Listener is more secure as nobody can send a broadcast with invalid
digests.
Bug: 160605420
Test: atest PackageManagerShellCommandTest PackageManagerShellCommandIncrementalTest IncrementalServiceTest PackageManagerServiceTest ChecksumsTest
Change-Id: I5f6ec3f0fa975d274d456d11d57be61d0b245e80
Completely deletes all the code for v1 of domain verification,
delegating everything to the new DomainVerificationService.
Exempt-From-Owner-Approval: Already approved by owners on main branch
Bug: 171251883
Test: none, removal of effectively dead code
Change-Id: Ib222ccd46019c1c28b402c0f68466077b62871c1
These legacy settings need to be migrated once to the new domain
verification API, so this pulls the parsing out of the legacy classes
into a DomainVerificationLegacySettings.
This does NOT handle serializing the legacy settings. It's assumed
that migration is a one-time best effort attempt, and that dropping
the legacy settings is an acceptable fallback.
The old setting was a result of an unexplained and unintuitive user
path, set through ResolverActivity, and so it's not clear whether we
should migrate at all.
Worst case, the user can always re-do their preferences.
NOTE: This change should only be merged if merged together with the
change that removes the legacy code. It's invalid to run these
separately, as this change breaks the legacy manager class. These are
only separate to make review easier, to separate their concerns.
Exempt-From-Owner-Approval: Already approved by owners on main branch
Bug: 171251883
Test: TODO
Change-Id: Iefde9f2cd8ab73cb5f592abc7d2163dd7d244789
Backporting the new per-domain state to the old v1 intent filter
verification agent API.
Uses a new STATE_LEGACY_FAILURE to track the failedDomains returned by
the v1 verification agent, to support per-domain state with the old API.
Exempt-From-Owner-Approval: Already approved by owners on main branch
Bug: 170321181
Test: TBD in later change when proxies are combined
Change-Id: I2953f7e0100d425dcb806c607fdeae101803d8f4
Implements the behavior of either delegating to an approved app for
a web domain, or the browsers, removing the "always ask" and "never"
options for applications.
This also considers cross profile intents, and will allow those to be
shown if the other profile has an approved handler.
This also migrates instant app state to the new behavior. Instant apps
will now be granted completely immutable autoVerify approval, to
preserve their automatic opening behavior. The user would have to
disable the app in settings similar to an auto approved system app.
This is flagged through USE_DOMAIN_VERIFICATION_V2. For now, both v1
and v2 run entirely parallel, until the v1 APIs are removed in a
follow up.
Exempt-From-Owner-Approval: Already approved by owners on main branch
Bug: 163564991
Test: TODO
Change-Id: I1a90f6b2b9bf2f108c5dc1b944985bc150c405a7
Support for mutating internal state using pm shell commands.
Also wires up the boot broadcast now that the ability to verify all
unverified packages has been added.
Exempt-From-Owner-Approval: Already approved by owners on main branch
Bug: 163565712
Test: TODO
Change-Id: I809436c6b8ff04cdc68430303859d2d7f40d9557
Contains the core SDK @SystemApi portion of the domain verification
APIs, including the state codes and get/set methods for package/user
state.
Set methods are gated by corresponding permissions, but get methods
were left available as general @SystemApi in case someone finds a use
case for them.
Adds a new exception which allows the manager to be more specific in
what caused a failure.
Exempt-From-Owner-Approval: Already approved by owners on main branch
Bug: 163565712
Test: none, just API interfaces, will be tested with implementation
Change-Id: I86802fe4b88a8a0f63a1798944c5d8c3a3bab09b
Includes the request class sent to the verification agent and the 2
data classes returned by the to-be-added DomainVerificationManager.
Exempt-From-Owner-Approval: Already approved by owners on main branch
Bug: 163565712
CTS-Coverage-Bug: 179382047
Test: atest DomainVerificationCoreApiTest
Change-Id: If9f1b987f0d06c930f6c44b58af101b83947acb9
1. Use registerWindowContextListener instead of
addWindowTokenWithOptions
2. Clean up the logic of sending the config to the client in WindowToken
3. Add a mechanism in WMS#addWindow, when a WindowContext adds a view,
the server side will switch to register the WindowToken for the
WindowContext.
In this way, we won't add a WindowToken until adding the fist view.
Also, we could apply an existing window token by overriding
WindowManager.LayoutParams.token.
Bug: 159767464
Bug: 153369119
Test: atest WindowContextTests WindowContextPolicyTests
Test: atest WindowContextTest
Test: atest WindowContextListenerControllerTests
Change-Id: I2396187c445306d18101706c4521edd9cf92facf
Added appop to the set of protection flags that can be used without
combining with a base protection of 'signature' or 'internal'.
Test: Builds, boots.
Bug: 179304245
Change-Id: Ifd7f925acdb560d966905f54603f68519311d9ad
Add feature flags to indicate whether KeyMint only enforce
this feature in hardware with count == 1 or enforce with
any number of the count (>=1).
Bug: b/174140443
Test: compile
Change-Id: Id9c13ee91b779164bd07ff20ae2b4c0e158fdb33
memtagMode allows an app to opt in to MTE in either sync or async mode.
nativeHeapZeroInit enables automatic initialization of heap memory.
Both attributes default to off and can be specified at either
application or process level.
Bug: 135772972
Bug: 177438394
Bug: 178038272
Test: CtsTaggingHostTestCases
Change-Id: I6a481a9d2363997bf954f248d08224c79f0c2afb
Similar to passing in display metrics. We can use
ActivityThread.currentApplication() as the context for getting
PermissionManager in system server process because it will be created
early in ActivityThread.attach() before any custom logic can run, but
it becomes a problem for apps because they can run their own logic by
overriding Application.attachBaseContext() and do things there before
ActivityThread.currentApplication() becomes non-null.
So pass in the split permissions explicitly as an external dependency
for ParsingPackageUtils, and move the getPackageArchiveInfo()
implementation from PackageManager to ApplicationPackageManager to
utilize the context there. PackageParser2 can get the split
permissions internally because it's only used in system server.
Fixes: 178155985
Test: manual
Change-Id: I8213cf752e16b08328ad1150b2639da18c5d0e83
(cherry picked from commit 7b8974d375)
Add feature flags to indicate whether KeyMint only enforce
this feature in hardware with count == 1 or enforce with
any number of the count (>=1).
Test: compile
Change-Id: Id9c13ee91b779164bd07ff20ae2b4c0e158fdb33
Merged-In: Id9c13ee91b779164bd07ff20ae2b4c0e158fdb33
This string allows apps add a media_capabilities.xml resource to the
AndroidManifest.xml
The media_capabilities.xml file will in turn allow apps declare the
media capabilities they support, so the OS can transcode unsupported
formats to compatible formats for the app
Note, that the hard-coded string is already in use in MediaProvider
and is covered by TranscodeTest mentioned below
Test: atest TranscodeTest
Bug: 178187121
Change-Id: I46cfaefe8fb7f0bbd14896efdee61dcc4da19783
