mIsSdkLibrary\nprivate final boolean mAllowUpdateOwnership\npublic long getLongVersionCode()\nprivate boolean hasAnyRequiredSplitTypes()\nclass ApkLite extends java.lang.Object implements []\n@com.android.internal.util.DataClass(genConstructor=false, genConstDefs=false)") @Deprecated private void __metadata() {} diff --git a/core/java/android/content/pm/parsing/ApkLiteParseUtils.java b/core/java/android/content/pm/parsing/ApkLiteParseUtils.java index 64fed63c7159c..a4339d41dfd2e 100644 --- a/core/java/android/content/pm/parsing/ApkLiteParseUtils.java +++ b/core/java/android/content/pm/parsing/ApkLiteParseUtils.java @@ -127,7 +127,8 @@ public class ApkLiteParseUtils { null /* isFeatureSplits */, null /* usesSplitNames */, null /* configForSplit */, null /* splitApkPaths */, null /* splitRevisionCodes */, baseApk.getTargetSdkVersion(), - null /* requiredSplitTypes */, null /* splitTypes */)); + null /* requiredSplitTypes */, null, /* splitTypes */ + baseApk.isAllowUpdateOwnership())); } finally { Trace.traceEnd(TRACE_TAG_PACKAGE_MANAGER); } @@ -273,7 +274,8 @@ public class ApkLiteParseUtils { return input.success( new PackageLite(codePath, baseCodePath, baseApk, splitNames, isFeatureSplits, usesSplitNames, configForSplits, splitCodePaths, splitRevisionCodes, - baseApk.getTargetSdkVersion(), requiredSplitTypes, splitTypes)); + baseApk.getTargetSdkVersion(), requiredSplitTypes, splitTypes, + baseApk.isAllowUpdateOwnership())); } /** @@ -400,6 +402,8 @@ public class ApkLiteParseUtils { "isFeatureSplit", false); boolean isSplitRequired = parser.getAttributeBooleanValue(ANDROID_RES_NAMESPACE, "isSplitRequired", false); + boolean allowUpdateOwnership = parser.getAttributeBooleanValue(ANDROID_RES_NAMESPACE, + "allowUpdateOwnership", true); String configForSplit = parser.getAttributeValue(null, "configForSplit"); int targetSdkVersion = DEFAULT_TARGET_SDK_VERSION; @@ -583,7 +587,7 @@ public class ApkLiteParseUtils { overlayIsStatic, overlayPriority, requiredSystemPropertyName, requiredSystemPropertyValue, minSdkVersion, targetSdkVersion, rollbackDataPolicy, requiredSplitTypes.first, requiredSplitTypes.second, - hasDeviceAdminReceiver, isSdkLibrary)); + hasDeviceAdminReceiver, isSdkLibrary, allowUpdateOwnership)); } private static boolean isDeviceAdminReceiver( diff --git a/core/java/android/content/pm/parsing/PackageLite.java b/core/java/android/content/pm/parsing/PackageLite.java index e2789c93516fb..e24b9320110e3 100644 --- a/core/java/android/content/pm/parsing/PackageLite.java +++ b/core/java/android/content/pm/parsing/PackageLite.java @@ -110,10 +110,16 @@ public class PackageLite { */ private final boolean mIsSdkLibrary; + /** + * Indicates if this package allows an installer to declare update ownership of it. + */ + private final boolean mAllowUpdateOwnership; + public PackageLite(String path, String baseApkPath, ApkLite baseApk, String[] splitNames, boolean[] isFeatureSplits, String[] usesSplitNames, String[] configForSplit, String[] splitApkPaths, int[] splitRevisionCodes, - int targetSdk, Set[] requiredSplitTypes, Set[] splitTypes) { + int targetSdk, Set[] requiredSplitTypes, Set[] splitTypes, + boolean allowUpdateOwnership) { // The following paths may be different from the path in ApkLite because we // move or rename the APK files. Use parameters to indicate the correct paths. mPath = path; @@ -144,6 +150,7 @@ public class PackageLite { mSplitApkPaths = splitApkPaths; mSplitRevisionCodes = splitRevisionCodes; mTargetSdk = targetSdk; + mAllowUpdateOwnership = allowUpdateOwnership; } /** @@ -414,12 +421,19 @@ public class PackageLite { return mIsSdkLibrary; } + /** + * Indicates if this package allows an installer to declare update ownership of it. + */ + @DataClass.Generated.Member + public boolean isAllowUpdateOwnership() { + return mAllowUpdateOwnership; + } + @DataClass.Generated( - time = 1643132127068L, + time = 1680125514341L, codegenVersion = "1.0.23", sourceFile = "frameworks/base/core/java/android/content/pm/parsing/PackageLite.java", - inputSignatures = - "private final @android.annotation.NonNull java.lang.String mPackageName\nprivate final @android.annotation.NonNull java.lang.String mPath\nprivate final @android.annotation.NonNull java.lang.String mBaseApkPath\nprivate final @android.annotation.Nullable java.lang.String[] mSplitApkPaths\nprivate final @android.annotation.Nullable java.lang.String[] mSplitNames\nprivate final @android.annotation.Nullable java.lang.String[] mUsesSplitNames\nprivate final @android.annotation.Nullable java.lang.String[] mConfigForSplit\nprivate final @android.annotation.Nullable java.util.Set mBaseRequiredSplitTypes\nprivate final @android.annotation.Nullable java.util.Set[] mRequiredSplitTypes\nprivate final @android.annotation.Nullable java.util.Set[] mSplitTypes\nprivate final int mVersionCodeMajor\nprivate final int mVersionCode\nprivate final int mTargetSdk\nprivate final int mBaseRevisionCode\nprivate final @android.annotation.Nullable int[] mSplitRevisionCodes\nprivate final int mInstallLocation\nprivate final @android.annotation.NonNull android.content.pm.VerifierInfo[] mVerifiers\nprivate final @android.annotation.Nullable boolean[] mIsFeatureSplits\nprivate final boolean mIsolatedSplits\nprivate final boolean mSplitRequired\nprivate final boolean mCoreApp\nprivate final boolean mDebuggable\nprivate final boolean mMultiArch\nprivate final boolean mUse32bitAbi\nprivate final boolean mExtractNativeLibs\nprivate final boolean mProfileableByShell\nprivate final boolean mUseEmbeddedDex\nprivate final boolean mIsSdkLibrary\npublic java.util.List getAllApkPaths()\npublic long getLongVersionCode()\nprivate boolean hasAnyRequiredSplitTypes()\nclass PackageLite extends java.lang.Object implements []\n@com.android.internal.util.DataClass(genConstructor=false, genConstDefs=false)") + inputSignatures = "private final @android.annotation.NonNull java.lang.String mPackageName\nprivate final @android.annotation.NonNull java.lang.String mPath\nprivate final @android.annotation.NonNull java.lang.String mBaseApkPath\nprivate final @android.annotation.Nullable java.lang.String[] mSplitApkPaths\nprivate final @android.annotation.Nullable java.lang.String[] mSplitNames\nprivate final @android.annotation.Nullable java.lang.String[] mUsesSplitNames\nprivate final @android.annotation.Nullable java.lang.String[] mConfigForSplit\nprivate final @android.annotation.Nullable java.util.Set mBaseRequiredSplitTypes\nprivate final @android.annotation.Nullable java.util.Set[] mRequiredSplitTypes\nprivate final @android.annotation.Nullable java.util.Set[] mSplitTypes\nprivate final int mVersionCodeMajor\nprivate final int mVersionCode\nprivate final int mTargetSdk\nprivate final int mBaseRevisionCode\nprivate final @android.annotation.Nullable int[] mSplitRevisionCodes\nprivate final int mInstallLocation\nprivate final @android.annotation.NonNull android.content.pm.VerifierInfo[] mVerifiers\nprivate final @android.annotation.Nullable boolean[] mIsFeatureSplits\nprivate final boolean mIsolatedSplits\nprivate final boolean mSplitRequired\nprivate final boolean mCoreApp\nprivate final boolean mDebuggable\nprivate final boolean mMultiArch\nprivate final boolean mUse32bitAbi\nprivate final boolean mExtractNativeLibs\nprivate final boolean mProfileableByShell\nprivate final boolean mUseEmbeddedDex\nprivate final boolean mIsSdkLibrary\nprivate final boolean mAllowUpdateOwnership\npublic java.util.List getAllApkPaths()\npublic long getLongVersionCode()\nprivate boolean hasAnyRequiredSplitTypes()\nclass PackageLite extends java.lang.Object implements []\n@com.android.internal.util.DataClass(genConstructor=false, genConstDefs=false)") @Deprecated private void __metadata() {} diff --git a/services/core/java/com/android/server/pm/PackageInstallerSession.java b/services/core/java/com/android/server/pm/PackageInstallerSession.java index fa535c38c5d20..389c447dbc651 100644 --- a/services/core/java/com/android/server/pm/PackageInstallerSession.java +++ b/services/core/java/com/android/server/pm/PackageInstallerSession.java @@ -746,6 +746,9 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub { @GuardedBy("mLock") private int mValidatedTargetSdk = INVALID_TARGET_SDK_VERSION; + @GuardedBy("mLock") + private boolean mAllowsUpdateOwnership = true; + private static final FileFilter sAddedApkFilter = new FileFilter() { @Override public boolean accept(File file) { @@ -867,13 +870,11 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub { private static final int USER_ACTION_NOT_NEEDED = 0; private static final int USER_ACTION_REQUIRED = 1; - private static final int USER_ACTION_PENDING_APK_PARSING = 2; private static final int USER_ACTION_REQUIRED_UPDATE_OWNER_REMINDER = 3; @IntDef({ USER_ACTION_NOT_NEEDED, USER_ACTION_REQUIRED, - USER_ACTION_PENDING_APK_PARSING, USER_ACTION_REQUIRED_UPDATE_OWNER_REMINDER, }) @interface UserActionRequirement {} @@ -964,11 +965,11 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub { && !isApexSession() && !isUpdateOwner && !isInstallerShell + && mAllowsUpdateOwnership // We don't enforce the update ownership for the managed user and profile. && !isFromManagedUserOrProfile) { return USER_ACTION_REQUIRED_UPDATE_OWNER_REMINDER; } - if (isPermissionGranted) { return USER_ACTION_NOT_NEEDED; } @@ -983,7 +984,20 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub { && isUpdateWithoutUserActionPermissionGranted && ((isUpdateOwnershipEnforcementEnabled ? isUpdateOwner : isInstallerOfRecord) || isSelfUpdate)) { - return USER_ACTION_PENDING_APK_PARSING; + if (!isApexSession()) { + if (!isTargetSdkConditionSatisfied(this)) { + return USER_ACTION_REQUIRED; + } + + if (!mSilentUpdatePolicy.isSilentUpdateAllowed( + getInstallerPackageName(), getPackageName())) { + // Fall back to the non-silent update if a repeated installation is invoked + // within the throttle time. + return USER_ACTION_REQUIRED; + } + mSilentUpdatePolicy.track(getInstallerPackageName(), getPackageName()); + return USER_ACTION_NOT_NEEDED; + } } return USER_ACTION_REQUIRED; @@ -2363,26 +2377,6 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub { session.sendPendingUserActionIntent(target); return true; } - - if (!session.isApexSession() && userActionRequirement == USER_ACTION_PENDING_APK_PARSING) { - if (!isTargetSdkConditionSatisfied(session)) { - session.sendPendingUserActionIntent(target); - return true; - } - - if (session.params.requireUserAction == SessionParams.USER_ACTION_NOT_REQUIRED) { - if (!session.mSilentUpdatePolicy.isSilentUpdateAllowed( - session.getInstallerPackageName(), session.getPackageName())) { - // Fall back to the non-silent update if a repeated installation is invoked - // within the throttle time. - session.sendPendingUserActionIntent(target); - return true; - } - session.mSilentUpdatePolicy.track(session.getInstallerPackageName(), - session.getPackageName()); - } - } - return false; } @@ -3399,6 +3393,8 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub { // {@link PackageLite#getTargetSdk()} mValidatedTargetSdk = packageLite.getTargetSdk(); + mAllowsUpdateOwnership = packageLite.isAllowUpdateOwnership(); + return packageLite; } diff --git a/services/core/java/com/android/server/pm/PackageManagerShellCommand.java b/services/core/java/com/android/server/pm/PackageManagerShellCommand.java index 41592bd3b7be0..b1cc58440bcb9 100644 --- a/services/core/java/com/android/server/pm/PackageManagerShellCommand.java +++ b/services/core/java/com/android/server/pm/PackageManagerShellCommand.java @@ -687,7 +687,7 @@ class PackageManagerShellCommand extends ShellCommand { null /* usesSplitNames */, null /* configForSplit */, null /* splitApkPaths */, null /* splitRevisionCodes */, apkLite.getTargetSdkVersion(), null /* requiredSplitTypes */, - null /* splitTypes */); + null /* splitTypes */, apkLite.isAllowUpdateOwnership()); sessionSize += InstallLocationUtils.calculateInstalledSize(pkgLite, params.sessionParams.abiOverride, fd.getFileDescriptor()); } catch (IOException e) { diff --git a/services/tests/servicestests/src/com/android/server/pm/dex/DexMetadataHelperTest.java b/services/tests/servicestests/src/com/android/server/pm/dex/DexMetadataHelperTest.java index b2843d82a08a7..de82854d42ee7 100644 --- a/services/tests/servicestests/src/com/android/server/pm/dex/DexMetadataHelperTest.java +++ b/services/tests/servicestests/src/com/android/server/pm/dex/DexMetadataHelperTest.java @@ -422,7 +422,8 @@ public class DexMetadataHelperTest { null /* splitNames */, null /* isFeatureSplits */, null /* usesSplitNames */, null /* configForSplit */, null /* splitApkPaths */, null /* splitRevisionCodes */, baseApk.getTargetSdkVersion(), - null /* requiredSplitTypes */, null /* splitTypes */); + null /* requiredSplitTypes */, null /* splitTypes */, + false /* allowUpdateOwnership */); Assert.assertEquals(dm.length(), DexMetadataHelper.getPackageDexMetadataSize(pkgLite)); }