Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f56ade36 authored by Winson's avatar Winson
Browse files

Actor signature overlayable policy 

There are cases where an app can ship overlays for itself,
but the "signature" policy as described would open up
a vulnerability by allowing the system actor to create
and sign any arbitrary overlay that will apply to the target.

To prevent this, redefine "signature" as target package only,
and introduce "actor" for checking against the actor signature.
Any app that wishes to use both can include both policies.

Bug: 130563563

Test: m aapt2_tests idmapt2_tests and run from host test output
Test: atest libandroidfw_tests

Change-Id: I1c583a5b37f4abbeb18fc6a35c502377d8977a41
parent 62ac8b56

cmds/idmap2/idmap2d/aidl/android/os/OverlayablePolicy.aidl

+1 −0
Original line number Diff line number Diff line
@@ -28,4 +28,5 @@ interface OverlayablePolicy { 
  const int SIGNATURE = 0x00000010;

  const int ODM_PARTITION = 0x00000020;

  const int OEM_PARTITION = 0x00000040;

  const int ACTOR_SIGNATURE = 0x00000080;

}

cmds/idmap2/libidmap2_policies/include/idmap2/Policies.h

+4 −2
Original line number Diff line number Diff line
@@ -29,6 +29,7 @@ using PolicyFlags = android::ResTable_overlayable_policy_header::PolicyFlags; 


namespace android::idmap2::policy {



constexpr const char* kPolicyActor = "actor";

constexpr const char* kPolicyOdm = "odm";

constexpr const char* kPolicyOem = "oem";

constexpr const char* kPolicyProduct = "product";
@@ -37,8 +38,9 @@ constexpr const char* kPolicySignature = "signature"; 
constexpr const char* kPolicySystem = "system";

constexpr const char* kPolicyVendor = "vendor";



inline static const std::array<std::pair<StringPiece, PolicyFlags>, 7> kPolicyStringToFlag = {

    std::pair{kPolicyOdm, PolicyFlags::ODM_PARTITION},

inline static const std::array<std::pair<StringPiece, PolicyFlags>, 8> kPolicyStringToFlag = {

    std::pair{kPolicyActor, PolicyFlags::ACTOR_SIGNATURE},

    {kPolicyOdm, PolicyFlags::ODM_PARTITION},

    {kPolicyOem, PolicyFlags::OEM_PARTITION},

    {kPolicyProduct, PolicyFlags::PRODUCT_PARTITION},

    {kPolicyPublic, PolicyFlags::PUBLIC},

cmds/idmap2/tests/IdmapTests.cpp

+16 −8
Original line number Diff line number Diff line
@@ -279,17 +279,25 @@ TEST(IdmapTests, CreateIdmapDataFromApkAssetsSharedLibOverlay) { 


  const auto& target_entries = data->GetTargetEntries();

  ASSERT_EQ(target_entries.size(), 4U);

  ASSERT_TARGET_ENTRY(target_entries[0], 0x7f010000, Res_value::TYPE_DYNAMIC_REFERENCE, 0x00010000);

  ASSERT_TARGET_ENTRY(target_entries[1], 0x7f02000c, Res_value::TYPE_DYNAMIC_REFERENCE, 0x00020000);

  ASSERT_TARGET_ENTRY(target_entries[2], 0x7f02000e, Res_value::TYPE_DYNAMIC_REFERENCE, 0x00020001);

  ASSERT_TARGET_ENTRY(target_entries[3], 0x7f02000f, Res_value::TYPE_DYNAMIC_REFERENCE, 0x00020002);

  ASSERT_TARGET_ENTRY(target_entries[0], R::target::integer::int1,

                      Res_value::TYPE_DYNAMIC_REFERENCE, R::overlay_shared::integer::int1);

  ASSERT_TARGET_ENTRY(target_entries[1], R::target::string::str1, Res_value::TYPE_DYNAMIC_REFERENCE,

                      R::overlay_shared::string::str1);

  ASSERT_TARGET_ENTRY(target_entries[2], R::target::string::str3, Res_value::TYPE_DYNAMIC_REFERENCE,

                      R::overlay_shared::string::str3);

  ASSERT_TARGET_ENTRY(target_entries[3], R::target::string::str4, Res_value::TYPE_DYNAMIC_REFERENCE,

                      R::overlay_shared::string::str4);



  const auto& overlay_entries = data->GetOverlayEntries();

  ASSERT_EQ(target_entries.size(), 4U);

  ASSERT_OVERLAY_ENTRY(overlay_entries[0], 0x00010000, 0x7f010000);

  ASSERT_OVERLAY_ENTRY(overlay_entries[1], 0x00020000, 0x7f02000c);

  ASSERT_OVERLAY_ENTRY(overlay_entries[2], 0x00020001, 0x7f02000e);

  ASSERT_OVERLAY_ENTRY(overlay_entries[3], 0x00020002, 0x7f02000f);

  ASSERT_OVERLAY_ENTRY(overlay_entries[0], R::overlay_shared::integer::int1,

                       R::target::integer::int1);

  ASSERT_OVERLAY_ENTRY(overlay_entries[1], R::overlay_shared::string::str1,

                       R::target::string::str1);

  ASSERT_OVERLAY_ENTRY(overlay_entries[2], R::overlay_shared::string::str3,

                       R::target::string::str3);

  ASSERT_OVERLAY_ENTRY(overlay_entries[3], R::overlay_shared::string::str4,

                       R::target::string::str4);

}



TEST(IdmapTests, CreateIdmapDataDoNotRewriteNonOverlayResourceId) {

cmds/idmap2/tests/PoliciesTests.cpp

+16 −0
Original line number Diff line number Diff line
@@ -67,6 +67,14 @@ TEST(PoliciesTests, PoliciesToBitmaskResults) { 


  const auto bitmask10 = PoliciesToBitmaskResult({"system "});

  ASSERT_FALSE(bitmask10);



  const auto bitmask11 = PoliciesToBitmaskResult({"signature"});

  ASSERT_TRUE(bitmask11);

  ASSERT_EQ(*bitmask11, PolicyFlags::SIGNATURE);



  const auto bitmask12 = PoliciesToBitmaskResult({"actor"});

  ASSERT_TRUE(bitmask12);

  ASSERT_EQ(*bitmask12, PolicyFlags::ACTOR_SIGNATURE);

}



TEST(PoliciesTests, BitmaskToPolicies) {
@@ -91,6 +99,14 @@ TEST(PoliciesTests, BitmaskToPolicies) { 
  ASSERT_EQ(policies3[3], "public");

  ASSERT_EQ(policies3[4], "system");

  ASSERT_EQ(policies3[5], "vendor");



  const auto policies4 = BitmaskToPolicies(PolicyFlags::SIGNATURE);

  ASSERT_EQ(1, policies4.size());

  ASSERT_EQ(policies4[0], "signature");



  const auto policies5 = BitmaskToPolicies(PolicyFlags::ACTOR_SIGNATURE);

  ASSERT_EQ(1, policies5.size());

  ASSERT_EQ(policies5[0], "actor");

}



}  // namespace android::idmap2

cmds/idmap2/tests/R.h

+30 −17
Original line number Diff line number Diff line
@@ -40,16 +40,17 @@ namespace R::target { 
  namespace string {

    constexpr ResourceId not_overlayable = 0x7f020003;

    constexpr ResourceId other = 0x7f020004;

    constexpr ResourceId policy_odm = 0x7f020005;

    constexpr ResourceId policy_oem = 0x7f020006;

    constexpr ResourceId policy_product = 0x7f020007;

    constexpr ResourceId policy_public = 0x7f020008;

    constexpr ResourceId policy_signature = 0x7f020009;

    constexpr ResourceId policy_system = 0x7f02000a;

    constexpr ResourceId policy_system_vendor = 0x7f02000b;

    constexpr ResourceId str1 = 0x7f02000c;

    constexpr ResourceId str3 = 0x7f02000e;

    constexpr ResourceId str4 = 0x7f02000f;

    constexpr ResourceId policy_actor = 0x7f020005;

    constexpr ResourceId policy_odm = 0x7f020006;

    constexpr ResourceId policy_oem = 0x7f020007;

    constexpr ResourceId policy_product = 0x7f020008;

    constexpr ResourceId policy_public = 0x7f020009;

    constexpr ResourceId policy_signature = 0x7f02000a;

    constexpr ResourceId policy_system = 0x7f02000b;

    constexpr ResourceId policy_system_vendor = 0x7f02000c;

    constexpr ResourceId str1 = 0x7f02000d;

    constexpr ResourceId str3 = 0x7f02000f;

    constexpr ResourceId str4 = 0x7f020010;



    namespace literal {

      inline const std::string str1 = hexify(R::target::string::str1);
@@ -70,6 +71,17 @@ namespace R::overlay { 
  }

}



namespace R::overlay_shared {

  namespace integer {

    constexpr ResourceId int1 = 0x00010000;

  }

  namespace string {

    constexpr ResourceId str1 = 0x00020000;

    constexpr ResourceId str3 = 0x00020001;

    constexpr ResourceId str4 = 0x00020002;

  }

}



namespace R::system_overlay::string {

  constexpr ResourceId policy_public = 0x7f010000;

  constexpr ResourceId policy_system = 0x7f010001;
@@ -79,13 +91,14 @@ namespace R::system_overlay::string { 
namespace R::system_overlay_invalid::string {

  constexpr ResourceId not_overlayable = 0x7f010000;

  constexpr ResourceId other = 0x7f010001;

  constexpr ResourceId policy_odm = 0x7f010002;

  constexpr ResourceId policy_oem = 0x7f010003;

  constexpr ResourceId policy_product = 0x7f010004;

  constexpr ResourceId policy_public = 0x7f010005;

  constexpr ResourceId policy_signature = 0x7f010006;

  constexpr ResourceId policy_system = 0x7f010007;

  constexpr ResourceId policy_system_vendor = 0x7f010008;

  constexpr ResourceId policy_actor = 0x7f010002;

  constexpr ResourceId policy_odm = 0x7f010003;

  constexpr ResourceId policy_oem = 0x7f010004;

  constexpr ResourceId policy_product = 0x7f010005;

  constexpr ResourceId policy_public = 0x7f010006;

  constexpr ResourceId policy_signature = 0x7f010007;

  constexpr ResourceId policy_system = 0x7f010008;

  constexpr ResourceId policy_system_vendor = 0x7f010009;

};

// clang-format on