Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4cd70ac4 authored by Jackal Guo's avatar Jackal Guo
Browse files

Remove unused PackageManagerNative APIs 

These APIs was used by IORAP, and some of them aren't well protected.
Since IORAP are removed from Android, removing these APIs to mitigate
the vunlerability.

Bug: 213903886
Test: build
Test: manually using the PoC in the buganizer to ensure the symptom
      no longer exists.
Change-Id: I3e6c9e74476f2a3621a223bbc4851927ddc3d619
parent 888ca1af

core/java/android/os/Process.java

+0 −6
Original line number Diff line number Diff line
@@ -212,12 +212,6 @@ public class Process { 
     */

    public static final int SE_UID = 1068;



    /**

     * Defines the UID/GID for the iorapd.

     * @hide

     */

    public static final int IORAPD_UID = 1071;



    /**

     * Defines the UID/GID for the NetworkStack app.

     * @hide

services/core/java/com/android/server/pm/ComputerEngine.java

+2 −7
Original line number Diff line number Diff line
@@ -129,8 +129,6 @@ import com.android.server.pm.parsing.PackageInfoUtils; 
import com.android.server.pm.parsing.pkg.AndroidPackage;

import com.android.server.pm.parsing.pkg.AndroidPackageUtils;

import com.android.server.pm.permission.PermissionManagerServiceInternal;

import com.android.server.pm.pkg.PackageState;

import com.android.server.pm.pkg.PackageStateImpl;

import com.android.server.pm.pkg.PackageStateInternal;

import com.android.server.pm.pkg.PackageStateUtils;

import com.android.server.pm.pkg.PackageUserStateInternal;
@@ -4274,11 +4272,8 @@ public class ComputerEngine implements Computer { 


    @Override

    public List<String> getAllPackages() {

        // Allow iorapd to call this method.

        if (Binder.getCallingUid() != Process.IORAPD_UID) {

        PackageManagerServiceUtils.enforceSystemOrRootOrShell(

                "getAllPackages is limited to privileged callers");

        }

        final int callingUid = Binder.getCallingUid();

        final int callingUserId = UserHandle.getUserId(callingUid);

        if (canViewInstantApps(callingUid, callingUserId)) {

services/core/java/com/android/server/pm/DeletePackageHelper.java

+0 −14
Original line number Diff line number Diff line
@@ -39,7 +39,6 @@ import android.app.ApplicationPackageManager; 
import android.content.Intent;

import android.content.pm.ApplicationInfo;

import android.content.pm.IPackageDeleteObserver2;

import android.content.pm.PackageChangeEvent;

import android.content.pm.PackageInstaller;

import android.content.pm.PackageManager;

import android.content.pm.SharedLibraryInfo;
@@ -751,7 +750,6 @@ final class DeletePackageHelper { 
            } catch (RemoteException e) {

                Log.i(TAG, "Observer no longer exists.");

            } //end catch

            notifyPackageChangeObserversOnDelete(packageName, versionCode);



            // Prune unused static shared libraries which have been cached a period of time

            mPm.schedulePruneUnusedStaticSharedLibraries(true /* delay */);
@@ -811,18 +809,6 @@ final class DeletePackageHelper { 
        return result;

    }



    private void notifyPackageChangeObserversOnDelete(String packageName, long version) {

        PackageChangeEvent pkgChangeEvent = new PackageChangeEvent();

        pkgChangeEvent.packageName = packageName;

        pkgChangeEvent.version = version;

        pkgChangeEvent.lastUpdateTimeMillis = 0L;

        pkgChangeEvent.newInstalled = false;

        pkgChangeEvent.dataRemoved = false;

        pkgChangeEvent.isDeleted = true;



        mPm.notifyPackageChangeObservers(pkgChangeEvent);

    }



    private static class TempUserState {

        public final int enabledState;

        @Nullable

services/core/java/com/android/server/pm/InstallPackageHelper.java

+0 −19
Original line number Diff line number Diff line
@@ -102,7 +102,6 @@ import android.content.IntentSender; 
import android.content.pm.ApplicationInfo;

import android.content.pm.DataLoaderType;

import android.content.pm.IPackageInstallObserver2;

import android.content.pm.PackageChangeEvent;

import android.content.pm.PackageInfo;

import android.content.pm.PackageInfoLite;

import android.content.pm.PackageInstaller;
@@ -2348,29 +2347,11 @@ final class InstallPackageHelper { 
            // BackgroundDexOptService will remove it from its denylist.

            // TODO: Layering violation

            BackgroundDexOptService.getService().notifyPackageChanged(packageName);



            notifyPackageChangeObserversOnUpdate(reconciledPkg);

        }

        PackageManagerServiceUtils.waitForNativeBinariesExtractionForIncremental(

                incrementalStorages);

    }



    private void notifyPackageChangeObserversOnUpdate(ReconciledPackage reconciledPkg) {

        final PackageSetting pkgSetting = reconciledPkg.mPkgSetting;

        final PackageInstalledInfo pkgInstalledInfo = reconciledPkg.mInstallResult;

        final PackageRemovedInfo pkgRemovedInfo = pkgInstalledInfo.mRemovedInfo;



        PackageChangeEvent pkgChangeEvent = new PackageChangeEvent();

        pkgChangeEvent.packageName = pkgSetting.getPkg().getPackageName();

        pkgChangeEvent.version = pkgSetting.getVersionCode();

        pkgChangeEvent.lastUpdateTimeMillis = pkgSetting.getLastUpdateTime();

        pkgChangeEvent.newInstalled = (pkgRemovedInfo == null || !pkgRemovedInfo.mIsUpdate);

        pkgChangeEvent.dataRemoved = (pkgRemovedInfo != null && pkgRemovedInfo.mDataRemoved);

        pkgChangeEvent.isDeleted = false;



        mPm.notifyPackageChangeObservers(pkgChangeEvent);

    }



    public int installLocationPolicy(PackageInfoLite pkgLite, int installFlags) {

        String packageName = pkgLite.packageName;

        int installLocation = pkgLite.installLocation;

services/core/java/com/android/server/pm/PackageManagerNative.java

+0 −50
Original line number Diff line number Diff line
@@ -20,20 +20,16 @@ import static android.content.pm.PackageManager.CERT_INPUT_SHA256; 


import static com.android.server.pm.PackageManagerService.TAG;



import android.annotation.NonNull;

import android.annotation.Nullable;

import android.content.pm.ApplicationInfo;

import android.content.pm.IPackageChangeObserver;

import android.content.pm.IPackageManagerNative;

import android.content.pm.IStagedApexObserver;

import android.content.pm.PackageInfo;

import android.content.pm.StagedApexInfo;

import android.os.Binder;

import android.os.IBinder;

import android.os.RemoteException;

import android.os.UserHandle;

import android.text.TextUtils;

import android.util.Log;

import android.util.Slog;



import java.util.Arrays;
@@ -45,35 +41,6 @@ final class PackageManagerNative extends IPackageManagerNative.Stub { 
        mPm = pm;

    }



    @Override

    public void registerPackageChangeObserver(@NonNull IPackageChangeObserver observer) {

        synchronized (mPm.mPackageChangeObservers) {

            try {

                observer.asBinder().linkToDeath(

                        new PackageChangeObserverDeathRecipient(observer), 0);

            } catch (RemoteException e) {

                Log.e(TAG, e.getMessage());

            }

            mPm.mPackageChangeObservers.add(observer);

            Log.d(TAG, "Size of mPackageChangeObservers after registry is "

                    + mPm.mPackageChangeObservers.size());

        }

    }



    @Override

    public void unregisterPackageChangeObserver(@NonNull IPackageChangeObserver observer) {

        synchronized (mPm.mPackageChangeObservers) {

            mPm.mPackageChangeObservers.remove(observer);

            Log.d(TAG, "Size of mPackageChangeObservers after unregistry is "

                    + mPm.mPackageChangeObservers.size());

        }

    }



    @Override

    public String[] getAllPackages() {

        return mPm.snapshotComputer().getAllPackages().toArray(new String[0]);

    }



    @Override

    public String[] getNamesForUids(int[] uids) throws RemoteException {

        String[] names = null;
@@ -222,21 +189,4 @@ final class PackageManagerNative extends IPackageManagerNative.Stub { 
    public StagedApexInfo getStagedApexInfo(String moduleName) {

        return mPm.mInstallerService.getStagingManager().getStagedApexInfo(moduleName);

    }



    private final class PackageChangeObserverDeathRecipient implements IBinder.DeathRecipient {

        private final IPackageChangeObserver mObserver;



        PackageChangeObserverDeathRecipient(IPackageChangeObserver observer) {

            mObserver = observer;

        }



        @Override

        public void binderDied() {

            synchronized (mPm.mPackageChangeObservers) {

                mPm.mPackageChangeObservers.remove(mObserver);

                Log.d(TAG, "Size of mPackageChangeObservers after removing dead observer is "

                        + mPm.mPackageChangeObservers.size());

            }

        }

    }

}