There are only two situations in which we want to enable hidden API
access flag checks. Turning the flag from DISABLE_ to ENABLE_
simplifies logic in ART and reduces the number places where the flag
had to be passed down to ART.
Bug: 64382372
Test: boot device, install and run apps, check log messages
(cherry picked from commit f7e31c0a2b)
Change-Id: Ib2f70696d98c6e1500d1d419d6acf0a8d0487213
There will be the following situations about mApplicationObject：
1) fork app process will invoke ActivityThread.main(),
then set mApplicationObject.
2) fork system_server， don't set mApplicationObject value.
3) using app_process fork process except zygote, will inovke RuntimeInit,
don't set mApplicationObject value。
For example using command as below:
app_process /system/bin com.android.commands.am.Am "$@",
if this process throw uncaught exception，will output FATAL EXCEPTION IN SYSTEM PROCESS log，
it's not in system process but in normal process。
so should add condition： Process.SYSTEM_UID == Process.myUid()
BUG: 72759350
Test: manual
Change-Id: Ie8d769e4149cd9b938577058de871c4f8db9efe5
Signed-off-by: yuanhuihui <yuanhuihui@xiaomi.com>
There was an asymmetry between parcelling and unparcelling of
VerifyCredentialResponse that could lead to type confusion if
packed with other objects in a Parcel.
Test: none
Bug: 71714464
Change-Id: Icff68879e249422ccca49f2bb7db85c35b4cb353
When forking a process for a system app, pass a flag to ART that
will disable enforcement of hidden API access checks.
Test: manual
Bug: 64382372
Change-Id: I5ba81d84a44c9467613f060428b11e1d9d725bd3
For now, system apps will be exempt from hidden API access checks.
Pass the appropriate flag to dexopt.
Test: manual
Bug: 64382372
Bug: 72305689
Merged-In: I5676ffa3a5ba680bf5f6bab0b62f0acf4a933097
Change-Id: Idc3067d2c6040f15fe0f051090ba45efe591ebae
If the qtaguid proc file is no longer exist, the device is running new
eBPF module to do traffic accounting. So the NetworkStatsFactory need to
use the proc/net/dev interface to get the per interface traffic stats
summary. Also, adding a test to verify the helper function work properly
Bug: 30950746
Test: run NetworkStatsFactoryTest
Change-Id: Ia36808bf02f1637dd41a3e7c50917b91b1a77524
Add the native method used to read the detail information of network
stats from bpf maps. The native method of NetworkStatsFactory should
choose the correct implementation to get the stats detail depending on
the kernel version. Currently the bpf result is printed as a reference
and the actual behavior of NetworkStatsFactory should not change.
Test: NetworkStatsFactory related cts test should not fail.
Bug: 30950746
Change-Id: I4715a23559b5b2306bd556cea0431f0ed172a993
This allows us to maintain NetworkStats entries that track
whether the traffic was on the default network.
At the moment, the stats collection code always passes in
DEFAULT_NETWORK_NO. However, this value is a no-op, since it is
not persisted to disk. Only the ident, the uid/set/tag, and the
packet/byte/operation counters are persisted.
A future change will add defaultNetwork to the ident and start
persisting it.
Bug: 35142602
Test: runtest frameworks-net
Change-Id: Ifa291c62c0fa389b88e5561086a29dcd7cee2253
Before this change, seccomp filter setup is as early as in zygote's main
function. To make it possible to split app and system server's filter,
this postpone the setup to after fork. It also starts to call app
specific and system server specific setup function.
The filter setup is done in Zygote's ForkAndSpecializeCommon. This is
because adding a seccomp filter must be done when either the caller has
CAP_SYS_ADMIN or after the PR_SET_NO_NEW_PRIVS bit is set. Given that
setting PR_SET_NO_NEW_PRIVS breaks SELinux domain transition
(b/71859146), this must be done after Zygote forks but before
CAP_SYS_ADMIN is droppped.
Test: (cts) -m CtsSecurityTestCases -t android.security.cts.SeccompTest
Test: no selinux denial flood in dmesg with selinux enforced
Test: debuggerd -b `pidof com.android.phone` # logcat shows tombstoned
received crash request
Bug: 63944145
Bug: 71859146
Change-Id: I8215c8530d3d0de504a270488f8e29635805e8b0
Dex2oat now accepts targetSdkVersion as a parameter to determine
whether ART should treat the app as "legacy" and allow or restrict
access to private APIs.
We also bump arguments of otapreopt to v4 to accommodate the new value.
Bug: 64382372
Test: manual
Change-Id: Iae3867325dfaf8deaba51626ab04b97ad797d3b6
Before this change, seccomp filter setup is as early as in zygote's main
function. To make it possible to split app and system server's filter,
this postpone the setup to after fork. It also starts to call app
specific and system server specific setup function.
In terms of performance since this happens at fork, the measure shows
the overhead is negligible. Assuming 130 instruction in the BPF, on
walleye, even when running on little core with fixed low frequency, each
setup took about 60.9us on average. When it runs on big core with
higher frequency, it took about 39.3us.
Test: (cts) -m CtsSecurityTestCases -t android.security.cts.SeccompTest
Bug: 63944145
Change-Id: I748735b478405098beac1e200d911c13ea60e380
Merged-In: I748735b478405098beac1e200d911c13ea60e380
ResolverActivity sort the list resolved intent with AsyncTask.
The method sort hold CountDownLatch to wait the time-consuming
operation. In some case, the operation doesn't end and the
CountDownLatch can't be released.The default excutor of AsyncTask
is serial. There should release CountDownLatch in destroy()
to avoid this case.
Change-Id: Ie10126f735d9f511dfe086c21f3f5ffaeb831086
Signed-off-by: gaochong <gaochong@xiaomi.com>
Test: manual - repeatedly test ResolverActivity show correctly
Bug: 71730061
Also remove 'build.master@android.com' which is deprecated, not
declared by anybody else, and makes the linter unhappy.
Bug: 70394432
Test: built
Merged-In: I9c0ba41386129379f82259fcc5e745562b014fae
(cherry pick from commit 626eed2ac8)
Change-Id: Ie802113d61f693d73f7234b44ac2a9bd462b3fbf
