Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0f699cbb authored by Songchun Fan's avatar Songchun Fan Committed by Hung-ying Tyan
Browse files

[pm] a system config to let oems register uids 

BUG: 287574607
Test: manually enable the flag and set a test uid via the xml and verify
that the uid is added by adding logs. Notice that the newly added uid
will be cleared if there's no package installed with the specified shared uid.

(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:616d913df8e3bb896173b807b005efca3b82201d)
(cherry picked from https://android-review.googlesource.com/q/commit:077343adb6e61376e85d3cd42167f5883491e738)
Merged-In: Ic436003390c8feb4c5e9a36106abc1f7ab7f5a46
Change-Id: Ic436003390c8feb4c5e9a36106abc1f7ab7f5a46
parent a8a41f98

data/etc/Android.bp

+6 −0
Original line number Diff line number Diff line
@@ -78,6 +78,12 @@ prebuilt_etc { 
    src: "package-shareduid-allowlist.xml",

}



prebuilt_etc {

    name: "oem-defined-uids.xml",

    sub_dir: "sysconfig",

    src: "oem-defined-uids.xml",

}



// Privapp permission whitelist files



prebuilt_etc {

data/etc/oem-defined-uids.xml

0 → 100644
+38 −0
Original line number Diff line number Diff line 
<?xml version="1.0" encoding="utf-8"?>

<!--

  ~ Copyright (C) 2024 The Android Open Source Project

  ~

  ~ Licensed under the Apache License, Version 2.0 (the "License");

  ~ you may not use this file except in compliance with the License.

  ~ You may obtain a copy of the License at

  ~

  ~      http://www.apache.org/licenses/LICENSE-2.0

  ~

  ~ Unless required by applicable law or agreed to in writing, software

  ~ distributed under the License is distributed on an "AS IS" BASIS,

  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

  ~ See the License for the specific language governing permissions and

  ~ limitations under the License.

 -->



<!--

This XML defines a list of UIDs for OEMs to register as shared UIDs. They will be registered at the

start of the system, which allows OEMs to create services with these UIDs. The range of these UIDs

must be in the OEM reserved range.



OEM must provide a preloaded app that is installed at boot time to retain the newly registered UID

by adding a android:sharedUserId tag in the manifest of the preloaded app, with the value of the tag

set to the name of the UID defined in this config file. Otherwise, the uid will be cleared at the

end of the boot and this config file will take no effect.



- The "name" XML attribute refers to the name of the shared UID. It must start with "android.uid.".

- The "uid" XML attribute refers to the value of the shared UID. It must be in range [2900, 2999].



Example usage

    <oem-defined-uid name="android.uid.vendordata" uid="2918"/>

    Indicates that a shared UID named "android.uid.vendordata" will be added to the system with the

    UID of 2918.

-->



<config>

</config>

services/core/java/com/android/server/SystemConfig.java

+28 −0
Original line number Diff line number Diff line
@@ -371,6 +371,10 @@ public class SystemConfig { 
    // exempt from ECM (i.e., they will never be considered "restricted").

    private final ArraySet<SignedPackage> mEnhancedConfirmationTrustedInstallers = new ArraySet<>();



    // A map of UIDs defined by OEMs, mapping from name to value. The UIDs will be registered at the

    // start of the system which allows OEMs to create and register their system services.

    @NonNull private final ArrayMap<String, Integer> mOemDefinedUids = new ArrayMap<>();



    /**

     * Map of system pre-defined, uniquely named actors; keys are namespace,

     * value maps actor name to package name.
@@ -594,6 +598,10 @@ public class SystemConfig { 
        return mEnhancedConfirmationTrustedInstallers;

    }



    @NonNull

    public ArrayMap<String, Integer> getOemDefinedUids() {

        return mOemDefinedUids;

    }

    /**

     * Only use for testing. Do NOT use in production code.

     * @param readPermissions false to create an empty SystemConfig; true to read the permissions.
@@ -1628,6 +1636,26 @@ public class SystemConfig { 
                            }

                        }

                    } break;

                    case "oem-defined-uid": {

                        final String uidName = parser.getAttributeValue(null, "name");

                        final String uidValue = parser.getAttributeValue(null, "uid");

                        if (TextUtils.isEmpty(uidName)) {

                            Slog.w(TAG, "<" + name + "> without valid uid name in " + permFile

                                    + " at " + parser.getPositionDescription());

                        } else if (TextUtils.isEmpty(uidValue)) {

                            Slog.w(TAG, "<" + name + "> without valid uid value in " + permFile

                                    + " at " + parser.getPositionDescription());

                        } else {

                            try {

                                final int oemDefinedUid = Integer.parseInt(uidValue);

                                mOemDefinedUids.put(uidName, oemDefinedUid);

                            } catch (NumberFormatException e) {

                                Slog.w(TAG, "<" + name + "> with invalid uid value: "

                                        + uidValue + " in " + permFile

                                        + " at " + parser.getPositionDescription());

                            }

                        }

                    } break;

                    case "enhanced-confirmation-trusted-package": {

                        if (android.permission.flags.Flags.enhancedConfirmationModeApisEnabled()) {

                            SignedPackage signedPackage = parseEnhancedConfirmationTrustedPackage(

services/core/java/com/android/server/pm/PackageManagerService.java

+11 −3
Original line number Diff line number Diff line
@@ -2033,6 +2033,10 @@ public class PackageManagerService implements PackageSender, TestUtilityService 
        // CHECKSTYLE:ON IndentationCheck

        t.traceEnd();



        t.traceBegin("get system config");

        SystemConfig systemConfig = injector.getSystemConfig();

        t.traceEnd();



        t.traceBegin("addSharedUsers");

        mSettings.addSharedUserLPw("android.uid.system", Process.SYSTEM_UID,

                ApplicationInfo.FLAG_SYSTEM, ApplicationInfo.PRIVATE_FLAG_PRIVILEGED);
@@ -2052,6 +2056,13 @@ public class PackageManagerService implements PackageSender, TestUtilityService 
                ApplicationInfo.FLAG_SYSTEM, ApplicationInfo.PRIVATE_FLAG_PRIVILEGED);

        mSettings.addSharedUserLPw("android.uid.uwb", UWB_UID,

                ApplicationInfo.FLAG_SYSTEM, ApplicationInfo.PRIVATE_FLAG_PRIVILEGED);

        final ArrayMap<String, Integer> oemDefinedUids = systemConfig.getOemDefinedUids();

        final int numOemDefinedUids = oemDefinedUids.size();

        for (int i = 0; i < numOemDefinedUids; i++) {

            mSettings.addOemSharedUserLPw(oemDefinedUids.keyAt(i), oemDefinedUids.valueAt(i),

                    ApplicationInfo.FLAG_SYSTEM, ApplicationInfo.PRIVATE_FLAG_PRIVILEGED);

        }



        t.traceEnd();



        String separateProcesses = SystemProperties.get("debug.separate_processes");
@@ -2083,10 +2094,7 @@ public class PackageManagerService implements PackageSender, TestUtilityService 
        mContext.getSystemService(DisplayManager.class)

                .getDisplay(Display.DEFAULT_DISPLAY).getMetrics(mMetrics);



        t.traceBegin("get system config");

        SystemConfig systemConfig = injector.getSystemConfig();

        mAvailableFeatures = systemConfig.getAvailableFeatures();

        t.traceEnd();



        mProtectedPackages = new ProtectedPackages(mContext);

services/core/java/com/android/server/pm/Settings.java

+15 −0
Original line number Diff line number Diff line
@@ -976,6 +976,21 @@ public final class Settings implements Watchable, Snappable, ResilientAtomicFile 
        return null;

    }



    SharedUserSetting addOemSharedUserLPw(String name, int uid, int pkgFlags, int pkgPrivateFlags) {

        if (!name.startsWith("android.uid")) {

            PackageManagerService.reportSettingsProblem(Log.ERROR,

                    "Failed to add oem defined shared user because of invalid name: " + name);

            return null;

        }

        // OEM defined uids must be in the OEM reserved range

        if (uid < 2900 || uid > 2999) {

            PackageManagerService.reportSettingsProblem(Log.ERROR,

                    "Failed to add oem defined shared user because of invalid uid: " + uid);

            return null;

        }

        return addSharedUserLPw(name, uid, pkgFlags, pkgPrivateFlags);

    }



    SharedUserSetting addSharedUserLPw(String name, int uid, int pkgFlags, int pkgPrivateFlags) {

        SharedUserSetting s = mSharedUsers.get(name);

        if (s != null) {