diff options
5 files changed, 15 insertions, 28 deletions
diff --git a/core/java/com/android/internal/os/Zygote.java b/core/java/com/android/internal/os/Zygote.java index 03e5667666c1..89d63f60ebdd 100644 --- a/core/java/com/android/internal/os/Zygote.java +++ b/core/java/com/android/internal/os/Zygote.java @@ -55,8 +55,8 @@ public final class Zygote { public static final int DISABLE_VERIFIER = 1 << 9; /** Only use oat files located in /system. Otherwise use dex/jar/apk . */ public static final int ONLY_USE_SYSTEM_OAT_FILES = 1 << 10; - /** Do not enfore hidden API access restrictions. */ - public static final int DISABLE_HIDDEN_API_CHECKS = 1 << 11; + /** Do enfore hidden API access restrictions. */ + public static final int ENABLE_HIDDEN_API_CHECKS = 1 << 11; /** Force generation of native debugging information for backtraces. */ public static final int DEBUG_GENERATE_MINI_DEBUG_INFO = 1 << 12; @@ -162,9 +162,6 @@ public final class Zygote { */ public static int forkSystemServer(int uid, int gid, int[] gids, int runtimeFlags, int[][] rlimits, long permittedCapabilities, long effectiveCapabilities) { - // SystemServer is always allowed to use hidden APIs. - runtimeFlags |= DISABLE_HIDDEN_API_CHECKS; - VM_HOOKS.preFork(); // Resets nice priority for zygote process. resetNicePriority(); diff --git a/core/java/com/android/internal/os/ZygoteInit.java b/core/java/com/android/internal/os/ZygoteInit.java index 89a70fc0c9a2..21f1fb652794 100644 --- a/core/java/com/android/internal/os/ZygoteInit.java +++ b/core/java/com/android/internal/os/ZygoteInit.java @@ -98,10 +98,6 @@ public class ZygoteInit { private static final String SOCKET_NAME_ARG = "--socket-name="; - /* Dexopt flag to disable hidden API access checks when dexopting SystemServer. - * Must be kept in sync with com.android.server.pm.Installer. */ - private static final int DEXOPT_DISABLE_HIDDEN_API_CHECKS = 1 << 10; - /** * Used to pre-load resources. */ @@ -569,10 +565,7 @@ public class ZygoteInit { if (dexoptNeeded != DexFile.NO_DEXOPT_NEEDED) { final String packageName = "*"; final String outputPath = null; - // Dexopt with a flag which lifts restrictions on hidden API usage. - // Offending methods would otherwise be re-verified at runtime and - // we want to avoid the performance overhead of that. - final int dexFlags = DEXOPT_DISABLE_HIDDEN_API_CHECKS; + final int dexFlags = 0; final String compilerFilter = systemServerFilter; final String uuid = StorageManager.UUID_PRIVATE_INTERNAL; final String seInfo = null; diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java index f2e0d3befbf3..0cce2d9ae56d 100644 --- a/services/core/java/com/android/server/am/ActivityManagerService.java +++ b/services/core/java/com/android/server/am/ActivityManagerService.java @@ -3891,10 +3891,10 @@ public class ActivityManagerService extends IActivityManager.Stub runtimeFlags |= Zygote.ONLY_USE_SYSTEM_OAT_FILES; } - if (app.info.isAllowedToUseHiddenApi()) { - // This app is allowed to use undocumented and private APIs. Set - // up its runtime with the appropriate flag. - runtimeFlags |= Zygote.DISABLE_HIDDEN_API_CHECKS; + if (!app.info.isAllowedToUseHiddenApi()) { + // This app is not allowed to use undocumented and private APIs. + // Set up its runtime with the appropriate flag. + runtimeFlags |= Zygote.ENABLE_HIDDEN_API_CHECKS; } String invokeWith = null; diff --git a/services/core/java/com/android/server/pm/Installer.java b/services/core/java/com/android/server/pm/Installer.java index 2cd128d0171e..91946821b8e0 100644 --- a/services/core/java/com/android/server/pm/Installer.java +++ b/services/core/java/com/android/server/pm/Installer.java @@ -58,9 +58,8 @@ public class Installer extends SystemService { public static final int DEXOPT_STORAGE_DE = 1 << 8; /** Indicates that dexopt is invoked from the background service. */ public static final int DEXOPT_IDLE_BACKGROUND_JOB = 1 << 9; - /* Indicates that dexopt should not restrict access to private APIs. - * Must be kept in sync with com.android.internal.os.ZygoteInit. */ - public static final int DEXOPT_DISABLE_HIDDEN_API_CHECKS = 1 << 10; + /** Indicates that dexopt should restrict access to private APIs. */ + public static final int DEXOPT_ENABLE_HIDDEN_API_CHECKS = 1 << 10; // NOTE: keep in sync with installd public static final int FLAG_CLEAR_CACHE_ONLY = 1 << 8; diff --git a/services/core/java/com/android/server/pm/PackageDexOptimizer.java b/services/core/java/com/android/server/pm/PackageDexOptimizer.java index 1f219c14dbec..77fe8bc36ce5 100644 --- a/services/core/java/com/android/server/pm/PackageDexOptimizer.java +++ b/services/core/java/com/android/server/pm/PackageDexOptimizer.java @@ -55,7 +55,7 @@ import static com.android.server.pm.Installer.DEXOPT_FORCE; import static com.android.server.pm.Installer.DEXOPT_STORAGE_CE; import static com.android.server.pm.Installer.DEXOPT_STORAGE_DE; import static com.android.server.pm.Installer.DEXOPT_IDLE_BACKGROUND_JOB; -import static com.android.server.pm.Installer.DEXOPT_DISABLE_HIDDEN_API_CHECKS; +import static com.android.server.pm.Installer.DEXOPT_ENABLE_HIDDEN_API_CHECKS; import static com.android.server.pm.InstructionSets.getAppDexInstructionSets; import static com.android.server.pm.InstructionSets.getDexCodeInstructionSets; @@ -510,11 +510,9 @@ public class PackageDexOptimizer { boolean isProfileGuidedFilter = isProfileGuidedCompilerFilter(compilerFilter); boolean isPublic = !info.isForwardLocked() && !isProfileGuidedFilter; int profileFlag = isProfileGuidedFilter ? DEXOPT_PROFILE_GUIDED : 0; - // System apps are invoked with a runtime flag which exempts them from - // restrictions on hidden API usage. We dexopt with the same runtime flag - // otherwise offending methods would have to be re-verified at runtime - // and we want to avoid the performance overhead of that. - int hiddenApiFlag = info.isAllowedToUseHiddenApi() ? DEXOPT_DISABLE_HIDDEN_API_CHECKS : 0; + // Some apps are executed with restrictions on hidden API usage. If this app is one + // of them, pass a flag to dexopt to enable the same restrictions during compilation. + int hiddenApiFlag = info.isAllowedToUseHiddenApi() ? 0 : DEXOPT_ENABLE_HIDDEN_API_CHECKS; int dexFlags = (isPublic ? DEXOPT_PUBLIC : 0) | (debuggable ? DEXOPT_DEBUGGABLE : 0) @@ -636,8 +634,8 @@ public class PackageDexOptimizer { if ((flags & DEXOPT_IDLE_BACKGROUND_JOB) == DEXOPT_IDLE_BACKGROUND_JOB) { flagsList.add("idle_background_job"); } - if ((flags & DEXOPT_DISABLE_HIDDEN_API_CHECKS) == DEXOPT_DISABLE_HIDDEN_API_CHECKS) { - flagsList.add("disable_hidden_api_checks"); + if ((flags & DEXOPT_ENABLE_HIDDEN_API_CHECKS) == DEXOPT_ENABLE_HIDDEN_API_CHECKS) { + flagsList.add("enable_hidden_api_checks"); } return String.join(",", flagsList); |