Merge "Use key rotation aware check when sharedUID signatures change on OTA" into tm-dev

services/core/java/com/android/server/pm/PackageManagerServiceUtils.java

@@ -19,6 +19,7 @@ package com.android.server.pm;
 import static android.content.pm.PackageManager.INSTALL_FAILED_SHARED_USER_INCOMPATIBLE;
 import static android.content.pm.PackageManager.INSTALL_FAILED_UPDATE_INCOMPATIBLE;
 import static android.content.pm.PackageManager.INSTALL_FAILED_VERSION_DOWNGRADE;
+import static android.content.pm.SigningDetails.CertCapabilities.SHARED_USER_ID;
 import static android.system.OsConstants.O_CREAT;
 import static android.system.OsConstants.O_RDWR;
 
@@ -565,13 +566,8 @@ public class PackageManagerServiceUtils {
             // the older ones.  We check to see if either the new package is signed by an older cert
             // with which the current sharedUser is ok, or if it is signed by a newer one, and is ok
             // with being sharedUser with the existing signing cert.
-            boolean match =
+            boolean match = canJoinSharedUserId(parsedSignatures,
-                    parsedSignatures.checkCapability(
+                    sharedUserSetting.getSigningDetails());
-                            sharedUserSetting.getSigningDetails(),
-                            SigningDetails.CertCapabilities.SHARED_USER_ID)
-                    || sharedUserSetting.getSigningDetails().checkCapability(
-                            parsedSignatures,
-                            SigningDetails.CertCapabilities.SHARED_USER_ID);
             // Special case: if the sharedUserId capability check failed it could be due to this
             // being the only package in the sharedUserId so far and the lineage being updated to
             // deny the sharedUserId capability of the previous key in the lineage.
@@ -645,6 +641,28 @@ public class PackageManagerServiceUtils {
         return compatMatch;
     }
 
+    /**
+     * Returns whether the package with {@code packageSigningDetails} can join the sharedUserId
+     * with {@code sharedUserSigningDetails}.
+     * <p>
+     * A sharedUserId maintains a shared {@link SigningDetails} containing the full lineage and
+     * capabilities for each package in the sharedUserId. A package can join the sharedUserId if
+     * its current signer is the same as the shared signer, or if the current signer of either
+     * is in the signing lineage of the other with the {@link
+     * SigningDetails.CertCapabilities#SHARED_USER_ID} capability granted to that previous signer
+     * in the lineage.
+     *
+     * @param packageSigningDetails the {@code SigningDetails} of the package seeking to join the
+     *                             sharedUserId
+     * @param sharedUserSigningDetails the {@code SigningDetails} of the sharedUserId
+     * @return true if the package seeking to join the sharedUserId meets the requirements
+     */
+    public static boolean canJoinSharedUserId(@NonNull SigningDetails packageSigningDetails,
+            @NonNull SigningDetails sharedUserSigningDetails) {
+        return packageSigningDetails.checkCapability(sharedUserSigningDetails, SHARED_USER_ID)
+                || sharedUserSigningDetails.checkCapability(packageSigningDetails, SHARED_USER_ID);
+    }
+
     /**
      * Extract native libraries to a target path
      */

services/core/java/com/android/server/pm/ReconcilePackageUtils.java

@@ -22,11 +22,9 @@ import static android.content.pm.SigningDetails.CapabilityMergeRule.MERGE_RESTRI
 
 import static com.android.server.pm.PackageManagerService.SCAN_BOOTING;
 import static com.android.server.pm.PackageManagerService.SCAN_DONT_KILL_APP;
-import static com.android.server.pm.PackageManagerServiceUtils.compareSignatures;
 
 import android.content.pm.PackageManager;
 import android.content.pm.SharedLibraryInfo;
-import android.content.pm.Signature;
 import android.content.pm.SigningDetails;
 import android.os.SystemProperties;
 import android.util.ArrayMap;
@@ -212,12 +210,10 @@ final class ReconcilePackageUtils {
                     // the signatures on the first package scanned for the shared user (i.e. if the
                     // signaturesChanged state hasn't been initialized yet in SharedUserSetting).
                     if (sharedUserSetting != null) {
-                        final Signature[] sharedUserSignatures = sharedUserSetting
-                                .signatures.mSigningDetails.getSignatures();
                         if (sharedUserSetting.signaturesChanged != null
-                                && compareSignatures(sharedUserSignatures,
+                                && !PackageManagerServiceUtils.canJoinSharedUserId(
-                                parsedPackage.getSigningDetails().getSignatures())
+                                parsedPackage.getSigningDetails(),
-                                != PackageManager.SIGNATURE_MATCH) {
+                                sharedUserSetting.getSigningDetails())) {
                             if (SystemProperties.getInt("ro.product.first_api_level", 0) <= 29) {
                                 // Mismatched signatures is an error and silently skipping system
                                 // packages will likely break the device in unforeseen ways.