Merge "Add enforcement of idmap policies" (98538450) · Commits · e / os / android_frameworks_base

cmds/idmap2/Android.bp

+2 −0

Original line number	Diff line number	Diff line
		@@ -39,6 +39,7 @@ cc_library {
		"libidmap2/CommandLineOptions.cpp",
		"libidmap2/FileUtils.cpp",
		"libidmap2/Idmap.cpp",
		"libidmap2/Policies.cpp",
		"libidmap2/PrettyPrintVisitor.cpp",
		"libidmap2/RawPrintVisitor.cpp",
		"libidmap2/ResourceUtils.cpp",
		@@ -88,6 +89,7 @@ cc_test {
		"tests/Idmap2BinaryTests.cpp",
		"tests/IdmapTests.cpp",
		"tests/Main.cpp",
		"tests/PoliciesTests.cpp",
		"tests/PrettyPrintVisitorTests.cpp",
		"tests/RawPrintVisitorTests.cpp",
		"tests/ResourceUtilsTests.cpp",

cmds/idmap2/idmap2/Create.cpp

+28 −3

Original line number	Diff line number	Diff line
		@@ -27,17 +27,25 @@
		#include "idmap2/CommandLineOptions.h"
		#include "idmap2/FileUtils.h"
		#include "idmap2/Idmap.h"
		#include "idmap2/Policies.h"
		#include "idmap2/Result.h"

		using android::ApkAssets;
		using android::idmap2::BinaryStreamVisitor;
		using android::idmap2::CommandLineOptions;
		using android::idmap2::Idmap;
		using android::idmap2::PoliciesToBitmask;
		using android::idmap2::PolicyBitmask;
		using android::idmap2::PolicyFlags;
		using android::idmap2::Result;
		using android::idmap2::utils::kIdmapFilePermissionMask;

		bool Create(const std::vector<std::string>& args, std::ostream& out_error) {
		std::string target_apk_path;
		std::string overlay_apk_path;
		std::string idmap_path;
		std::vector<std::string> policies;
		bool ignore_overlayable;

		const CommandLineOptions opts =
		CommandLineOptions("idmap2 create")
		@@ -47,12 +55,28 @@ bool Create(const std::vector<std::string>& args, std::ostream& out_error) {
		.MandatoryOption("--overlay-apk-path",
		"input: path to apk which contains the new resource values",
		&overlay_apk_path)
		.MandatoryOption("--idmap-path", "output: path to where to write idmap file",
		&idmap_path);
		.MandatoryOption("--idmap-path", "output: path to where to write idmap file", &idmap_path)
		.OptionalOption("--policy",
		"input: an overlayable policy this overlay fulfills "
		"(if none or supplied, the overlay policy will default to \"public\")",
		&policies)
		.OptionalFlag("--ignore-overlayable", "disables overlayable and policy checks",
		&ignore_overlayable);
		if (!opts.Parse(args, out_error)) {
		return false;
		}

		PolicyBitmask fulfilled_policies = 0;
		if (auto result = PoliciesToBitmask(policies, out_error)) {
		fulfilled_policies \|= *result;
		} else {
		return false;
		}

		if (fulfilled_policies == 0) {
		fulfilled_policies \|= PolicyFlags::POLICY_PUBLIC;
		}

		const std::unique_ptr<const ApkAssets> target_apk = ApkAssets::Load(target_apk_path);
		if (!target_apk) {
		out_error << "error: failed to load apk " << target_apk_path << std::endl;
		@@ -66,7 +90,8 @@ bool Create(const std::vector<std::string>& args, std::ostream& out_error) {
		}

		const std::unique_ptr<const Idmap> idmap =
		Idmap::FromApkAssets(target_apk_path, target_apk, overlay_apk_path, overlay_apk, out_error);
		Idmap::FromApkAssets(target_apk_path, target_apk, overlay_apk_path, overlay_apk,
		fulfilled_policies, !ignore_overlayable, out_error);
		if (!idmap) {
		return false;
		}

cmds/idmap2/idmap2/Scan.cpp

+89 −18

Original line number	Diff line number	Diff line
		@@ -21,8 +21,11 @@
		#include <set>
		#include <sstream>
		#include <string>
		#include <utility>
		#include <vector>

		#include "android-base/properties.h"

		#include "idmap2/CommandLineOptions.h"
		#include "idmap2/FileUtils.h"
		#include "idmap2/Idmap.h"
		@@ -34,6 +37,10 @@
		using android::idmap2::CommandLineOptions;
		using android::idmap2::Idmap;
		using android::idmap2::MemoryChunk;
		using android::idmap2::PoliciesToBitmask;
		using android::idmap2::PolicyBitmask;
		using android::idmap2::PolicyFlags;
		using android::idmap2::Result;
		using android::idmap2::Xml;
		using android::idmap2::ZipFile;
		using android::idmap2::utils::FindFiles;
		@@ -48,8 +55,16 @@ struct InputOverlay {
		std::string apk_path; // NOLINT(misc-non-private-member-variables-in-classes)
		std::string idmap_path; // NOLINT(misc-non-private-member-variables-in-classes)
		int priority; // NOLINT(misc-non-private-member-variables-in-classes)
		std::vector<std::string> policies; // NOLINT(misc-non-private-member-variables-in-classes)
		bool ignore_overlayable; // NOLINT(misc-non-private-member-variables-in-classes)
		};

		bool VendorIsQOrLater() {
		// STOPSHIP(b/119390857): Check api version once Q sdk version is finalized
		std::string version = android::base::GetProperty("ro.vndk.version", "Q");
		return version == "Q" \|\| version == "q";
		}

		std::unique_ptr<std::vector<std::string>> FindApkFiles(const std::vector<std::string>& dirs,
		bool recursive, std::ostream& out_error) {
		const auto predicate = [](unsigned char type, const std::string& path) -> bool {
		@@ -70,6 +85,22 @@ std::unique_ptr<std::vector<std::string>> FindApkFiles(const std::vector<std::st
		return std::make_unique<std::vector<std::string>>(paths.cbegin(), paths.cend());
		}

		PolicyBitmask PolicyForPath(const std::string& apk_path) {
		static const std::vector<std::pair<std::string, PolicyBitmask>> values = {
		{"/product/", PolicyFlags::POLICY_PRODUCT_PARTITION},
		{"/system/", PolicyFlags::POLICY_SYSTEM_PARTITION},
		{"/vendor/", PolicyFlags::POLICY_VENDOR_PARTITION},
		};

		for (auto const& pair : values) {
		if (apk_path.compare(0, pair.first.size(), pair.first) == 0) {
		return pair.second \| PolicyFlags::POLICY_PUBLIC;
		}
		}

		return PolicyFlags::POLICY_PUBLIC;
		}

		} // namespace

		bool Scan(const std::vector<std::string>& args, std::ostream& out_error) {
		@@ -77,6 +108,7 @@ bool Scan(const std::vector<std::string>& args, std::ostream& out_error) {
		std::string target_package_name;
		std::string target_apk_path;
		std::string output_directory;
		std::vector<std::string> override_policies;
		bool recursive = false;

		const CommandLineOptions opts =
		@@ -89,7 +121,12 @@ bool Scan(const std::vector<std::string>& args, std::ostream& out_error) {
		.MandatoryOption("--target-apk-path", "path to target apk", &target_apk_path)
		.MandatoryOption("--output-directory",
		"directory in which to write artifacts (idmap files and overlays.list)",
		&output_directory);
		&output_directory)
		.OptionalOption(
		"--override-policy",
		"input: an overlayable policy this overlay fulfills "
		"(if none or supplied, the overlays will not have their policies overriden",
		&override_policies);
		if (!opts.Parse(args, out_error)) {
		return false;
		}
		@@ -144,28 +181,62 @@ bool Scan(const std::vector<std::string>& args, std::ostream& out_error) {
		continue;
		}

		// Sort the static overlays in ascending priority order
		PolicyBitmask fulfilled_policies;
		if (!override_policies.empty()) {
		if (Result<PolicyBitmask> result = PoliciesToBitmask(override_policies, out_error)) {
		fulfilled_policies = *result;
		} else {
		return false;
		}
		} else {
		fulfilled_policies = PolicyForPath(path);
		}

		bool ignore_overlayable = false;
		if ((fulfilled_policies & PolicyFlags::POLICY_VENDOR_PARTITION) != 0 && !VendorIsQOrLater()) {
		// If the overlay is on a pre-Q vendor partition, do not enforce overlayable
		// restrictions on this overlay because the pre-Q platform has no understanding of
		// overlayable.
		ignore_overlayable = true;
		}

		std::string idmap_path = Idmap::CanonicalIdmapPathFor(output_directory, path);
		InputOverlay input{path, idmap_path, priority};

		// Sort the static overlays in ascending priority order
		InputOverlay input{path, idmap_path, priority, override_policies, ignore_overlayable};
		interesting_apks.insert(
		std::lower_bound(interesting_apks.begin(), interesting_apks.end(), input), input);
		}

		std::stringstream stream;
		for (const auto& overlay : interesting_apks) {
		// Create the idmap for the overlay if it currently does not exist or if it is not up to date.
		std::stringstream dev_null;
		if (!Verify(std::vector<std::string>({"--idmap-path", overlay.idmap_path}), dev_null) &&
		!Create(std::vector<std::string>({
		"--target-apk-path",
		target_apk_path,
		"--overlay-apk-path",
		overlay.apk_path,
		"--idmap-path",
		overlay.idmap_path,
		}),
		out_error)) {

		std::vector<std::string> verify_args = {"--idmap-path", overlay.idmap_path};
		for (const std::string& policy : overlay.policies) {
		verify_args.emplace_back("--policy");
		verify_args.emplace_back(policy);
		}

		if (!Verify(std::vector<std::string>(verify_args), dev_null)) {
		std::vector<std::string> create_args = {"--target-apk-path", target_apk_path,
		"--overlay-apk-path", overlay.apk_path,
		"--idmap-path", overlay.idmap_path};
		if (overlay.ignore_overlayable) {
		create_args.emplace_back("--ignore-overlayable");
		}

		for (const std::string& policy : overlay.policies) {
		verify_args.emplace_back("--policy");
		verify_args.emplace_back(policy);
		}

		if (!Create(create_args, out_error)) {
		return false;
		}
		}

		stream << overlay.idmap_path << std::endl;
		}

cmds/idmap2/idmap2d/Idmap2Service.cpp

+20 −2

Original line number	Diff line number	Diff line
		@@ -26,12 +26,15 @@
		#include <string>

		#include "android-base/macros.h"
		#include "android-base/stringprintf.h"
		#include "utils/String8.h"
		#include "utils/Trace.h"

		#include "idmap2/BinaryStreamVisitor.h"
		#include "idmap2/FileUtils.h"
		#include "idmap2/Idmap.h"
		#include "idmap2/Policies.h"
		#include "idmap2/Result.h"

		#include "idmap2d/Idmap2Service.h"

		@@ -39,6 +42,8 @@ using android::binder::Status;
		using android::idmap2::BinaryStreamVisitor;
		using android::idmap2::Idmap;
		using android::idmap2::IdmapHeader;
		using android::idmap2::PolicyBitmask;
		using android::idmap2::Result;
		using android::idmap2::utils::kIdmapFilePermissionMask;

		namespace {
		@@ -54,6 +59,10 @@ Status error(const std::string& msg) {
		return Status::fromExceptionCode(Status::EX_NONE, msg.c_str());
		}

		PolicyBitmask ConvertAidlArgToPolicyBitmask(int32_t arg) {
		return static_cast<PolicyBitmask>(arg);
		}

		} // namespace

		namespace android::os {
		@@ -78,6 +87,8 @@ Status Idmap2Service::removeIdmap(const std::string& overlay_apk_path,
		}

		Status Idmap2Service::verifyIdmap(const std::string& overlay_apk_path,
		int32_t fulfilled_policies ATTRIBUTE_UNUSED,
		bool enforce_overlayable ATTRIBUTE_UNUSED,
		int32_t user_id ATTRIBUTE_UNUSED, bool* _aidl_return) {
		assert(_aidl_return);
		const std::string idmap_path = Idmap::CanonicalIdmapPathFor(kIdmapCacheDir, overlay_apk_path);
		@@ -86,11 +97,15 @@ Status Idmap2Service::verifyIdmap(const std::string& overlay_apk_path,
		fin.close();
		std::stringstream dev_null;
		*_aidl_return = header && header->IsUpToDate(dev_null);

		// TODO(b/119328308): Check that the set of fulfilled policies of the overlay has not changed

		return ok();
		}

		Status Idmap2Service::createIdmap(const std::string& target_apk_path,
		const std::string& overlay_apk_path, int32_t user_id,
		const std::string& overlay_apk_path, int32_t fulfilled_policies,
		bool enforce_overlayable, int32_t user_id,
		std::unique_ptr<std::string>* _aidl_return) {
		assert(_aidl_return);
		std::stringstream trace;
		@@ -101,6 +116,8 @@ Status Idmap2Service::createIdmap(const std::string& target_apk_path,

		_aidl_return->reset(nullptr);

		const PolicyBitmask policy_bitmask = ConvertAidlArgToPolicyBitmask(fulfilled_policies);

		const std::unique_ptr<const ApkAssets> target_apk = ApkAssets::Load(target_apk_path);
		if (!target_apk) {
		return error("failed to load apk " + target_apk_path);
		@@ -113,7 +130,8 @@ Status Idmap2Service::createIdmap(const std::string& target_apk_path,

		std::stringstream err;
		const std::unique_ptr<const Idmap> idmap =
		Idmap::FromApkAssets(target_apk_path, target_apk, overlay_apk_path, overlay_apk, err);
		Idmap::FromApkAssets(target_apk_path, target_apk, overlay_apk_path, overlay_apk,
		policy_bitmask, enforce_overlayable, err);
		if (!idmap) {
		return error(err.str());
		}

cmds/idmap2/idmap2d/Idmap2Service.h

+4 −3

Original line number	Diff line number	Diff line
		@@ -39,11 +39,12 @@ class Idmap2Service : public BinderService<Idmap2Service>, public BnIdmap2 {
		binder::Status removeIdmap(const std::string& overlay_apk_path, int32_t user_id,
		bool* _aidl_return);

		binder::Status verifyIdmap(const std::string& overlay_apk_path, int32_t user_id,
		bool* _aidl_return);
		binder::Status verifyIdmap(const std::string& overlay_apk_path, int32_t fulfilled_policies,
		bool enforce_overlayable, int32_t user_id, bool* _aidl_return);

		binder::Status createIdmap(const std::string& target_apk_path,
		const std::string& overlay_apk_path, int32_t user_id,
		const std::string& overlay_apk_path, int32_t fulfilled_policies,
		bool enforce_overlayable, int32_t user_id,
		std::unique_ptr<std::string>* _aidl_return);
		};