From 825d3e9c8a78f9a4b1e7c7fbc5d7907256335812 Mon Sep 17 00:00:00 2001 From: Ricky Wai Date: Wed, 18 Dec 2019 15:16:17 +0000 Subject: [PATCH] Add app data isolation whitelist The whitelisted apps will still be sharing its data directory to all other applications. Bug: 143937733 Test: Confirm apps in whitelist xml are whitelisted Change-Id: Iaee2ef3740fc03ebd04104928cfb4d5df9c23c14 --- core/java/com/android/server/SystemConfig.java | 15 +++++++++++++++ core/xsd/permission.xsd | 4 ++++ core/xsd/schema/current.txt | 7 +++++++ .../java/com/android/server/am/ProcessList.java | 16 ++++++++++++++++ 4 files changed, 42 insertions(+) diff --git a/core/java/com/android/server/SystemConfig.java b/core/java/com/android/server/SystemConfig.java index 8a59c998dacb4..74b481c938c31 100644 --- a/core/java/com/android/server/SystemConfig.java +++ b/core/java/com/android/server/SystemConfig.java @@ -218,6 +218,7 @@ public class SystemConfig { final ArrayMap> mAllowedAssociations = new ArrayMap<>(); private final ArraySet mBugreportWhitelistedPackages = new ArraySet<>(); + private final ArraySet mAppDataIsolationWhitelistedApps = new ArraySet<>(); // Map of packagesNames to userTypes. Stored temporarily until cleared by UserManagerService(). private ArrayMap> mPackageToUserTypeWhitelist = new ArrayMap<>(); @@ -389,6 +390,10 @@ public class SystemConfig { return mRollbackWhitelistedPackages; } + public ArraySet getAppDataIsolationWhitelistedApps() { + return mAppDataIsolationWhitelistedApps; + } + /** * Gets map of packagesNames to userTypes, dictating on which user types each package should be * initially installed, and then removes this map from SystemConfig. @@ -1045,6 +1050,16 @@ public class SystemConfig { } XmlUtils.skipCurrentTag(parser); } break; + case "app-data-isolation-whitelisted-app": { + String pkgname = parser.getAttributeValue(null, "package"); + if (pkgname == null) { + Slog.w(TAG, "<" + name + "> without package in " + permFile + + " at " + parser.getPositionDescription()); + } else { + mAppDataIsolationWhitelistedApps.add(pkgname); + } + XmlUtils.skipCurrentTag(parser); + } break; case "bugreport-whitelisted": { String pkgname = parser.getAttributeValue(null, "package"); if (pkgname == null) { diff --git a/core/xsd/permission.xsd b/core/xsd/permission.xsd index 9520db7673506..396bec8831ad3 100644 --- a/core/xsd/permission.xsd +++ b/core/xsd/permission.xsd @@ -46,6 +46,7 @@ + @@ -161,6 +162,9 @@ + + + diff --git a/core/xsd/schema/current.txt b/core/xsd/schema/current.txt index 771c1dffb9097..c36c422a852dc 100644 --- a/core/xsd/schema/current.txt +++ b/core/xsd/schema/current.txt @@ -45,6 +45,12 @@ package com.android.xml.permission.configfile { method public void set_package(String); } + public class AppDataIsolationWhitelistedApp { + ctor public AppDataIsolationWhitelistedApp(); + method public String get_package(); + method public void set_package(String); + } + public class AppLink { ctor public AppLink(); method public String get_package(); @@ -160,6 +166,7 @@ package com.android.xml.permission.configfile { method public java.util.List getAllowInPowerSaveExceptIdle_optional(); method public java.util.List getAllowInPowerSave_optional(); method public java.util.List getAllowUnthrottledLocation_optional(); + method public java.util.List getAppDataIsolationWhitelistedApp_optional(); method public java.util.List getAppLink_optional(); method public java.util.List getAssignPermission_optional(); method public java.util.List getBackupTransportWhitelistedService_optional(); diff --git a/services/core/java/com/android/server/am/ProcessList.java b/services/core/java/com/android/server/am/ProcessList.java index 557def44dc666..2573fe54a5c8a 100644 --- a/services/core/java/com/android/server/am/ProcessList.java +++ b/services/core/java/com/android/server/am/ProcessList.java @@ -103,6 +103,7 @@ import com.android.internal.util.ArrayUtils; import com.android.internal.util.MemInfoReader; import com.android.server.LocalServices; import com.android.server.ServiceThread; +import com.android.server.SystemConfig; import com.android.server.Watchdog; import com.android.server.compat.PlatformCompat; import com.android.server.pm.dex.DexManager; @@ -350,6 +351,8 @@ public final class ProcessList { private boolean mAppDataIsolationEnabled = false; + private ArrayList mAppDataIsolationWhitelistedApps; + /** * Temporary to avoid allocations. Protected by main lock. */ @@ -638,6 +641,9 @@ public final class ProcessList { // want some apps enabled while some apps disabled mAppDataIsolationEnabled = SystemProperties.getBoolean(ANDROID_APP_DATA_ISOLATION_ENABLED_PROPERTY, false); + mAppDataIsolationWhitelistedApps = new ArrayList<>( + SystemConfig.getInstance().getAppDataIsolationWhitelistedApps()); + if (sKillHandler == null) { sKillThread = new ServiceThread(TAG + ":kill", @@ -1893,6 +1899,16 @@ public final class ProcessList { result.put(packageName, Pair.create(volumeUuid, inode)); } } + if (mAppDataIsolationWhitelistedApps != null) { + for (String packageName : mAppDataIsolationWhitelistedApps) { + String volumeUuid = pmInt.getPackage(packageName).getVolumeUuid(); + long inode = pmInt.getCeDataInode(packageName, userId); + if (inode != 0) { + result.put(packageName, Pair.create(volumeUuid, inode)); + } + } + } + return result; }