Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Rename partner-apex-allowlist to vendor-apex-allowlist" into sc-dev

Browse Source
This commit is contained in:
Nikita Ioffe
2021-06-23 10:47:38 +00:00
committed by Android (Google) Code Review
parent 1a10b25d48 d204005ac3
commit b3db287943
3 changed files with 33 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
core/java/com/android/server/SystemConfig.java
View File

@@ -86,6 +86,7 @@ public class SystemConfig {
// and "allow-ignore-location-settings".
private static final int ALLOW_OVERRIDE_APP_RESTRICTIONS = 0x100;
private static final int ALLOW_IMPLICIT_BROADCASTS = 0x200;
private static final int ALLOW_VENDOR_APEX = 0x400;
private static final int ALLOW_ALL = ~0;
// property for runtime configuration differentiation
@@ -240,7 +241,7 @@ public class SystemConfig {
private final ArraySet<String> mRollbackWhitelistedPackages = new ArraySet<>();
private final ArraySet<String> mWhitelistedStagedInstallers = new ArraySet<>();
private final ArraySet<String> mAllowedPartnerApexes = new ArraySet<>();
private final ArraySet<String> mAllowedVendorApexes = new ArraySet<>();
/**
* Map of system pre-defined, uniquely named actors; keys are namespace,
@@ -411,8 +412,8 @@ public class SystemConfig {
return mWhitelistedStagedInstallers;
}
public Set<String> getAllowedPartnerApexes() {
return mAllowedPartnerApexes;
public Set<String> getAllowedVendorApexes() {
return mAllowedVendorApexes;
}
public ArraySet<String> getAppDataIsolationWhitelistedApps() {
@@ -489,7 +490,7 @@ public class SystemConfig {
// Vendors are only allowed to customize these
int vendorPermissionFlag = ALLOW_LIBS | ALLOW_FEATURES | ALLOW_PRIVAPP_PERMISSIONS
| ALLOW_ASSOCIATIONS;
| ALLOW_ASSOCIATIONS | ALLOW_VENDOR_APEX;
if (Build.VERSION.DEVICE_INITIAL_SDK_INT <= Build.VERSION_CODES.O_MR1) {
// For backward compatibility
vendorPermissionFlag |= (ALLOW_PERMISSIONS | ALLOW_APP_CONFIGS);
@@ -530,7 +531,8 @@ public class SystemConfig {
}
// Allow OEM to customize these
int oemPermissionFlag = ALLOW_FEATURES | ALLOW_OEM_PERMISSIONS | ALLOW_ASSOCIATIONS;
int oemPermissionFlag = ALLOW_FEATURES | ALLOW_OEM_PERMISSIONS | ALLOW_ASSOCIATIONS
| ALLOW_VENDOR_APEX;
readPermissions(Environment.buildPath(
Environment.getOemDirectory(), "etc", "sysconfig"), oemPermissionFlag);
readPermissions(Environment.buildPath(
@@ -541,7 +543,8 @@ public class SystemConfig {
// the use of hidden APIs from the product partition.
int productPermissionFlag = ALLOW_FEATURES | ALLOW_LIBS | ALLOW_PERMISSIONS
| ALLOW_APP_CONFIGS | ALLOW_PRIVAPP_PERMISSIONS | ALLOW_HIDDENAPI_WHITELISTING
| ALLOW_ASSOCIATIONS | ALLOW_OVERRIDE_APP_RESTRICTIONS | ALLOW_IMPLICIT_BROADCASTS;
| ALLOW_ASSOCIATIONS | ALLOW_OVERRIDE_APP_RESTRICTIONS | ALLOW_IMPLICIT_BROADCASTS
| ALLOW_VENDOR_APEX;
if (Build.VERSION.DEVICE_INITIAL_SDK_INT <= Build.VERSION_CODES.R) {
// TODO(b/157393157): This must check product interface enforcement instead of
// DEVICE_INITIAL_SDK_INT for the devices without product interface enforcement.
@@ -668,6 +671,7 @@ public class SystemConfig {
(permissionFlag & ALLOW_OVERRIDE_APP_RESTRICTIONS) != 0;
final boolean allowImplicitBroadcasts = (permissionFlag & ALLOW_IMPLICIT_BROADCASTS)
!= 0;
final boolean allowVendorApex = (permissionFlag & ALLOW_VENDOR_APEX) != 0;
while (true) {
XmlUtils.nextElement(parser);
if (parser.getEventType() == XmlPullParser.END_DOCUMENT) {
@@ -1217,15 +1221,14 @@ public class SystemConfig {
}
XmlUtils.skipCurrentTag(parser);
} break;
case "allowed-partner-apex": {
// TODO(b/189274479): should this be allowOemPermissions instead?
if (allowAppConfigs) {
case "allowed-vendor-apex": {
if (allowVendorApex) {
String pkgName = parser.getAttributeValue(null, "package");
if (pkgName == null) {
Slog.w(TAG, "<" + name + "> without package in " + permFile
+ " at " + parser.getPositionDescription());
} else {
mAllowedPartnerApexes.add(pkgName);
mAllowedVendorApexes.add(pkgName);
}
} else {
logNotAllowedInPartition(name, permFile, parser);

2
services/core/java/com/android/server/pm/PackageInstallerSession.java
View File

@@ -2799,7 +2799,7 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub {
private boolean isApexUpdateAllowed(String apexPackageName) {
return mPm.getModuleInfo(apexPackageName, 0) != null
|| SystemConfig.getInstance().getAllowedPartnerApexes().contains(apexPackageName);
|| SystemConfig.getInstance().getAllowedVendorApexes().contains(apexPackageName);
}
/**

38
services/tests/servicestests/src/com/android/server/systemconfig/SystemConfigTest.java
View File

@@ -222,61 +222,61 @@ public class SystemConfigTest {
}
/**
* Tests that readPermissions works correctly with {@link SystemConfig#ALLOW_APP_CONFIGS}
* permission flag for the tag: {@code allowed-partner-apex}.
* Tests that readPermissions works correctly with {@link SystemConfig#ALLOW_VENDOR_APEX}
* permission flag for the tag: {@code allowed-vendor-apex}.
*/
@Test
public void readPermissions_allowAppConfigs_parsesPartnerApexAllowList()
public void readPermissions_allowVendorApex_parsesVendorApexAllowList()
throws IOException {
final String contents =
"<config>\n"
+ " <allowed-partner-apex package=\"com.android.apex1\" />\n"
+ " <allowed-vendor-apex package=\"com.android.apex1\" />\n"
+ "</config>";
final File folder = createTempSubfolder("folder");
createTempFile(folder, "partner-apex-allowlist.xml", contents);
createTempFile(folder, "vendor-apex-allowlist.xml", contents);
mSysConfig.readPermissions(folder, /* Grant all permission flags */ ~0);
assertThat(mSysConfig.getAllowedPartnerApexes()).containsExactly("com.android.apex1");
assertThat(mSysConfig.getAllowedVendorApexes()).containsExactly("com.android.apex1");
}
/**
* Tests that readPermissions works correctly with {@link SystemConfig#ALLOW_APP_CONFIGS}
* permission flag for the tag: {@code allowed-partner-apex}.
* Tests that readPermissions works correctly with {@link SystemConfig#ALLOW_VENDOR_APEX}
* permission flag for the tag: {@code allowed-vendor-apex}.
*/
@Test
public void readPermissions_allowAppConfigs_parsesPartnerApexAllowList_noPackage()
public void readPermissions_allowVendorApex_parsesVendorApexAllowList_noPackage()
throws IOException {
final String contents =
"<config>\n"
+ " <allowed-partner-apex/>\n"
+ " <allowed-vendor-apex/>\n"
+ "</config>";
final File folder = createTempSubfolder("folder");
createTempFile(folder, "partner-apex-allowlist.xml", contents);
createTempFile(folder, "vendor-apex-allowlist.xml", contents);
mSysConfig.readPermissions(folder, /* Grant all permission flags */ ~0);
assertThat(mSysConfig.getAllowedPartnerApexes()).isEmpty();
assertThat(mSysConfig.getAllowedVendorApexes()).isEmpty();
}
/**
* Tests that readPermissions works correctly without {@link SystemConfig#ALLOW_APP_CONFIGS}
* permission flag for the tag: {@code allowed-partner-apex}.
* Tests that readPermissions works correctly without {@link SystemConfig#ALLOW_VENDOR_APEX}
* permission flag for the tag: {@code allowed-oem-apex}.
*/
@Test
public void readPermissions_notAllowAppConfigs_doesNotParsePartnerApexAllowList()
public void readPermissions_notAllowVendorApex_doesNotParseVendorApexAllowList()
throws IOException {
final String contents =
"<config>\n"
+ " <allowed-partner-apex package=\"com.android.apex1\" />\n"
+ " <allowed-vendor-apex package=\"com.android.apex1\" />\n"
+ "</config>";
final File folder = createTempSubfolder("folder");
createTempFile(folder, "partner-apex-allowlist.xml", contents);
createTempFile(folder, "vendor-apex-allowlist.xml", contents);
mSysConfig.readPermissions(folder, /* Grant all but ALLOW_APP_CONFIGS flag */ ~0x08);
mSysConfig.readPermissions(folder, /* Grant all but ALLOW_VENDOR_APEX flag */ ~0x400);
assertThat(mSysConfig.getAllowedPartnerApexes()).isEmpty();
assertThat(mSysConfig.getAllowedVendorApexes()).isEmpty();
}
/**