Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5696dde9 authored by Florian Mayer's avatar Florian Mayer
Browse files

Add MTE Settings.

MTE is a technology to help prevent exploitation of some security bugs.
We want to offer users that want to trade off a slight reduction in
performance for higher security the option to do so from the settings
menu.

Test: make RunSettingsRoboTests
      check UI manually
Bug: 245624194
Change-Id: Ifbb76e124142ae843ce90bd604ae8417d65fcc7b
parent 1cda0a84
Loading
Loading
Loading
Loading
+33 −0
Original line number Diff line number Diff line
@@ -6709,6 +6709,7 @@
    <!-- Help URL, Top level privacy settings [DO NOT TRANSLATE] -->
    <string name="help_url_privacy_dashboard" translatable="false"></string>
    <string name="help_url_memtag" translatable="false"></string>
    <string name="help_url_network_dashboard" translatable="false"></string>
    <string name="help_url_connected_devices" translatable="false"></string>
    <string name="help_url_apps_and_notifications" translatable="false"></string>
@@ -8628,6 +8629,38 @@
    <!-- [CHAR LIMIT=NONE] eSim deletion confirmation description  -->
    <string name="confirm_sim_deletion_description">Verify it\u0027s you before erasing a downloaded SIM</string>
    <!-- TODO(b/258550150): Finalize all strings in this section and remove translatable="false" -->
    <!-- [CHAR LIMIT=32] Name of Advanced memory protection page in "More Security Settings" and heading of page. -->
    <string name="memtag_title" translatable="false">Advanced memory protection</string>
    <!-- [CHAR LIMIT=52] Label for button to turn on / off Advanced memory protection.-->
    <string name="memtag_toggle" translatable="false">Try Advanced memory protection</string>
    <!-- [CHAR LIMIT=NONE] Subtitle of Advanced memory protection page. -->
    <string name="memtag_intro" translatable="false">This beta feature helps you protect your device from bugs that may put your security at risk.</string>
    <!-- [CHAR LIMIT=NONE] Status label indicating that Advanced memory protection is on. -->
    <string name="memtag_on" translatable="false">On</string>
    <!-- [CHAR LIMIT=37] Status label indicating that Advanced memory protection is off. -->
    <string name="memtag_off" translatable="false">Off</string>
    <!-- [CHAR LIMIT=37] Status label indicating that system needs to be rebooted for Advanced memory protection to be on. -->
    <string name="memtag_on_pending" translatable="false">On after restart</string>
    <!-- [CHAR LIMIT=37] Status label indicating that system needs to be rebooted for Advanced memory protection to be off. -->
    <string name="memtag_off_pending" translatable="false">Off after restart</string>
    <!-- [CHAR LIMIT=37] Status label indicating that Advanced memory protection was forced off via remote device configuration. -->
    <string name="memtag_force_off" translatable="false">Currently unavailable for your device.</string>
    <!-- [CHAR LIMIT=NONE] Subtext on page to control Advanced memory protection settings. -->
    <string name="memtag_footer" translatable="false">You\u0027ll have to restart your device to turn Advanced memory protection on or off. When it\u0027s on, you may notice slower device performance.</string>
    <!-- [CHAR LIMIT=31] Header of dialog asking user to reboot device. -->
    <string name="memtag_reboot_title" translatable="false">Restart device?</string>
    <!-- [CHAR LIMIT=NONE] Message shown in dialog prompting user to reboot device to turn on Advanced memory protection.-->
    <string name="memtag_reboot_message_on" translatable="false">You\u0027ll need to restart your device to turn on Advanced memory protection.</string>
    <!-- [CHAR LIMIT=NONE] Message shown in dialog prompting user to reboot device to turn off Advanced memory protection.-->
    <string name="memtag_reboot_message_off" translatable="false">You\u0027ll need to restart your device to turn off Advanced memory protection.</string>
    <!-- [CHAR LIMIT=17] Button label in dialog prompting user to reboot device.-->
    <string name="memtag_reboot_yes" translatable="false">Restart</string>
    <!-- [CHAR LIMIT=17] Button label in dialog prompting user to reboot device.-->
    <string name="memtag_reboot_no" translatable="false">Not now</string>
    <!-- [CHAR LIMIT=NONE] Label for Learn More link. -->
    <string name="memtag_learn_more" translatable="false">Learn more about Advanced memory protection.</string>
    <!-- Opening string on the dialog that prompts the user to confirm that they really want to delete their existing work profile. The administration app icon and name appear after the final colon. [CHAR LIMIT=NONE] -->
    <string name="opening_paragraph_delete_profile_unknown_company">This work profile is managed by:</string>
    <!-- Summary for work profile accounts group. [CHAR LIMIT=25] -->
+37 −0
Original line number Diff line number Diff line
<?xml version="1.0" encoding="utf-8"?>
<!-- Copyright (C) 2022 The Android Open Source Project

     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
     You may obtain a copy of the License at

          http://www.apache.org/licenses/LICENSE-2.0

     Unless required by applicable law or agreed to in writing, software
     distributed under the License is distributed on an "AS IS" BASIS,
     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     See the License for the specific language governing permissions and
     limitations under the License.
-->

<PreferenceScreen
    xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:settings="http://schemas.android.com/apk/res-auto"
    android:title="@string/memtag_title">

    <com.android.settingslib.widget.TopIntroPreference
        android:title="@string/memtag_intro"
        settings:searchable="false"/>

    <SwitchPreference
        android:id="@+id/memtag_page_switch"
        android:key="memtag"
        android:title="@string/memtag_toggle"
        settings:controller="com.android.settings.security.MemtagPreferenceController" />

    <com.android.settingslib.widget.FooterPreference
        android:title="@string/memtag_footer"
        android:key="memtag_footer"
        settings:searchable="false"
        settings:controller="com.android.settings.security.MemtagFooterPreferenceController" />
</PreferenceScreen>
+9 −1
Original line number Diff line number Diff line
@@ -107,9 +107,17 @@
        settings:isPreferenceVisible="@bool/config_show_sim_info"
        settings:controller="com.android.settings.security.ConfirmSimDeletionPreferenceController" />

  <Preference
        android:order="100"
        android:id="@+id/memtag_page"
        android:key="memtag_page"
        android:title="@string/memtag_title"
        android:fragment="com.android.settings.security.MemtagPage"
        settings:controller="com.android.settings.security.MemtagPagePreferenceController" />

    <!-- work profile security section -->
    <PreferenceCategory
        android:order="100"
        android:order="110"
        android:key="security_category_profile"
        android:title="@string/lock_settings_profile_title">

+56 −0
Original line number Diff line number Diff line
/*
 * Copyright (C) 2022 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License
 */

package com.android.settings.security;

import android.content.Context;
import android.text.TextUtils;

import androidx.preference.PreferenceScreen;

import com.android.settings.R;
import com.android.settings.core.BasePreferenceController;
import com.android.settingslib.HelpUtils;
import com.android.settingslib.widget.FooterPreference;

/** Footer for face settings showing the help text and help link. */
public class MemtagFooterPreferenceController extends BasePreferenceController {

    public MemtagFooterPreferenceController(Context context, String preferenceKey) {
        super(context, preferenceKey);
    }

    @Override
    public int getAvailabilityStatus() {
        return AVAILABLE_UNSEARCHABLE;
    }

    @Override
    public void displayPreference(PreferenceScreen screen) {
        super.displayPreference(screen);
        // Set up learn more link.
        FooterPreference prefFooter = screen.findPreference(getPreferenceKey());
        String helpUrl = mContext.getString(R.string.help_url_memtag);
        if (prefFooter != null && !TextUtils.isEmpty(helpUrl)) {
            prefFooter.setLearnMoreAction(
                    v ->
                            mContext.startActivity(
                                    HelpUtils.getHelpIntent(
                                            mContext, helpUrl, /* backupContext= */ "")));
            prefFooter.setLearnMoreText(mContext.getString(R.string.memtag_learn_more));
        }
    }
}
+79 −0
Original line number Diff line number Diff line
/*
 * Copyright (C) 2022 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package com.android.settings.security;

import android.os.SystemProperties;

import com.android.internal.os.Zygote;
import com.android.settings.R;
import com.android.settings.core.BasePreferenceController;

import java.util.Arrays;

public class MemtagHelper {
    private static boolean isForcedOff() {
        return "force_off"
                .equals(
                        SystemProperties.get(
                                "persist.device_config.memory_safety_native.bootloader_override"));
    }

    public static boolean isChecked() {
        String modes[] = SystemProperties.get("arm64.memtag.bootctl", "").split(",");
        return Arrays.asList(modes).contains("memtag");
    }

    public static void setChecked(boolean isChecked) {
        String newString = isChecked ? "memtag" : "none";
        SystemProperties.set("arm64.memtag.bootctl", newString);
    }

    public static int getAvailabilityStatus() {
        if (MemtagHelper.isForcedOff()) {
            return BasePreferenceController.DISABLED_DEPENDENT_SETTING;
        }
        return SystemProperties.getBoolean("ro.arm64.memtag.bootctl_supported", false)
                ? BasePreferenceController.AVAILABLE
                : BasePreferenceController.UNSUPPORTED_ON_DEVICE;
    }

    /**
     * Returns whether MTE is currently active on this device. We use this to determine whether we
     * need to reboot the device to apply the user choice.
     *
     * @return boolean whether MTE is currently active
     */
    public static boolean isOn() {
        return Zygote.nativeSupportsMemoryTagging();
    }

    public static int getSummary() {
        if (isForcedOff()) {
            return R.string.memtag_force_off;
        }
        if (isOn()) {
            if (isChecked()) {
                return R.string.memtag_on;
            }
            return R.string.memtag_off_pending;
        }
        if (isChecked()) {
            return R.string.memtag_on_pending;
        }
        return R.string.memtag_off;
    }
}
Loading