From bedbb8902f237dd54a928d1f53f30c5efea16bb6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bram=20Bonn=C3=A9?= Date: Mon, 7 Jun 2021 18:30:56 +0200 Subject: [PATCH] Allow app's targetSDK to overwrite SELINUX_LATEST_CHANGES SDK The previous behavior capped the maximum target SDK level for apps to the current platform target SDK in SELinux policy. This prevented developing and testing newer SELinux policies in AOSP. In addition to allowing higher targetSDKs specified by the app to be considered in SELinux policies, this change adds a test to enforce that behavior for future target SDK versions. Bug: 190375530 Test: atest com.android.server.pm.SELinuxMMACTest Test: atest CtsSelinuxTargetSdkCurrentTestCases Test: atest CtsSelinuxTargetSdk29TestCases Test: atest CtsSelinuxTargetSdk28TestCases Test: atest CtsSelinuxTargetSdk27TestCases Change-Id: Iee40e5ffd677038157ab7349a38eb34934458e25 --- .../core/java/com/android/server/pm/SELinuxMMAC.java | 6 +++--- .../src/com/android/server/pm/SELinuxMMACTest.java | 10 ++++++++++ 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/services/core/java/com/android/server/pm/SELinuxMMAC.java b/services/core/java/com/android/server/pm/SELinuxMMAC.java index bdecaa78b6eec..f078c499a19e9 100644 --- a/services/core/java/com/android/server/pm/SELinuxMMAC.java +++ b/services/core/java/com/android/server/pm/SELinuxMMAC.java @@ -79,7 +79,7 @@ public final class SELinuxMMAC { /** * Allows opt-in to the latest targetSdkVersion enforced changes without changing target SDK. - * Turning this change off for an app targeting the latest SDK is a no-op. + * Turning this change off for an app targeting >= the latest SDK is a no-op. * *

Has no effect for apps using shared user id. * @@ -92,7 +92,7 @@ public final class SELinuxMMAC { /** * This change gates apps access to untrusted_app_R-targetSDK SELinux domain. Allows opt-in * to R targetSdkVersion enforced changes without changing target SDK. Turning this change - * off for an app targeting S is a no-op. + * off for an app targeting >= S is a no-op. * *

Has no effect for apps using shared user id. * @@ -364,7 +364,7 @@ public final class SELinuxMMAC { } final ApplicationInfo appInfo = pkg.toAppInfoWithoutState(); if (compatibility.isChangeEnabledInternal(SELINUX_LATEST_CHANGES, appInfo)) { - return android.os.Build.VERSION_CODES.S; + return Math.max(android.os.Build.VERSION_CODES.S, pkg.getTargetSdkVersion()); } else if (compatibility.isChangeEnabledInternal(SELINUX_R_CHANGES, appInfo)) { return Math.max(android.os.Build.VERSION_CODES.R, pkg.getTargetSdkVersion()); } diff --git a/services/tests/servicestests/src/com/android/server/pm/SELinuxMMACTest.java b/services/tests/servicestests/src/com/android/server/pm/SELinuxMMACTest.java index f1930d7268d7f..cee4cda99e468 100644 --- a/services/tests/servicestests/src/com/android/server/pm/SELinuxMMACTest.java +++ b/services/tests/servicestests/src/com/android/server/pm/SELinuxMMACTest.java @@ -90,6 +90,16 @@ public class SELinuxMMACTest { is("default:targetSdkVersion=" + LATEST_OPT_IN_VERSION)); } + @Test + public void getSeInfoTargetingCurDevelopment() { + AndroidPackage pkg = makePackage(Build.VERSION_CODES.CUR_DEVELOPMENT); + when(mMockCompatibility.isChangeEnabledInternal(eq(SELinuxMMAC.SELINUX_LATEST_CHANGES), + argThat(argument -> argument.packageName.equals(pkg.getPackageName())))) + .thenReturn(true); + assertThat(SELinuxMMAC.getSeInfo(pkg, null, mMockCompatibility), + is("default:targetSdkVersion=" + Build.VERSION_CODES.CUR_DEVELOPMENT)); + } + @Test public void getSeInfoNoOptInButAlreadyR() { AndroidPackage pkg = makePackage(R_OPT_IN_VERSION);