Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f93a39cb authored by Song Pan's avatar Song Pan
Browse files

Add implementation class to handle integrity check broadcasts. 

Change-Id: Ifca76a8fcf8277bfd2f123a6fd9351ae7db45643
Test: add unit test and manually building/flashing on a test device and
installing an app.
parent 4f059fa5

services/core/java/android/content/pm/PackageManagerInternal.java

+15 −0
Original line number Diff line number Diff line
@@ -822,4 +822,19 @@ public abstract class PackageManagerInternal { 


    /** Sets the enforcement of reading external storage */

    public abstract void setReadExternalStorageEnforced(boolean enforced);



    /**

     * Allows the integrity component to respond to the

     * {@link Intent#ACTION_PACKAGE_NEEDS_INTEGRITY_VERIFICATION package verification

     * broadcast} to respond to the package manager. The response must include

     * the {@code verificationCode} which is one of

     * {@link PackageManager#VERIFICATION_ALLOW} or

     * {@link PackageManager#VERIFICATION_REJECT}.

     *

     * @param verificationId pending package identifier as passed via the

     *            {@link PackageManager#EXTRA_VERIFICATION_ID} Intent extra.

     * @param verificationResult either {@link PackageManager#VERIFICATION_ALLOW}

     *            or {@link PackageManager#VERIFICATION_REJECT}.

     */

    public abstract void setIntegrityVerificationResult(int verificationId, int verificationResult);

}

services/core/java/com/android/server/integrity/AppIntegrityManagerService.java

0 → 100644
+43 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2019 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



package com.android.server.integrity;



import android.content.Context;



import com.android.server.SystemService;



/**

 * Service that manages app integrity rules and verifications.

 *

 * @hide

 */

public class AppIntegrityManagerService extends SystemService {



    private Context mContext;

    private AppIntegrityManagerServiceImpl mService;



    public AppIntegrityManagerService(Context context) {

        super(context);

        mContext = context;

    }



    @Override

    public void onStart() {

        mService = new AppIntegrityManagerServiceImpl(mContext);

        // TODO: define and publish a binder service.

    }

}

services/core/java/com/android/server/integrity/AppIntegrityManagerServiceImpl.java

0 → 100644
+80 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2019 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



package com.android.server.integrity;



import static android.content.Intent.ACTION_PACKAGE_NEEDS_INTEGRITY_VERIFICATION;

import static android.content.pm.PackageManager.EXTRA_VERIFICATION_ID;



import android.content.BroadcastReceiver;

import android.content.Context;

import android.content.Intent;

import android.content.IntentFilter;

import android.content.pm.PackageManager;

import android.content.pm.PackageManagerInternal;

import android.os.Handler;

import android.os.HandlerThread;

import android.util.Slog;



import com.android.internal.annotations.VisibleForTesting;

import com.android.server.LocalServices;



/** Implementation of {@link AppIntegrityManagerService}. */

class AppIntegrityManagerServiceImpl {

    private static final String TAG = "AppIntegrityManagerServiceImpl";



    private final Context mContext;

    private final Handler mHandler;

    private final PackageManagerInternal mPackageManagerInternal;



    AppIntegrityManagerServiceImpl(Context context) {

        mContext = context;



        HandlerThread handlerThread = new HandlerThread("AppIntegrityManagerServiceHandler");

        handlerThread.start();

        mHandler = handlerThread.getThreadHandler();



        mPackageManagerInternal = LocalServices.getService(PackageManagerInternal.class);



        IntentFilter integrityVerificationFilter = new IntentFilter();

        integrityVerificationFilter.addAction(ACTION_PACKAGE_NEEDS_INTEGRITY_VERIFICATION);



        mContext.registerReceiver(

                new BroadcastReceiver() {

                    @Override

                    public void onReceive(Context context, Intent intent) {

                        if (!ACTION_PACKAGE_NEEDS_INTEGRITY_VERIFICATION.equals(

                                intent.getAction())) {

                            return;

                        }

                        mHandler.post(() -> handleIntegrityVerification(intent));

                    }

                },

                integrityVerificationFilter,

                /* broadcastPermission= */ null,

                mHandler);

    }



    // protected broadcasts cannot be sent in the test.

    @VisibleForTesting

    void handleIntegrityVerification(Intent intent) {

        int verificationId = intent.getIntExtra(EXTRA_VERIFICATION_ID, -1);

        // TODO: implement this method.

        Slog.i(TAG, "Received integrity verification intent " + intent.toString());

        mPackageManagerInternal.setIntegrityVerificationResult(

                verificationId, PackageManager.VERIFICATION_ALLOW);

    }

}

services/core/java/com/android/server/pm/PackageManagerService.java

+13 −0
Original line number Diff line number Diff line
@@ -1439,6 +1439,7 @@ public class PackageManagerService extends IPackageManager.Stub 
    static final int ENABLE_ROLLBACK_TIMEOUT = 22;

    static final int DEFERRED_NO_KILL_POST_DELETE = 23;

    static final int DEFERRED_NO_KILL_INSTALL_OBSERVER = 24;

    static final int INTEGRITY_VERIFICATION_COMPLETE = 25;















    static final int DEFERRED_NO_KILL_POST_DELETE_DELAY_MS = 3 * 1000;















    static final int DEFERRED_NO_KILL_INSTALL_OBSERVER_DELAY_MS = 500;










@@ -1763,6 +1764,10 @@ public class PackageManagerService extends IPackageManager.Stub



























                    break;















                }













                case INTEGRITY_VERIFICATION_COMPLETE: {













                    // TODO: implement this case.













                    break;













                }















                case START_INTENT_FILTER_VERIFICATIONS: {















                    IFVerificationParams params = (IFVerificationParams) msg.obj;















                    verifyIntentFiltersIfNeeded(params.userId, params.verifierUid, params.replacing,










@@ -23199,6 +23204,14 @@ public class PackageManagerService extends IPackageManager.Stub













                mSettings.writeLPr();















            }















        }

























        @Override













        public void setIntegrityVerificationResult(int verificationId, int verificationResult) {













            final Message msg = mHandler.obtainMessage(INTEGRITY_VERIFICATION_COMPLETE);













            msg.arg1 = verificationId;













            msg.obj = verificationResult;













            mHandler.sendMessage(msg);













        }















    }





























    @GuardedBy("mLock")

























services/java/com/android/server/SystemServer.java



+5
−0




























Original line number
Diff line number
Diff line








@@ -109,6 +109,7 @@ import com.android.server.input.InputManagerService;













import com.android.server.inputmethod.InputMethodManagerService;















import com.android.server.inputmethod.InputMethodSystemProperty;















import com.android.server.inputmethod.MultiClientInputMethodManagerService;













import com.android.server.integrity.AppIntegrityManagerService;















import com.android.server.lights.LightsService;















import com.android.server.media.MediaResourceMonitorService;















import com.android.server.media.MediaRouterService;










@@ -1129,6 +1130,10 @@ public final class SystemServer {













            SignedConfigService.registerUpdateReceiver(mSystemContext);















            t.traceEnd();





























            t.traceBegin("AppIntegrityService");













            mSystemServiceManager.startService(AppIntegrityManagerService.class);













            t.traceEnd();





























        } catch (Throwable e) {















            Slog.e("System", "******************************************");















            Slog.e("System", "************ Failure starting core service");