Add SELinux updater and Settings-based enforcement switch. (77118fb5) · Commits · e / os / android_frameworks_base

core/java/android/provider/Settings.java

+56 −0

Original line number	Original line	Diff line number	Diff line
	@@ -5347,6 +5347,62 @@ public final class Settings {
	*/		*/
	public static final String AUDIO_SAFE_VOLUME_STATE = "audio_safe_volume_state";		public static final String AUDIO_SAFE_VOLUME_STATE = "audio_safe_volume_state";

			/**
			* URL for tzinfo (time zone) updates
			* @hide
			*/
			public static final String TZINFO_UPDATE_CONTENT_URL = "tzinfo_content_url";

			/**
			* URL for tzinfo (time zone) update metadata
			* @hide
			*/
			public static final String TZINFO_UPDATE_METADATA_URL = "tzinfo_metadata_url";

			/**
			* URL for selinux (mandatory access control) updates
			* @hide
			*/
			public static final String SELINUX_UPDATE_CONTENT_URL = "selinux_content_url";

			/**
			* URL for selinux (mandatory access control) update metadata
			* @hide
			*/
			public static final String SELINUX_UPDATE_METADATA_URL = "selinux_metadata_url";

			/**
			* URL for sms short code updates
			* @hide
			*/
			public static final String SMS_SHORT_CODES_UPDATE_CONTENT_URL =
			"sms_short_codes_content_url";

			/**
			* URL for sms short code update metadata
			* @hide
			*/
			public static final String SMS_SHORT_CODES_UPDATE_METADATA_URL =
			"sms_short_codes_metadata_url";

			/**
			* URL for cert pinlist updates
			* @hide
			*/
			public static final String CERT_PIN_UPDATE_CONTENT_URL = "cert_pin_content_url";

			/**
			* URL for cert pinlist updates
			* @hide
			*/
			public static final String CERT_PIN_UPDATE_METADATA_URL = "cert_pin_metadata_url";

			/**
			* SELinux enforcement status. If 0, permissive; if 1, enforcing.
			* @hide
			*/
			public static final String SELINUX_STATUS = "selinux_status";

	/**		/**
	* Settings to backup. This is here so that it's in the same place as the settings		* Settings to backup. This is here so that it's in the same place as the settings
	* keys and easy to update.		* keys and easy to update.

core/res/AndroidManifest.xml

+6 −0

Original line number	Original line	Diff line number	Diff line
	@@ -2313,6 +2313,12 @@
	</intent-filter>		</intent-filter>
	</receiver>		</receiver>

			<receiver android:name="com.android.server.updates.SELinuxPolicyInstallReceiver" >
			<intent-filter>
			<action android:name="android.intent.action.UPDATE_SEPOLICY" />
			</intent-filter>
			</receiver>

	<receiver android:name="com.android.server.MasterClearReceiver"		<receiver android:name="com.android.server.MasterClearReceiver"
	android:permission="android.permission.MASTER_CLEAR"		android:permission="android.permission.MASTER_CLEAR"
	android:priority="100" >		android:priority="100" >

services/java/com/android/server/updates/ConfigUpdateInstallReceiver.java

+4 −0

Original line number	Original line	Diff line number	Diff line
	@@ -102,6 +102,7 @@ public class ConfigUpdateInstallReceiver extends BroadcastReceiver {
	Slog.i(TAG, "Found new update, installing...");		Slog.i(TAG, "Found new update, installing...");
	install(altContent, altVersion);		install(altContent, altVersion);
	Slog.i(TAG, "Installation successful");		Slog.i(TAG, "Installation successful");
			postInstall(context, intent);
	}		}
	} catch (Exception e) {		} catch (Exception e) {
	Slog.e(TAG, "Could not update content!", e);		Slog.e(TAG, "Could not update content!", e);
	@@ -257,4 +258,7 @@ public class ConfigUpdateInstallReceiver extends BroadcastReceiver {
	writeUpdate(updateDir, updateContent, content);		writeUpdate(updateDir, updateContent, content);
	writeUpdate(updateDir, updateVersion, Long.toString(version).getBytes());		writeUpdate(updateDir, updateVersion, Long.toString(version).getBytes());
	}		}

			protected void postInstall(Context context, Intent intent) {
			}
	}		}

services/java/com/android/server/updates/SELinuxPolicyInstallReceiver.java

0 → 100644

+45 −0

Original line number	Original line	Diff line number	Diff line
			/*
			* Copyright (C) 2013 The Android Open Source Project
			*
			* Licensed under the Apache License, Version 2.0 (the "License");
			* you may not use this file except in compliance with the License.
			* You may obtain a copy of the License at
			*
			* http://www.apache.org/licenses/LICENSE-2.0
			*
			* Unless required by applicable law or agreed to in writing, software
			* distributed under the License is distributed on an "AS IS" BASIS,
			* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
			* See the License for the specific language governing permissions and
			* limitations under the License.
			*/

			package com.android.server.updates;

			import android.content.Context;
			import android.content.Intent;
			import android.os.SELinux;
			import android.provider.Settings;
			import android.util.Base64;
			import android.util.Slog;

			import java.io.IOException;

			public class SELinuxPolicyInstallReceiver extends ConfigUpdateInstallReceiver {

			public SELinuxPolicyInstallReceiver() {
			super("/data/security/", "sepolicy", "metadata/", "version");
			}

			@Override
			protected void install(byte[] encodedContent, int version) throws IOException {
			super.install(Base64.decode(encodedContent, Base64.DEFAULT), version);
			}

			@Override
			protected void postInstall(Context context, Intent intent) {
			boolean mode = Settings.Global.getInt(context.getContentResolver(),
			Settings.Global.SELINUX_STATUS, 0) == 1;
			SELinux.setSELinuxEnforce(mode);
			}
			}