Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5a8d1b20 authored by Martijn Coenen's avatar Martijn Coenen
Browse files

Add a new UID range for SDK sandbox processes. 

These are processes that are spawned alongside regular app processes.
They have their own UID range, such that they can be properly isolated
from applications.

Add some APIs in Process that allows the system and mainline
modules to verify that a particular UID belongs to a sandbox
process, and to map between the sandbox process and the
corresponding app process.

Bug: 215012578
Test: N/A
Change-Id: I02aaaa1c2bcf9d141ddc97747eb6d7edd52d7b92
Merged-In: I02aaaa1c2bcf9d141ddc97747eb6d7edd52d7b92
parent ececa85c

core/api/current.txt

+1 −0
Original line number Original line Diff line number Diff line
@@ -30532,6 +30532,7 @@ package android.os { 
    method public static final boolean is64Bit();

    method public static final boolean is64Bit();

    method public static boolean isApplicationUid(int);

    method public static boolean isApplicationUid(int);

    method public static final boolean isIsolated();

    method public static final boolean isIsolated();

    method public static final boolean isSdkSandbox();

    method public static final void killProcess(int);

    method public static final void killProcess(int);

    method public static final int myPid();

    method public static final int myPid();

    method public static final int myTid();

    method public static final int myTid();

core/api/module-lib-current.txt

+3 −0
Original line number Original line Diff line number Diff line
@@ -290,6 +290,9 @@ package android.os { 
  }

  }





  public class Process {

  public class Process {

    method public static final int getAppUidForSdkSandboxUid(int);

    method public static final boolean isSdkSandboxUid(int);

    method public static final int toSdkSandboxUid(int);

    field public static final int NFC_UID = 1027; // 0x403

    field public static final int NFC_UID = 1027; // 0x403

    field public static final int VPN_UID = 1016; // 0x3f8

    field public static final int VPN_UID = 1016; // 0x3f8

  }

  }

core/api/test-current.txt

+3 −0
Original line number Original line Diff line number Diff line
@@ -1716,7 +1716,10 @@ package android.os { 
  }

  }





  public class Process {

  public class Process {

    method public static final int getAppUidForSdkSandboxUid(int);

    method public static final int getThreadScheduler(int) throws java.lang.IllegalArgumentException;

    method public static final int getThreadScheduler(int) throws java.lang.IllegalArgumentException;

    method public static final boolean isSdkSandboxUid(int);

    method public static final int toSdkSandboxUid(int);

    field public static final int FIRST_APP_ZYGOTE_ISOLATED_UID = 90000; // 0x15f90

    field public static final int FIRST_APP_ZYGOTE_ISOLATED_UID = 90000; // 0x15f90

    field public static final int FIRST_ISOLATED_UID = 99000; // 0x182b8

    field public static final int FIRST_ISOLATED_UID = 99000; // 0x182b8

    field public static final int LAST_APP_ZYGOTE_ISOLATED_UID = 98999; // 0x182b7

    field public static final int LAST_APP_ZYGOTE_ISOLATED_UID = 98999; // 0x182b7

core/java/android/os/Process.java

+98 −35
Original line number Original line Diff line number Diff line
@@ -276,6 +276,26 @@ public class Process { 
     */

     */

    public static final int LAST_APPLICATION_UID = 19999;

    public static final int LAST_APPLICATION_UID = 19999;





    /**

     * Defines the start of a range of UIDs going from this number to

     * {@link #LAST_SDK_SANDBOX_UID} that are reserved for assigning to

     * sdk sandbox processes. There is a 1-1 mapping between a sdk sandbox

     * process UID and the app that it belongs to, which can be computed by

     * subtracting (FIRST_SDK_SANDBOX_UID - FIRST_APPLICATION_UID) from the

     * uid of a sdk sandbox process.

     *

     * Note that there are no GIDs associated with these processes; storage

     * attribution for them will be done using project IDs.

     * @hide

     */

    public static final int FIRST_SDK_SANDBOX_UID = 20000;



    /**

     * Last UID that is used for sdk sandbox processes.

     * @hide

     */

    public static final int LAST_SDK_SANDBOX_UID = 29999;



    /**

    /**

     * First uid used for fully isolated sandboxed processes spawned from an app zygote

     * First uid used for fully isolated sandboxed processes spawned from an app zygote

     * @hide

     * @hide
@@ -821,6 +841,49 @@ public class Process { 
                || (uid >= FIRST_APP_ZYGOTE_ISOLATED_UID && uid <= LAST_APP_ZYGOTE_ISOLATED_UID);

                || (uid >= FIRST_APP_ZYGOTE_ISOLATED_UID && uid <= LAST_APP_ZYGOTE_ISOLATED_UID);

    }

    }





    /**

     * Returns whether the provided UID belongs to a SDK sandbox process.

     *

     * @hide

     */

    @SystemApi(client = MODULE_LIBRARIES)

    @TestApi

    public static final boolean isSdkSandboxUid(int uid) {

        uid = UserHandle.getAppId(uid);

        return (uid >= FIRST_SDK_SANDBOX_UID && uid <= LAST_SDK_SANDBOX_UID);

    }



    /**

     *

     * Returns the app process corresponding to an sdk sandbox process.

     *

     * @hide

     */

    @SystemApi(client = MODULE_LIBRARIES)

    @TestApi

    public static final int getAppUidForSdkSandboxUid(int uid) {

        return uid - (FIRST_SDK_SANDBOX_UID - FIRST_APPLICATION_UID);

    }



    /**

     *

     * Returns the sdk sandbox process corresponding to an app process.

     *

     * @hide

     */

    @SystemApi(client = MODULE_LIBRARIES)

    @TestApi

    public static final int toSdkSandboxUid(int uid) {

        return uid + (FIRST_SDK_SANDBOX_UID - FIRST_APPLICATION_UID);

    }



    /**

     * Returns whether the current process is a sdk sandbox process.

     */

    public static final boolean isSdkSandbox() {

        return isSdkSandboxUid(myUid());

    }



    /**

    /**

     * Returns the UID assigned to a particular user name, or -1 if there is

     * Returns the UID assigned to a particular user name, or -1 if there is

     * none.  If the given string consists of only numbers, it is converted

     * none.  If the given string consists of only numbers, it is converted