Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare installer against rule providers

Browse Source 
Test: atest FrameworksServicesTests:AppIntegrityManagerServiceImplTest
Change-Id: I3c89276e5fad357dd049593acbe4623567e31679
This commit is contained in:
Khaled Abdelmohsen
2020-01-22 19:25:42 +00:00
parent 77129e43f2
commit eab3f92132
1 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
services/core/java/com/android/server/integrity/AppIntegrityManagerServiceImpl.java
View File

@@ -67,7 +67,9 @@ import java.security.cert.CertificateEncodingException;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.Arrays;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
/** Implementation of {@link AppIntegrityManagerService}. */
@@ -220,11 +222,10 @@ public class AppIntegrityManagerServiceImpl extends IAppIntegrityManager.Stub {
return;
}
String ruleProvider = getCallerPackageName();
String installerPackageName = getInstallerPackageName(intent);
// Skip integrity verification if the verifier is doing the install.
if (ruleProvider != null && ruleProvider.equals(installerPackageName)) {
if (isRuleProvider(installerPackageName)) {
Slog.i(TAG, "Verifier doing the install. Skipping integrity check.");
mPackageManagerInternal.setIntegrityVerificationResult(
verificationId, PackageManagerInternal.INTEGRITY_VERIFICATION_ALLOW);
@@ -281,7 +282,7 @@ public class AppIntegrityManagerServiceImpl extends IAppIntegrityManager.Stub {
* Verify the UID and return the installer package name.
*
* @return the package name of the installer, or null if it cannot be determined or it is
* installed via adb.
* installed via adb.
*/
@Nullable
private String getInstallerPackageName(Intent intent) {
@@ -538,9 +539,7 @@ public class AppIntegrityManagerServiceImpl extends IAppIntegrityManager.Stub {
}
private String getCallerPackageName() {
final String[] allowedRuleProviders =
mContext.getResources()
.getStringArray(R.array.config_integrityRuleProviderPackages);
final List<String> allowedRuleProviders = getAllowedRuleProviders();
for (String packageName : allowedRuleProviders) {
try {
// At least in tests, getPackageUid gives "NameNotFound" but getPackagesFromUid
@@ -570,4 +569,14 @@ public class AppIntegrityManagerServiceImpl extends IAppIntegrityManager.Stub {
return false;
}
}
private List<String> getAllowedRuleProviders() {
return Arrays.asList(mContext.getResources().getStringArray(
R.array.config_integrityRuleProviderPackages));
}
private boolean isRuleProvider(String installerPackageName) {
return getAllowedRuleProviders().stream().anyMatch(
ruleProvider -> ruleProvider.equals(installerPackageName));
}
}