Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Use key rotation aware check when sharedUID signatures change on OTA" into tm-dev am: d931f19fb0 am: 7593599cc0

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/18381775

Change-Id: Ia2e53a9ade116b8d6ce42a9b882fb0846b15f4e8
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Michael Groover
2022-05-16 03:52:53 +00:00
committed by Automerger Merge Worker
parent 044de12a14 7593599cc0
commit 8b2a14730d
2 changed files with 28 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
services/core/java/com/android/server/pm/PackageManagerServiceUtils.java
View File

@@ -19,6 +19,7 @@ package com.android.server.pm;
import static android.content.pm.PackageManager.INSTALL_FAILED_SHARED_USER_INCOMPATIBLE;
import static android.content.pm.PackageManager.INSTALL_FAILED_UPDATE_INCOMPATIBLE;
import static android.content.pm.PackageManager.INSTALL_FAILED_VERSION_DOWNGRADE;
import static android.content.pm.SigningDetails.CertCapabilities.SHARED_USER_ID;
import static android.system.OsConstants.O_CREAT;
import static android.system.OsConstants.O_RDWR;
@@ -565,13 +566,8 @@ public class PackageManagerServiceUtils {
// the older ones. We check to see if either the new package is signed by an older cert
// with which the current sharedUser is ok, or if it is signed by a newer one, and is ok
// with being sharedUser with the existing signing cert.
boolean match =
parsedSignatures.checkCapability(
sharedUserSetting.getSigningDetails(),
SigningDetails.CertCapabilities.SHARED_USER_ID)
|| sharedUserSetting.getSigningDetails().checkCapability(
parsedSignatures,
SigningDetails.CertCapabilities.SHARED_USER_ID);
boolean match = canJoinSharedUserId(parsedSignatures,
sharedUserSetting.getSigningDetails());
// Special case: if the sharedUserId capability check failed it could be due to this
// being the only package in the sharedUserId so far and the lineage being updated to
// deny the sharedUserId capability of the previous key in the lineage.
@@ -645,6 +641,28 @@ public class PackageManagerServiceUtils {
return compatMatch;
}
/**
* Returns whether the package with {@code packageSigningDetails} can join the sharedUserId
* with {@code sharedUserSigningDetails}.
* <p>
* A sharedUserId maintains a shared {@link SigningDetails} containing the full lineage and
* capabilities for each package in the sharedUserId. A package can join the sharedUserId if
* its current signer is the same as the shared signer, or if the current signer of either
* is in the signing lineage of the other with the {@link
* SigningDetails.CertCapabilities#SHARED_USER_ID} capability granted to that previous signer
* in the lineage.
*
* @param packageSigningDetails the {@code SigningDetails} of the package seeking to join the
* sharedUserId
* @param sharedUserSigningDetails the {@code SigningDetails} of the sharedUserId
* @return true if the package seeking to join the sharedUserId meets the requirements
*/
public static boolean canJoinSharedUserId(@NonNull SigningDetails packageSigningDetails,
@NonNull SigningDetails sharedUserSigningDetails) {
return packageSigningDetails.checkCapability(sharedUserSigningDetails, SHARED_USER_ID)
|| sharedUserSigningDetails.checkCapability(packageSigningDetails, SHARED_USER_ID);
}
/**
* Extract native libraries to a target path
*/

10
services/core/java/com/android/server/pm/ReconcilePackageUtils.java
View File

@@ -22,11 +22,9 @@ import static android.content.pm.SigningDetails.CapabilityMergeRule.MERGE_RESTRI
import static com.android.server.pm.PackageManagerService.SCAN_BOOTING;
import static com.android.server.pm.PackageManagerService.SCAN_DONT_KILL_APP;
import static com.android.server.pm.PackageManagerServiceUtils.compareSignatures;
import android.content.pm.PackageManager;
import android.content.pm.SharedLibraryInfo;
import android.content.pm.Signature;
import android.content.pm.SigningDetails;
import android.os.SystemProperties;
import android.util.ArrayMap;
@@ -212,12 +210,10 @@ final class ReconcilePackageUtils {
// the signatures on the first package scanned for the shared user (i.e. if the
// signaturesChanged state hasn't been initialized yet in SharedUserSetting).
if (sharedUserSetting != null) {
final Signature[] sharedUserSignatures = sharedUserSetting
.signatures.mSigningDetails.getSignatures();
if (sharedUserSetting.signaturesChanged != null
&& compareSignatures(sharedUserSignatures,
parsedPackage.getSigningDetails().getSignatures())
!= PackageManager.SIGNATURE_MATCH) {
&& !PackageManagerServiceUtils.canJoinSharedUserId(
parsedPackage.getSigningDetails(),
sharedUserSetting.getSigningDetails())) {
if (SystemProperties.getInt("ro.product.first_api_level", 0) <= 29) {
// Mismatched signatures is an error and silently skipping system
// packages will likely break the device in unforeseen ways.