Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7e092967 authored by Robert Craig's avatar Robert Craig Committed by Ricardo Cerqueira
Browse files

Move seinfo and install-time changes to inside PMS. 

Per request by Google, move the install-time checks entirely
inside PMS.

Change-Id: I01f2a9084dfe7886087b1497070b0d7f2ad8479e
parent c6767eb4

services/java/com/android/server/DevicePolicyManagerService.java

+4 −3
Original line number Diff line number Diff line
@@ -45,7 +45,6 @@ import android.content.pm.IPackageManager; 
import android.content.pm.PackageManager;

import android.content.pm.PackageManager.NameNotFoundException;

import android.content.pm.ResolveInfo;

import android.content.pm.SELinuxMMAC;

import android.os.Binder;

import android.os.Bundle;

import android.os.Environment;
@@ -259,6 +258,8 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { 
        }

    }



    private static final String MMAC_ENFORCE_PROPERTY = "persist.mmac.enforce";



    private static final String SEPOLICY_PATH_SEPOLICY = "/data/security/sepolicy";



    private static final String SEPOLICY_PATH_PROPCTXS = "/data/security/property_contexts";
@@ -3036,12 +3037,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { 
            return false;

        }



        boolean systemState = SELinuxMMAC.getEnforcingMode();

        boolean systemState = SystemProperties.getBoolean(MMAC_ENFORCE_PROPERTY, false);

        boolean enforceMMAC = mmacAdmin.enforceMMAC;

        if (!firstBoot || !systemState) {

            if (systemState != enforceMMAC) {

                Slog.v(TAG, "Changed MMAC enforcing status " + systemState + " to " + enforceMMAC);

                SELinuxMMAC.setEnforcingMode(enforceMMAC);

                SystemProperties.set(MMAC_ENFORCE_PROPERTY, enforceMMAC ? "true" : "false");

            }

        }

services/java/com/android/server/pm/PackageManagerService.java

+8 −16
Original line number Diff line number Diff line
@@ -85,7 +85,6 @@ import android.content.pm.PermissionGroupInfo; 
import android.content.pm.PermissionInfo;

import android.content.pm.ProviderInfo;

import android.content.pm.ResolveInfo;

import android.content.pm.SELinuxMMAC;

import android.content.pm.ServiceInfo;

import android.content.pm.Signature;

import android.content.pm.ManifestDigest;
@@ -1041,6 +1040,8 @@ public class PackageManagerService extends IPackageManager.Stub { 


            readPermissions();



            mFoundPolicyFile = SELinuxMMAC.readInstallPolicy();



            mRestoredSettings = mSettings.readLPw(sUserManager.getUsers(false),

                    mSdkVersion, mOnlyCore);

            long startTime = SystemClock.uptimeMillis();
@@ -1164,13 +1165,6 @@ public class PackageManagerService extends IPackageManager.Stub { 
                }

            }



            // Find potential SELinux install policy

            long startPolicyTime = SystemClock.uptimeMillis();

            mFoundPolicyFile = SELinuxMMAC.readInstallPolicy();

            Slog.i(TAG, "Time to scan SELinux install policy: "

                   + ((SystemClock.uptimeMillis()-startPolicyTime)/1000f)

                   + " seconds");



            // Find base frameworks (resource packages without code).

            mFrameworkInstallObserver = new AppDirObserver(

                mFrameworkDir.getPath(), OBSERVER_EVENTS, true);
@@ -3659,14 +3653,6 @@ public class PackageManagerService extends IPackageManager.Stub { 
        }

        mScanningPath = scanFile;



        if (mFoundPolicyFile && !SELinuxMMAC.passInstallPolicyChecks(pkg) &&

                SELinuxMMAC.getEnforcingMode()) {

            Slog.w(TAG, "Installing application package " + pkg.packageName

                   + " failed due to policy.");

            mLastScanError = PackageManager.INSTALL_FAILED_POLICY_REJECTED_PERMISSION;

            return null;

        }



        if ((parseFlags&PackageParser.PARSE_IS_SYSTEM) != 0) {

            pkg.applicationInfo.flags |= ApplicationInfo.FLAG_SYSTEM;

        }
@@ -3895,6 +3881,12 @@ public class PackageManagerService extends IPackageManager.Stub { 
            

            if (mSettings.isDisabledSystemPackageLPr(pkg.packageName)) {

                pkg.applicationInfo.flags |= ApplicationInfo.FLAG_UPDATED_SYSTEM_APP;

            } else if (mFoundPolicyFile && !SELinuxMMAC.passInstallPolicyChecks(pkg) &&

                       SELinuxMMAC.getEnforcingMode()) {

                Slog.w(TAG, "Installing application package " + pkg.packageName

                       + " failed due to policy.");

                mLastScanError = PackageManager.INSTALL_FAILED_POLICY_REJECTED_PERMISSION;

                return null;

            }



            pkg.applicationInfo.uid = pkgSetting.appId;

core/java/android/content/pm/SELinuxMMAC.java→services/java/com/android/server/pm/SELinuxMMAC.java

+2 −2
Original line number Diff line number Diff line
@@ -14,7 +14,7 @@ 
 * limitations under the License.

 */



package android.content.pm;

package com.android.server.pm;



import android.content.pm.ApplicationInfo;

import android.content.pm.PackageParser;
@@ -92,7 +92,7 @@ public final class SELinuxMMAC { 
    }



    /**

     * Returns the current status of MMAC enforcing mode.

     * Sets the current status of MMAC enforcing mode.

     * @param boolean value to set the enforcing state too.

     */

    public static void setEnforcingMode(boolean value) {

services/tests/servicestests/Android.mk

+29 −1
Original line number Diff line number Diff line 
LOCAL_PATH:= $(call my-dir)

ACTUAL_LOCAL_PATH := $(call my-dir)



# this var will hold all the test apk module names later. 

FrameworkServicesTests_all_apks :=



# We have to include the subdir makefiles first

# so that FrameworkServicesTests_all_apks will be populated correctly.

include $(call all-makefiles-under,$(ACTUAL_LOCAL_PATH))



LOCAL_PATH := $(ACTUAL_LOCAL_PATH)



include $(CLEAR_VARS)



# We only want this apk build for tests.
@@ -18,5 +28,23 @@ LOCAL_PACKAGE_NAME := FrameworksServicesTests 


LOCAL_CERTIFICATE := platform



# intermediate dir to include all the test apks as raw resource 

FrameworkServicesTests_intermediates := $(call intermediates-dir-for,APPS,$(LOCAL_PACKAGE_NAME))/test_apks/res

LOCAL_RESOURCE_DIR := $(FrameworkServicesTests_intermediates) $(LOCAL_PATH)/res



include $(BUILD_PACKAGE)



# Rules to copy all the test apks to the intermediate raw resource directory 

FrameworkServicesTests_all_apks_res := $(addprefix $(FrameworkServicesTests_intermediates)/raw/, \

    $(foreach a, $(FrameworkServicesTests_all_apks), $(patsubst FrameworkServicesTests_%,%,$(a))))



$(FrameworkServicesTests_all_apks_res): $(FrameworkServicesTests_intermediates)/raw/%: $(call intermediates-dir-for,APPS,FrameworkServicesTests_%)/package.apk | $(ACP)

	$(call copy-file-to-new-target)



# Use R_file_stamp as dependency because we want the test apks in place before the R.java is generated.

$(R_file_stamp) : $(FrameworkServicesTests_all_apks_res)



FrameworkServicesTests_all_apks :=

FrameworkServicesTests_intermediates :=

FrameworkServicesTests_all_apks_res :=

services/tests/servicestests/apks/Android.mk

0 → 100644
+7 −0
Original line number Diff line number Diff line 
LOCAL_PATH:= $(call my-dir)

include $(CLEAR_VARS)



FrameworkServicesTests_BUILD_PACKAGE := $(LOCAL_PATH)/FrameworkServicesTests_apk.mk



# build sub packages

include $(call all-makefiles-under,$(LOCAL_PATH))