Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ce72ef0f authored by Pavel Grafov's avatar Pavel Grafov
Browse files

Log additional events in security log. 

These events are required for US NIAP MDFPP v3.1 compliance.

Bug: 70886042
Test: manual
Change-Id: I1752469cf4c7ff499eb4356fa1c94f3146d4c9b8
parent 0edd6454

api/current.txt

+26 −0
Original line number Diff line number Diff line
@@ -6723,20 +6723,46 @@ package android.app.admin { 














  public class SecurityLog {















    ctor public SecurityLog();













    field public static final int LEVEL_ERROR = 3; // 0x3













    field public static final int LEVEL_INFO = 1; // 0x1













    field public static final int LEVEL_WARNING = 2; // 0x2















    field public static final int TAG_ADB_SHELL_CMD = 210002; // 0x33452















    field public static final int TAG_ADB_SHELL_INTERACTIVE = 210001; // 0x33451















    field public static final int TAG_APP_PROCESS_START = 210005; // 0x33455













    field public static final int TAG_CERT_AUTHORITY_INSTALLED = 210029; // 0x3346d













    field public static final int TAG_CERT_AUTHORITY_REMOVED = 210030; // 0x3346e













    field public static final int TAG_KEYGUARD_DISABLED_FEATURES_SET = 210021; // 0x33465















    field public static final int TAG_KEYGUARD_DISMISSED = 210006; // 0x33456















    field public static final int TAG_KEYGUARD_DISMISS_AUTH_ATTEMPT = 210007; // 0x33457















    field public static final int TAG_KEYGUARD_SECURED = 210008; // 0x33458













    field public static final int TAG_KEY_DESTRUCTION = 210026; // 0x3346a













    field public static final int TAG_KEY_GENERATED = 210024; // 0x33468













    field public static final int TAG_KEY_IMPORT = 210025; // 0x33469













    field public static final int TAG_LOGGING_STARTED = 210011; // 0x3345b













    field public static final int TAG_LOGGING_STOPPED = 210012; // 0x3345c













    field public static final int TAG_LOG_BUFFER_SIZE_CRITICAL = 210015; // 0x3345f













    field public static final int TAG_MAX_PASSWORD_ATTEMPTS_SET = 210020; // 0x33464













    field public static final int TAG_MAX_SCREEN_LOCK_TIMEOUT_SET = 210019; // 0x33463













    field public static final int TAG_MEDIA_MOUNT = 210013; // 0x3345d













    field public static final int TAG_MEDIA_UNMOUNT = 210014; // 0x3345e













    field public static final int TAG_OS_SHUTDOWN = 210010; // 0x3345a













    field public static final int TAG_OS_STARTUP = 210009; // 0x33459













    field public static final int TAG_PASSWORD_COMPLEXITY_SET = 210017; // 0x33461













    field public static final int TAG_PASSWORD_EXPIRATION_SET = 210016; // 0x33460













    field public static final int TAG_PASSWORD_HISTORY_LENGTH_SET = 210018; // 0x33462













    field public static final int TAG_REMOTE_LOCK = 210022; // 0x33466















    field public static final int TAG_SYNC_RECV_FILE = 210003; // 0x33453















    field public static final int TAG_SYNC_SEND_FILE = 210004; // 0x33454













    field public static final int TAG_USER_RESTRICTION_ADDED = 210027; // 0x3346b













    field public static final int TAG_USER_RESTRICTION_REMOVED = 210028; // 0x3346c













    field public static final int TAG_WIPE_FAILURE = 210023; // 0x33467















  }





























  public static final class SecurityLog.SecurityEvent implements android.os.Parcelable {















    method public int describeContents();















    method public java.lang.Object getData();















    method public long getId();













    method public int getLogLevel();















    method public int getTag();















    method public long getTimeNanos();















    method public void writeToParcel(android.os.Parcel, int);

























core/java/android/app/admin/SecurityLog.java



+384
−26


























File changed.
Preview size limit exceeded, changes collapsed.
























core/java/android/app/admin/SecurityLogTags.logtags



+25
−0




























Original line number
Diff line number
Diff line








@@ -10,3 +10,28 @@ option java_package android.app.admin













210006 security_keyguard_dismissed















210007 security_keyguard_dismiss_auth_attempt   (success|1),(method_strength|1)















210008 security_keyguard_secured



























# Additional event types for NIAP MDFPP 3.1 compliant audit logging.



























210009 security_os_startup                      (boot_state|3),(verity_mode|3)













210010 security_os_shutdown













210011 security_logging_started













210012 security_logging_stopped













210013 security_media_mounted                   (path|3),(label|3)













210014 security_media_unmounted                 (path|3),(label|3)













210015 security_log_buffer_size_critical













210016 security_password_expiration_set         (package|3),(admin_user|1),(target_user|1),(timeout|2|3)













210017 security_password_complexity_set         (package|3),(admin_user|1),(target_user|1),(length|1),(quality|1),(num_letters|1),(num_non_letters|1),(num_numeric|1),(num_uppercase|1),(num_lowercase|1),(num_symbols|1)













210018 security_password_history_length_set     (package|3),(admin_user|1),(target_user|1),(length|1)













210019 security_max_screen_lock_timeout_set     (package|3),(admin_user|1),(target_user|1),(timeout|2|3)













210020 security_max_password_attempts_set       (package|3),(admin_user|1),(target_user|1),(num_failures|1)













210021 security_keyguard_disabled_features_set  (package|3),(admin_user|1),(target_user|1),(features|1)













210022 security_remote_lock                     (package|3),(admin_user|1),(target_user|1)













210023 security_wipe_failed                     (package|3),(admin_user|1)













210024 security_key_generated                   (success|1),(key_id|3),(uid|1)













210025 security_key_imported                    (success|1),(key_id|3),(uid|1)













210026 security_key_destroyed                   (success|1),(key_id|3),(uid|1)













210027 security_user_restriction_added          (package|3),(admin_user|1),(restriction|3)













210028 security_user_restriction_removed        (package|3),(admin_user|1),(restriction|3)













210029 security_cert_authority_installed        (success|1),(subject|3)













210030 security_cert_authority_removed          (success|1),(subject|3)










 No newline at end of file
























services/core/java/com/android/server/StorageManagerService.java



+24
−2




























Original line number
Diff line number
Diff line








@@ -36,6 +36,7 @@ import android.app.ActivityManagerInternal.ScreenObserver;













import android.app.AppOpsManager;















import android.app.IActivityManager;















import android.app.KeyguardManager;













import android.app.admin.SecurityLog;















import android.app.usage.StorageStatsManager;















import android.content.BroadcastReceiver;















import android.content.ComponentName;









@@ -50,7 +51,6 @@ import android.content.pm.UserInfo;













import android.content.res.Configuration;















import android.content.res.ObbInfo;















import android.database.ContentObserver;













import android.net.TrafficStats;















import android.net.Uri;















import android.os.Binder;















import android.os.DropBoxManager;










@@ -150,7 +150,6 @@ import java.util.Locale;













import java.util.Map;















import java.util.Map.Entry;















import java.util.Objects;













import java.util.concurrent.CompletableFuture;















import java.util.concurrent.CopyOnWriteArrayList;















import java.util.concurrent.CountDownLatch;















import java.util.concurrent.TimeUnit;










@@ -1275,6 +1274,29 @@ class StorageManagerService extends IStorageManager.Stub













            mObbActionHandler.sendMessage(mObbActionHandler.obtainMessage(















                    OBB_FLUSH_MOUNT_STATE, vol.path));















        }













        maybeLogMediaMount(vol, newState);













    }



























    private void maybeLogMediaMount(VolumeInfo vol, int newState) {













        if (!SecurityLog.isLoggingEnabled()) {













            return;













        }



























        final DiskInfo disk = vol.getDisk();













        if (disk == null || (disk.flags & (DiskInfo.FLAG_SD | DiskInfo.FLAG_USB)) == 0) {













            return;













        }



























        // Sometimes there is a newline character.













        final String label = disk.label != null ? disk.label.trim() : "";



























        if (newState == VolumeInfo.STATE_MOUNTED













                || newState == VolumeInfo.STATE_MOUNTED_READ_ONLY) {













            SecurityLog.writeEvent(SecurityLog.TAG_MEDIA_MOUNT, vol.path, label);













        } else if (newState == VolumeInfo.STATE_UNMOUNTED













                || newState == VolumeInfo.STATE_BAD_REMOVAL) {













            SecurityLog.writeEvent(SecurityLog.TAG_MEDIA_UNMOUNT, vol.path, label);













        }















    }































    private void onMoveStatusLocked(int status) {

































services/core/java/com/android/server/power/ShutdownThread.java



+5
−0




























Original line number
Diff line number
Diff line








@@ -21,6 +21,7 @@ import android.app.AlertDialog;













import android.app.Dialog;















import android.app.IActivityManager;















import android.app.ProgressDialog;













import android.app.admin.SecurityLog;















import android.content.BroadcastReceiver;















import android.content.Context;















import android.content.DialogInterface;










@@ -390,6 +391,10 @@ public final class ShutdownThread extends Thread {













            }















        }





























        if (SecurityLog.isLoggingEnabled()) {













            SecurityLog.writeEvent(SecurityLog.TAG_OS_SHUTDOWN);













        }





























        // start the thread that initiates shutdown















        sInstance.mHandler = new Handler() {















        };