Merge "[pm] a system config to let oems register uids" into main (715ffd22) · Commits · e / os / android_frameworks_base

data/etc/Android.bp

+6 −0

Original line number	Diff line number	Diff line
		@@ -78,6 +78,12 @@ prebuilt_etc {
		src: "package-shareduid-allowlist.xml",
		}

		prebuilt_etc {
		name: "oem-defined-uids.xml",
		sub_dir: "sysconfig",
		src: "oem-defined-uids.xml",
		}

		// Privapp permission whitelist files

		prebuilt_etc {

data/etc/oem-defined-uids.xml

0 → 100644

+38 −0

Original line number	Diff line number	Diff line
		<?xml version="1.0" encoding="utf-8"?>
		<!--
		~ Copyright (C) 2024 The Android Open Source Project
		~
		~ Licensed under the Apache License, Version 2.0 (the "License");
		~ you may not use this file except in compliance with the License.
		~ You may obtain a copy of the License at
		~
		~ http://www.apache.org/licenses/LICENSE-2.0
		~
		~ Unless required by applicable law or agreed to in writing, software
		~ distributed under the License is distributed on an "AS IS" BASIS,
		~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		~ See the License for the specific language governing permissions and
		~ limitations under the License.
		-->

		<!--
		This XML defines a list of UIDs for OEMs to register as shared UIDs. They will be registered at the
		start of the system, which allows OEMs to create services with these UIDs. The range of these UIDs
		must be in the OEM reserved range.

		OEM must provide a preloaded app that is installed at boot time to retain the newly registered UID
		by adding a android:sharedUserId tag in the manifest of the preloaded app, with the value of the tag
		set to the name of the UID defined in this config file. Otherwise, the uid will be cleared at the
		end of the boot and this config file will take no effect.

		- The "name" XML attribute refers to the name of the shared UID. It must start with "android.uid.".
		- The "uid" XML attribute refers to the value of the shared UID. It must be in range [2900, 2999].

		Example usage
		<oem-defined-uid name="android.uid.vendordata" uid="2918"/>
		Indicates that a shared UID named "android.uid.vendordata" will be added to the system with the
		UID of 2918.
		-->

		<config>
		</config>

services/core/java/com/android/server/SystemConfig.java

+28 −0

Original line number	Diff line number	Diff line
		@@ -371,6 +371,10 @@ public class SystemConfig {
		// exempt from ECM (i.e., they will never be considered "restricted").
		private final ArraySet<SignedPackage> mEnhancedConfirmationTrustedInstallers = new ArraySet<>();

		// A map of UIDs defined by OEMs, mapping from name to value. The UIDs will be registered at the
		// start of the system which allows OEMs to create and register their system services.
		@NonNull private final ArrayMap<String, Integer> mOemDefinedUids = new ArrayMap<>();

		/**
		* Map of system pre-defined, uniquely named actors; keys are namespace,
		* value maps actor name to package name.
		@@ -594,6 +598,10 @@ public class SystemConfig {
		return mEnhancedConfirmationTrustedInstallers;
		}

		@NonNull
		public ArrayMap<String, Integer> getOemDefinedUids() {
		return mOemDefinedUids;
		}
		/**
		* Only use for testing. Do NOT use in production code.
		* @param readPermissions false to create an empty SystemConfig; true to read the permissions.
		@@ -1622,6 +1630,26 @@ public class SystemConfig {
		}
		}
		} break;
		case "oem-defined-uid": {
		final String uidName = parser.getAttributeValue(null, "name");
		final String uidValue = parser.getAttributeValue(null, "uid");
		if (TextUtils.isEmpty(uidName)) {
		Slog.w(TAG, "<" + name + "> without valid uid name in " + permFile
		+ " at " + parser.getPositionDescription());
		} else if (TextUtils.isEmpty(uidValue)) {
		Slog.w(TAG, "<" + name + "> without valid uid value in " + permFile
		+ " at " + parser.getPositionDescription());
		} else {
		try {
		final int oemDefinedUid = Integer.parseInt(uidValue);
		mOemDefinedUids.put(uidName, oemDefinedUid);
		} catch (NumberFormatException e) {
		Slog.w(TAG, "<" + name + "> with invalid uid value: "
		+ uidValue + " in " + permFile
		+ " at " + parser.getPositionDescription());
		}
		}
		} break;
		case "enhanced-confirmation-trusted-package": {
		if (android.permission.flags.Flags.enhancedConfirmationModeApisEnabled()) {
		SignedPackage signedPackage = parseEnhancedConfirmationTrustedPackage(

services/core/java/com/android/server/pm/PackageManagerService.java

+11 −3

Original line number	Diff line number	Diff line
		@@ -2073,6 +2073,10 @@ public class PackageManagerService implements PackageSender, TestUtilityService
		// CHECKSTYLE:ON IndentationCheck
		t.traceEnd();

		t.traceBegin("get system config");
		SystemConfig systemConfig = injector.getSystemConfig();
		t.traceEnd();

		t.traceBegin("addSharedUsers");
		mSettings.addSharedUserLPw("android.uid.system", Process.SYSTEM_UID,
		ApplicationInfo.FLAG_SYSTEM, ApplicationInfo.PRIVATE_FLAG_PRIVILEGED);
		@@ -2092,6 +2096,13 @@ public class PackageManagerService implements PackageSender, TestUtilityService
		ApplicationInfo.FLAG_SYSTEM, ApplicationInfo.PRIVATE_FLAG_PRIVILEGED);
		mSettings.addSharedUserLPw("android.uid.uwb", UWB_UID,
		ApplicationInfo.FLAG_SYSTEM, ApplicationInfo.PRIVATE_FLAG_PRIVILEGED);
		final ArrayMap<String, Integer> oemDefinedUids = systemConfig.getOemDefinedUids();
		final int numOemDefinedUids = oemDefinedUids.size();
		for (int i = 0; i < numOemDefinedUids; i++) {
		mSettings.addOemSharedUserLPw(oemDefinedUids.keyAt(i), oemDefinedUids.valueAt(i),
		ApplicationInfo.FLAG_SYSTEM, ApplicationInfo.PRIVATE_FLAG_PRIVILEGED);
		}

		t.traceEnd();

		String separateProcesses = SystemProperties.get("debug.separate_processes");
		@@ -2124,10 +2135,7 @@ public class PackageManagerService implements PackageSender, TestUtilityService
		mContext.getSystemService(DisplayManager.class)
		.getDisplay(Display.DEFAULT_DISPLAY).getMetrics(mMetrics);

		t.traceBegin("get system config");
		SystemConfig systemConfig = injector.getSystemConfig();
		mAvailableFeatures = systemConfig.getAvailableFeatures();
		t.traceEnd();

		mProtectedPackages = new ProtectedPackages(mContext);

services/core/java/com/android/server/pm/Settings.java

+15 −0

Original line number	Diff line number	Diff line
		@@ -969,6 +969,21 @@ public final class Settings implements Watchable, Snappable, ResilientAtomicFile
		return null;
		}

		SharedUserSetting addOemSharedUserLPw(String name, int uid, int pkgFlags, int pkgPrivateFlags) {
		if (!name.startsWith("android.uid")) {
		PackageManagerService.reportSettingsProblem(Log.ERROR,
		"Failed to add oem defined shared user because of invalid name: " + name);
		return null;
		}
		// OEM defined uids must be in the OEM reserved range
		if (uid < 2900 \|\| uid > 2999) {
		PackageManagerService.reportSettingsProblem(Log.ERROR,
		"Failed to add oem defined shared user because of invalid uid: " + uid);
		return null;
		}
		return addSharedUserLPw(name, uid, pkgFlags, pkgPrivateFlags);
		}

		SharedUserSetting addSharedUserLPw(String name, int uid, int pkgFlags, int pkgPrivateFlags) {
		SharedUserSetting s = mSharedUsers.get(name);
		if (s != null) {