Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3ea674c0 authored by Eran Messeri's avatar Eran Messeri
Browse files

Migrate Memory Tagging to DPE 

Move setting of the Memory Tagging policy to DevicePolicyEngine.
This includes storing the MTE policy on the DevicePolicyEngine and
migrating it from the ActiveAdmin to the DevicePolicyEngine.

Bug: 376213673
Test: btest android.devicepolicy.cts.MtePolicyTest
Flag: android.app.admin.flags.set_mte_policy_coexistence

Change-Id: I921aafebd163362a3e550bf2d19983aadeece8ee
parent c05ff705

core/api/current.txt

+1 −0
Original line number Diff line number Diff line
@@ -8023,6 +8023,7 @@ package android.app.admin { 
    field @FlaggedApi("android.view.contentprotection.flags.manage_device_policy_enabled") public static final String CONTENT_PROTECTION_POLICY = "contentProtection";

    field public static final String KEYGUARD_DISABLED_FEATURES_POLICY = "keyguardDisabledFeatures";

    field public static final String LOCK_TASK_POLICY = "lockTask";

    field @FlaggedApi("android.app.admin.flags.set_mte_policy_coexistence") public static final String MEMORY_TAGGING_POLICY = "memoryTagging";

    field public static final String PACKAGES_SUSPENDED_POLICY = "packagesSuspended";

    field public static final String PACKAGE_UNINSTALL_BLOCKED_POLICY = "packageUninstallBlocked";

    field public static final String PASSWORD_COMPLEXITY_POLICY = "passwordComplexity";

core/java/android/app/admin/DevicePolicyIdentifiers.java

+6 −0
Original line number Diff line number Diff line
@@ -190,6 +190,12 @@ public final class DevicePolicyIdentifiers { 
     */

    public static final String PASSWORD_COMPLEXITY_POLICY = "passwordComplexity";



    /**

     * String identifier for {@link DevicePolicyManager#setMtePolicy(int)}.

     */

    @FlaggedApi(android.app.admin.flags.Flags.FLAG_SET_MTE_POLICY_COEXISTENCE)

    public static final String MEMORY_TAGGING_POLICY = "memoryTagging";



    /**

     * @hide

     */

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+109 −29
Original line number Diff line number Diff line
@@ -3551,6 +3551,46 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { 
        return true;

    }





































    @GuardedBy("getLockObject()")













    private boolean maybeMigrateMemoryTaggingLocked(String backupId) {













        if (!Flags.setMtePolicyCoexistence()) {













            Slog.i(LOG_TAG, "Memory Tagging not migrated because coexistence "













                    + "support is disabled.");













            return false;













        }













        if (mOwners.isMemoryTaggingMigrated()) {













            // TODO: Remove log after Flags.setMtePolicyCoexistence full rollout.













            Slog.v(LOG_TAG, "Memory Tagging was previously migrated to policy engine.");













            return false;













        }

























        Slog.i(LOG_TAG, "Migrating Memory Tagging to policy engine");

























        // Create backup if none exists













        mDevicePolicyEngine.createBackup(backupId);













        try {













            iterateThroughDpcAdminsLocked((admin, enforcingAdmin) -> {













                if (admin.mtePolicy != 0) {













                    Slog.i(LOG_TAG, "Setting Memory Tagging policy");













                    mDevicePolicyEngine.setGlobalPolicy(













                            PolicyDefinition.MEMORY_TAGGING,













                            enforcingAdmin,













                            new IntegerPolicyValue(admin.mtePolicy),













                            true /* No need to re-set system properties */);













                }













            });













        } catch (Exception e) {













            Slog.wtf(LOG_TAG,













                    "Failed to migrate Memory Tagging to policy engine", e);













        }

























        Slog.i(LOG_TAG, "Marking Memory Tagging migration complete");













        mOwners.markMemoryTaggingMigrated();













        return true;













    }



























    /** Register callbacks for statsd pulled atoms. */















    private void registerStatsCallbacks() {















        final StatsManager statsManager = mContext.getSystemService(StatsManager.class);










@@ -23332,13 +23372,32 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













            Preconditions.checkCallAuthorization(isDefaultDeviceOwner(caller));















        }



























        if (Flags.setMtePolicyCoexistence()) {













            enforcePermission(MANAGE_DEVICE_POLICY_MTE, caller.getPackageName(),













                    UserHandle.USER_ALL);













        } else {















            Preconditions.checkCallAuthorization(















                    isDefaultDeviceOwner(caller)















                    || isProfileOwnerOfOrganizationOwnedDevice(caller));













        }



























        synchronized (getLockObject()) {













            if (Flags.setMtePolicyCoexistence()) {













                final EnforcingAdmin admin = enforcePermissionAndGetEnforcingAdmin(null,













                        MANAGE_DEVICE_POLICY_MTE, callerPackageName, caller.getUserId());













                if (flags != DevicePolicyManager.MTE_NOT_CONTROLLED_BY_POLICY) {













                    mDevicePolicyEngine.setGlobalPolicy(













                            PolicyDefinition.MEMORY_TAGGING,













                            admin,













                            new IntegerPolicyValue(flags));













                } else {













                    mDevicePolicyEngine.removeGlobalPolicy(













                            PolicyDefinition.MEMORY_TAGGING,













                            admin);













                }













            } else {















                ActiveAdmin admin =















                        getDeviceOwnerOrProfileOwnerOfOrganizationOwnedDeviceLocked();



























                if (admin != null) {















                    final String memtagProperty = "arm64.memtag.bootctl";















                    if (flags == DevicePolicyManager.MTE_ENABLED) {









@@ -23352,6 +23411,8 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













                    }















                    admin.mtePolicy = flags;















                    saveSettingsLocked(caller.getUserId());













                }













            }





























            DevicePolicyEventLogger.createEvent(DevicePolicyEnums.SET_MTE_POLICY)















                    .setInt(flags)









@@ -23359,17 +23420,29 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













                    .write();















        }















    }













    }





























    @Override















    public int getMtePolicy(String callerPackageName) {















        final CallerIdentity caller = getCallerIdentity(callerPackageName);













        if (Flags.setMtePolicyCoexistence()) {













            enforcePermission(MANAGE_DEVICE_POLICY_MTE, caller.getPackageName(),













                    UserHandle.USER_ALL);













        } else {















            Preconditions.checkCallAuthorization(















                    isDefaultDeviceOwner(caller)















                    || isProfileOwnerOfOrganizationOwnedDevice(caller)















                    || isSystemUid(caller));













        }





























        synchronized (getLockObject()) {













            if (Flags.setMtePolicyCoexistence()) {













                final EnforcingAdmin admin = enforcePermissionAndGetEnforcingAdmin(null,













                        MANAGE_DEVICE_POLICY_MTE, callerPackageName, caller.getUserId());













                final Integer policyFromAdmin = mDevicePolicyEngine.getGlobalPolicySetByAdmin(













                        PolicyDefinition.MEMORY_TAGGING, admin);













                return (policyFromAdmin != null ? policyFromAdmin













                        : DevicePolicyManager.MTE_NOT_CONTROLLED_BY_POLICY);













            } else {















                ActiveAdmin admin =















                        getDeviceOwnerOrProfileOwnerOfOrganizationOwnedDeviceLocked();















                return admin != null









@@ -23377,6 +23450,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













                        : DevicePolicyManager.MTE_NOT_CONTROLLED_BY_POLICY;















            }















        }













    }





























    @Override















    public void setContentProtectionPolicy(










@@ -23736,6 +23810,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













            Slogf.i(LOG_TAG, "Backup made: " + supervisionBackupId);















        }



























        String memoryTaggingBackupId = "36.3.memory-tagging";













        boolean memoryTaggingMigrated = maybeMigrateMemoryTaggingLocked(memoryTaggingBackupId);













        if (memoryTaggingMigrated) {













            Slogf.i(LOG_TAG, "Backup made: " + memoryTaggingBackupId);













        }



























        // Additional migration steps should repeat the pattern above with a new backupId.















    }







































services/devicepolicy/java/com/android/server/devicepolicy/Owners.java



+13
−0




























Original line number
Diff line number
Diff line








@@ -682,6 +682,19 @@ class Owners {













        }















    }





























    void markMemoryTaggingMigrated() {













        synchronized (mData) {













            mData.mMemoryTaggingMigrated = true;













            mData.writeDeviceOwner();













        }













    }



























    boolean isMemoryTaggingMigrated() {













        synchronized (mData) {













            return mData.mMemoryTaggingMigrated;













        }













    }





























    @GuardedBy("mData")















    void pushToAppOpsLocked() {















        if (!mSystemReady) {

































services/devicepolicy/java/com/android/server/devicepolicy/OwnersData.java



+11
−1




























Original line number
Diff line number
Diff line








@@ -93,6 +93,9 @@ class OwnersData {













    private static final String ATTR_SUSPENDED_PACKAGES_MIGRATED = "suspendedPackagesMigrated";















    private static final String ATTR_RESET_PASSWORD_WITH_TOKEN_MIGRATED =















            "resetPasswordWithTokenMigrated";













    private static final String ATTR_MEMORY_TAGGING_MIGRATED =













            "memoryTaggingMigrated";





























    private static final String ATTR_MIGRATED_POST_UPGRADE = "migratedPostUpgrade";































    // Internal state for the device owner package.










@@ -125,6 +128,7 @@ class OwnersData {













    boolean mRequiredPasswordComplexityMigrated = false;















    boolean mSuspendedPackagesMigrated = false;















    boolean mResetPasswordWithTokenMigrated = false;













    boolean mMemoryTaggingMigrated = false;































    boolean mPoliciesMigratedPostUpdate = false;


























@@ -424,6 +428,10 @@ class OwnersData {













                out.attributeBoolean(null, ATTR_RESET_PASSWORD_WITH_TOKEN_MIGRATED,















                        mResetPasswordWithTokenMigrated);















            }













            if (Flags.setMtePolicyCoexistence()) {













                out.attributeBoolean(null, ATTR_MEMORY_TAGGING_MIGRATED,













                        mMemoryTaggingMigrated);













            }















            out.endTag(null, TAG_POLICY_ENGINE_MIGRATION);































        }










@@ -497,7 +505,9 @@ class OwnersData {













                    mResetPasswordWithTokenMigrated = Flags.resetPasswordWithTokenCoexistence()















                            && parser.getAttributeBoolean(null,















                            ATTR_RESET_PASSWORD_WITH_TOKEN_MIGRATED, false);



























                    mMemoryTaggingMigrated = Flags.setMtePolicyCoexistence()













                            && parser.getAttributeBoolean(null,













                            ATTR_MEMORY_TAGGING_MIGRATED, false);















                    break;















                default:















                    Slog.e(TAG, "Unexpected tag: " + tag);