Merge "Add SELinux updater and Settings-based enforcement switch." into jb-mr2-dev (cac0e0b1) · Commits · e / os / android_frameworks_base

core/java/android/provider/Settings.java

+56 −0

Original line number	Diff line number	Diff line
		@@ -5347,6 +5347,62 @@ public final class Settings {
		*/
		public static final String AUDIO_SAFE_VOLUME_STATE = "audio_safe_volume_state";

		/**
		* URL for tzinfo (time zone) updates
		* @hide
		*/
		public static final String TZINFO_UPDATE_CONTENT_URL = "tzinfo_content_url";

		/**
		* URL for tzinfo (time zone) update metadata
		* @hide
		*/
		public static final String TZINFO_UPDATE_METADATA_URL = "tzinfo_metadata_url";

		/**
		* URL for selinux (mandatory access control) updates
		* @hide
		*/
		public static final String SELINUX_UPDATE_CONTENT_URL = "selinux_content_url";

		/**
		* URL for selinux (mandatory access control) update metadata
		* @hide
		*/
		public static final String SELINUX_UPDATE_METADATA_URL = "selinux_metadata_url";

		/**
		* URL for sms short code updates
		* @hide
		*/
		public static final String SMS_SHORT_CODES_UPDATE_CONTENT_URL =
		"sms_short_codes_content_url";

		/**
		* URL for sms short code update metadata
		* @hide
		*/
		public static final String SMS_SHORT_CODES_UPDATE_METADATA_URL =
		"sms_short_codes_metadata_url";

		/**
		* URL for cert pinlist updates
		* @hide
		*/
		public static final String CERT_PIN_UPDATE_CONTENT_URL = "cert_pin_content_url";

		/**
		* URL for cert pinlist updates
		* @hide
		*/
		public static final String CERT_PIN_UPDATE_METADATA_URL = "cert_pin_metadata_url";

		/**
		* SELinux enforcement status. If 0, permissive; if 1, enforcing.
		* @hide
		*/
		public static final String SELINUX_STATUS = "selinux_status";

		/**
		* Settings to backup. This is here so that it's in the same place as the settings
		* keys and easy to update.

core/res/AndroidManifest.xml

+6 −0

Original line number	Diff line number	Diff line
		@@ -2313,6 +2313,12 @@
		</intent-filter>
		</receiver>

		<receiver android:name="com.android.server.updates.SELinuxPolicyInstallReceiver" >
		<intent-filter>
		<action android:name="android.intent.action.UPDATE_SEPOLICY" />
		</intent-filter>
		</receiver>

		<receiver android:name="com.android.server.MasterClearReceiver"
		android:permission="android.permission.MASTER_CLEAR"
		android:priority="100" >

services/java/com/android/server/updates/ConfigUpdateInstallReceiver.java

+4 −0

Original line number	Diff line number	Diff line
		@@ -102,6 +102,7 @@ public class ConfigUpdateInstallReceiver extends BroadcastReceiver {
		Slog.i(TAG, "Found new update, installing...");
		install(altContent, altVersion);
		Slog.i(TAG, "Installation successful");
		postInstall(context, intent);
		}
		} catch (Exception e) {
		Slog.e(TAG, "Could not update content!", e);
		@@ -257,4 +258,7 @@ public class ConfigUpdateInstallReceiver extends BroadcastReceiver {
		writeUpdate(updateDir, updateContent, content);
		writeUpdate(updateDir, updateVersion, Long.toString(version).getBytes());
		}

		protected void postInstall(Context context, Intent intent) {
		}
		}

services/java/com/android/server/updates/SELinuxPolicyInstallReceiver.java

0 → 100644

+45 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2013 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		package com.android.server.updates;

		import android.content.Context;
		import android.content.Intent;
		import android.os.SELinux;
		import android.provider.Settings;
		import android.util.Base64;
		import android.util.Slog;

		import java.io.IOException;

		public class SELinuxPolicyInstallReceiver extends ConfigUpdateInstallReceiver {

		public SELinuxPolicyInstallReceiver() {
		super("/data/security/", "sepolicy", "metadata/", "version");
		}

		@Override
		protected void install(byte[] encodedContent, int version) throws IOException {
		super.install(Base64.decode(encodedContent, Base64.DEFAULT), version);
		}

		@Override
		protected void postInstall(Context context, Intent intent) {
		boolean mode = Settings.Global.getInt(context.getContentResolver(),
		Settings.Global.SELINUX_STATUS, 0) == 1;
		SELinux.setSELinuxEnforce(mode);
		}
		}