From b5fc9412d005d381626399aa96ced7dc5c641dfe Mon Sep 17 00:00:00 2001
From: Alan Stokes <alanstokes@google.com>
Date: Wed, 16 Dec 2020 17:27:28 +0000
Subject: [PATCH] Disable CE access checking for canAccessDataDir.

The access is correct, so we don't want StrictMode to kill us.

Fix: 174750397
Test: Presubmits
Change-Id: I14561a4fc1e0195d658dafd7532c8412f51ba386
---
 core/java/android/app/LoadedApk.java | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/core/java/android/app/LoadedApk.java b/core/java/android/app/LoadedApk.java
index 99785e1e73f4d..50853a3bcf9c2 100644
--- a/core/java/android/app/LoadedApk.java
+++ b/core/java/android/app/LoadedApk.java
@@ -729,6 +729,23 @@ public final class LoadedApk {
         }
     }
 
+    private StrictMode.VmPolicy allowVmViolations() {
+        if (mActivityThread == null) {
+            // When LoadedApk is used without an ActivityThread (usually in a
+            // zygote context), don't call into StrictMode, as it initializes
+            // the binder subsystem, which we don't want.
+            return null;
+        }
+
+        return StrictMode.allowVmViolations();
+    }
+
+    private void setVmPolicy(StrictMode.VmPolicy policy) {
+        if (mActivityThread != null && policy != null) {
+            StrictMode.setVmPolicy(policy);
+        }
+    }
+
     private void createOrUpdateClassLoaderLocked(List<String> addedPaths) {
         if (mPackageName.equals("android")) {
             // Note: This branch is taken for system server and we don't need to setup
@@ -984,13 +1001,20 @@ public final class LoadedApk {
 
         // Temporarily disable logging of disk reads on the Looper thread as this is necessary -
         // and the loader will access the directory anyway if we don't check it.
-        StrictMode.ThreadPolicy oldPolicy = allowThreadDiskReads();
+        StrictMode.ThreadPolicy oldThreadPolicy = allowThreadDiskReads();
+
+        // Also disable logging of access to /data/user before CE storage is unlocked. The check
+        // below will return false (because the directory name we pass will not match the
+        // encrypted one), but that's correct.
+        StrictMode.VmPolicy oldVmPolicy = allowVmViolations();
+
         try {
             // We are constructing a classloader for a different package. It is likely,
             // but not certain, that we can't acccess its app data dir - so check.
             return new File(mDataDir).canExecute();
         } finally {
-            setThreadPolicy(oldPolicy);
+            setThreadPolicy(oldThreadPolicy);
+            setVmPolicy(oldVmPolicy);
         }
     }