Merge "As per Todd's advice, this CL does the following on AppIntegrityComponentImpl: 1 - Remove the use of stream() -- still couldn't do this for File.listDir result. 2 - Hide the logs behind a DEBUG_INTEGRITY_COMPONENT static boolean." into rvc-dev am: 0f45d14519

Change-Id: I3f2daf3e81e1bc69bcf073aa005b9cd0d24ca58d

services/core/java/com/android/server/integrity/AppIntegrityManagerServiceImpl.java

@@ -117,6 +117,8 @@ public class AppIntegrityManagerServiceImpl extends IAppIntegrityManager.Stub {
     private static final String ALLOWED_INSTALLER_DELIMITER = ",";
     private static final String INSTALLER_PACKAGE_CERT_DELIMITER = "\\|";
 
+    public static final boolean DEBUG_INTEGRITY_COMPONENT = false;
+
     private static final Set<String> PACKAGE_INSTALLER =
             new HashSet<>(
                     Arrays.asList(
@@ -262,14 +264,18 @@ public class AppIntegrityManagerServiceImpl extends IAppIntegrityManager.Stub {
         int verificationId = intent.getIntExtra(EXTRA_VERIFICATION_ID, -1);
 
         try {
-            Slog.i(TAG, "Received integrity verification intent " + intent.toString());
+            if (DEBUG_INTEGRITY_COMPONENT) {
-            Slog.i(TAG, "Extras " + intent.getExtras());
+                Slog.d(TAG, "Received integrity verification intent " + intent.toString());
+                Slog.d(TAG, "Extras " + intent.getExtras());
+            }
 
             String installerPackageName = getInstallerPackageName(intent);
 
             // Skip integrity verification if the verifier is doing the install.
             if (!integrityCheckIncludesRuleProvider() && isRuleProvider(installerPackageName)) {
-                Slog.i(TAG, "Verifier doing the install. Skipping integrity check.");
+                if (DEBUG_INTEGRITY_COMPONENT) {
+                    Slog.i(TAG, "Verifier doing the install. Skipping integrity check.");
+                }
                 mPackageManagerInternal.setIntegrityVerificationResult(
                         verificationId, PackageManagerInternal.INTEGRITY_VERIFICATION_ALLOW);
                 return;
@@ -303,19 +309,23 @@ public class AppIntegrityManagerServiceImpl extends IAppIntegrityManager.Stub {
 
             AppInstallMetadata appInstallMetadata = builder.build();
 
-            Slog.i(
+            if (DEBUG_INTEGRITY_COMPONENT) {
-                    TAG,
+                Slog.i(
-                    "To be verified: "
+                        TAG,
-                            + appInstallMetadata
+                        "To be verified: "
-                            + " installers "
+                                + appInstallMetadata
-                            + getAllowedInstallers(packageInfo));
+                                + " installers "
+                                + getAllowedInstallers(packageInfo));
+            }
             IntegrityCheckResult result = mEvaluationEngine.evaluate(appInstallMetadata);
-            Slog.i(
+            if (DEBUG_INTEGRITY_COMPONENT) {
-                    TAG,
+                Slog.i(
-                    "Integrity check result: "
+                        TAG,
-                            + result.getEffect()
+                        "Integrity check result: "
-                            + " due to "
+                                + result.getEffect()
-                            + result.getMatchedRules());
+                                + " due to "
+                                + result.getMatchedRules());
+            }
 
             FrameworkStatsLog.write(
                     FrameworkStatsLog.INTEGRITY_CHECK_RESULT_REPORTED,
@@ -424,7 +434,7 @@ public class AppIntegrityManagerServiceImpl extends IAppIntegrityManager.Stub {
                             .getPackageInfo(installer, PackageManager.GET_SIGNING_CERTIFICATES);
             return getCertificateFingerprint(installerInfo);
         } catch (PackageManager.NameNotFoundException e) {
-            Slog.i(TAG, "Installer package " + installer + " not found.");
+            Slog.w(TAG, "Installer package " + installer + " not found.");
             return Collections.emptyList();
         }
     }
@@ -653,28 +663,39 @@ public class AppIntegrityManagerServiceImpl extends IAppIntegrityManager.Stub {
     private String getCallingRulePusherPackageName(int callingUid) {
         // Obtain the system apps that are whitelisted in config_integrityRuleProviderPackages.
         List<String> allowedRuleProviders = getAllowedRuleProviderSystemApps();
-        Slog.i(TAG, String.format(
+        if (DEBUG_INTEGRITY_COMPONENT) {
-                "Rule provider system app list contains: %s", allowedRuleProviders));
+            Slog.i(TAG, String.format(
+                    "Rule provider system app list contains: %s", allowedRuleProviders));
+        }
 
         // Identify the package names in the caller list.
         List<String> callingPackageNames = getPackageListForUid(callingUid);
-        Slog.i(TAG, String.format("Calling packages are: ", callingPackageNames));
+        if (DEBUG_INTEGRITY_COMPONENT) {
+            Slog.i(TAG, String.format("Calling packages are: ", callingPackageNames));
+        }
 
         // Find the intersection between the allowed and calling packages. Ideally, we will have
         // at most one package name here. But if we have more, it is fine.
-        List<String> allowedCallingPackages =
+        List<String> allowedCallingPackages = new ArrayList<>();
-                callingPackageNames
+        for (String packageName : callingPackageNames) {
-                        .stream()
+            if (allowedRuleProviders.contains(packageName)) {
-                        .filter(packageName -> allowedRuleProviders.contains(packageName))
+                allowedCallingPackages.add(packageName);
-                        .collect(Collectors.toList());
+            }
-        Slog.i(TAG, String.format("Calling rule pusher packages are: ", allowedCallingPackages));
+        }
-
+        if (DEBUG_INTEGRITY_COMPONENT) {
+            Slog.i(TAG,
+                    String.format("Calling rule pusher packages are: ", allowedCallingPackages));
+        }
         return allowedCallingPackages.isEmpty() ? null : allowedCallingPackages.get(0);
     }
 
     private boolean isRuleProvider(String installerPackageName) {
-        return getAllowedRuleProviderSystemApps().stream()
+        for (String ruleProvider : getAllowedRuleProviderSystemApps()) {
-                .anyMatch(ruleProvider -> ruleProvider.equals(installerPackageName));
+            if (ruleProvider.matches(installerPackageName)) {
+                return true;
+            }
+        }
+        return false;
     }
 
     private List<String> getAllowedRuleProviderSystemApps() {
@@ -682,13 +703,18 @@ public class AppIntegrityManagerServiceImpl extends IAppIntegrityManager.Stub {
                 Arrays.asList(
                         mContext.getResources()
                                 .getStringArray(R.array.config_integrityRuleProviderPackages));
-
+        if (DEBUG_INTEGRITY_COMPONENT) {
-        Slog.i(TAG, String.format("Rule provider list contains: %s", integrityRuleProviders));
+            Slog.i(TAG, String.format("Rule provider list contains: %s", integrityRuleProviders));
+        }
 
         // Filter out the rule provider packages that are not system apps.
-        return integrityRuleProviders.stream()
+        List<String> systemAppRuleProviders = new ArrayList<>();
-                .filter(this::isSystemApp)
+        for (String ruleProvider: integrityRuleProviders) {
-                .collect(Collectors.toList());
+            if (isSystemApp(ruleProvider)) {
+                systemAppRuleProviders.add(ruleProvider);
+            }
+        }
+        return systemAppRuleProviders;
     }
 
     private boolean isSystemApp(String packageName) {