Merge "Add SELinux updater and Settings-based enforcement switch." into jb-mr2-dev

core/java/android/provider/Settings.java

@@ -5347,6 +5347,62 @@ public final class Settings {
          */
         public static final String AUDIO_SAFE_VOLUME_STATE = "audio_safe_volume_state";
 
+        /**
+         * URL for tzinfo (time zone) updates
+         * @hide
+         */
+        public static final String TZINFO_UPDATE_CONTENT_URL = "tzinfo_content_url";
+
+        /**
+         * URL for tzinfo (time zone) update metadata
+         * @hide
+         */
+        public static final String TZINFO_UPDATE_METADATA_URL = "tzinfo_metadata_url";
+
+        /**
+         * URL for selinux (mandatory access control) updates
+         * @hide
+         */
+        public static final String SELINUX_UPDATE_CONTENT_URL = "selinux_content_url";
+
+        /**
+         * URL for selinux (mandatory access control) update metadata
+         * @hide
+         */
+        public static final String SELINUX_UPDATE_METADATA_URL = "selinux_metadata_url";
+
+        /**
+         * URL for sms short code updates
+         * @hide
+         */
+        public static final String SMS_SHORT_CODES_UPDATE_CONTENT_URL =
+                "sms_short_codes_content_url";
+
+        /**
+         * URL for sms short code update metadata
+         * @hide
+         */
+        public static final String SMS_SHORT_CODES_UPDATE_METADATA_URL =
+                "sms_short_codes_metadata_url";
+
+        /**
+         * URL for cert pinlist updates
+         * @hide
+         */
+        public static final String CERT_PIN_UPDATE_CONTENT_URL = "cert_pin_content_url";
+
+        /**
+         * URL for cert pinlist updates
+         * @hide
+         */
+        public static final String CERT_PIN_UPDATE_METADATA_URL = "cert_pin_metadata_url";
+
+        /**
+         * SELinux enforcement status. If 0, permissive; if 1, enforcing.
+         * @hide
+         */
+        public static final String SELINUX_STATUS = "selinux_status";
+
         /**
          * Settings to backup. This is here so that it's in the same place as the settings
          * keys and easy to update.

core/res/AndroidManifest.xml

@@ -2313,6 +2313,12 @@
             </intent-filter>
         </receiver>
 
+        <receiver android:name="com.android.server.updates.SELinuxPolicyInstallReceiver" >
+            <intent-filter>
+                <action android:name="android.intent.action.UPDATE_SEPOLICY" />
+            </intent-filter>
+        </receiver>
+
         <receiver android:name="com.android.server.MasterClearReceiver"
             android:permission="android.permission.MASTER_CLEAR"
             android:priority="100" >

services/java/com/android/server/updates/ConfigUpdateInstallReceiver.java

@@ -102,6 +102,7 @@ public class ConfigUpdateInstallReceiver extends BroadcastReceiver {
                         Slog.i(TAG, "Found new update, installing...");
                         install(altContent, altVersion);
                         Slog.i(TAG, "Installation successful");
+                        postInstall(context, intent);
                     }
                 } catch (Exception e) {
                     Slog.e(TAG, "Could not update content!", e);
@@ -257,4 +258,7 @@ public class ConfigUpdateInstallReceiver extends BroadcastReceiver {
         writeUpdate(updateDir, updateContent, content);
         writeUpdate(updateDir, updateVersion, Long.toString(version).getBytes());
     }
+
+    protected void postInstall(Context context, Intent intent) {
+    }
 }

services/java/com/android/server/updates/SELinuxPolicyInstallReceiver.java

@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.updates;
+
+import android.content.Context;
+import android.content.Intent;
+import android.os.SELinux;
+import android.provider.Settings;
+import android.util.Base64;
+import android.util.Slog;
+
+import java.io.IOException;
+
+public class SELinuxPolicyInstallReceiver extends ConfigUpdateInstallReceiver {
+
+    public SELinuxPolicyInstallReceiver() {
+        super("/data/security/", "sepolicy", "metadata/", "version");
+    }
+
+    @Override
+    protected void install(byte[] encodedContent, int version) throws IOException {
+        super.install(Base64.decode(encodedContent, Base64.DEFAULT), version);
+    }
+
+    @Override
+    protected void postInstall(Context context, Intent intent) {
+           boolean mode = Settings.Global.getInt(context.getContentResolver(),
+                                                Settings.Global.SELINUX_STATUS, 0) == 1;
+           SELinux.setSELinuxEnforce(mode);
+    }
+}