From 73f0c7e4d975235d8de6e8078a276704285d9921 Mon Sep 17 00:00:00 2001 From: Patrick Baumann Date: Wed, 10 Mar 2021 13:51:07 -0800 Subject: Begin watching mIsolatedOwners This change swaps the type for mIsolatedOwners in PackageManagerService and the Computer from a SparseIntArray to a WatchedSparseIntArray to ensure that changes to it are propogated to the snapshotting system. Bug: 180418767 Change-Id: Ifa0890d07398adc727884ef0e15dd86843c5146f --- .../core/java/com/android/server/pm/PackageManagerService.java | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index bc991634fb07..706e3c5ddeb4 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -410,6 +410,7 @@ import com.android.server.utils.Watched; import com.android.server.utils.WatchedArrayMap; import com.android.server.utils.WatchedLongSparseArray; import com.android.server.utils.WatchedSparseBooleanArray; +import com.android.server.utils.WatchedSparseIntArray; import com.android.server.utils.Watcher; import com.android.server.wm.ActivityTaskManagerInternal; @@ -892,7 +893,7 @@ public class PackageManagerService extends IPackageManager.Stub // that created the isolated process. @Watched @GuardedBy("mLock") - final SparseIntArray mIsolatedOwners = new SparseIntArray(); + final WatchedSparseIntArray mIsolatedOwners = new WatchedSparseIntArray(); /** * Tracks new system packages [received in an OTA] that we expect to @@ -1795,7 +1796,7 @@ public class PackageManagerService extends IPackageManager.Stub public static final int SNAPPED = 2; public final Settings settings; - public final SparseIntArray isolatedOwners; + public final WatchedSparseIntArray isolatedOwners; public final WatchedArrayMap packages; public final WatchedArrayMap> sharedLibs; public final WatchedArrayMap> staticLibs; @@ -1814,7 +1815,7 @@ public class PackageManagerService extends IPackageManager.Stub Snapshot(int type) { if (type == Snapshot.SNAPPED) { settings = mSettings.snapshot(); - isolatedOwners = mIsolatedOwners.clone(); + isolatedOwners = mIsolatedOwners.snapshot(); packages = mPackages.snapshot(); sharedLibs = mSharedLibraries.snapshot(); staticLibs = mStaticLibsByDeclaringPackage.snapshot(); @@ -2014,7 +2015,7 @@ public class PackageManagerService extends IPackageManager.Stub // Cached attributes. The names in this class are the same as the // names in PackageManagerService; see that class for documentation. private final Settings mSettings; - private final SparseIntArray mIsolatedOwners; + private final WatchedSparseIntArray mIsolatedOwners; private final WatchedArrayMap mPackages; private final WatchedArrayMap mInstrumentation; @@ -6145,6 +6146,7 @@ public class PackageManagerService extends IPackageManager.Stub mAppsFilter.registerObserver(mWatcher); mInstantAppRegistry.registerObserver(mWatcher); mSettings.registerObserver(mWatcher); + mIsolatedOwners.registerObserver(mWatcher); // If neither "build" attribute is true then this may be a mockito test, and verification // can fail as a false positive. Watchable.verifyWatchedAttributes(this, mWatcher, !(mIsEngBuild || mIsUserDebugBuild)); -- cgit v1.2.3-59-g8ed1b From f868b7d608c2868e82c748500790e790b41ad689 Mon Sep 17 00:00:00 2001 From: Patrick Baumann Date: Wed, 10 Mar 2021 13:07:28 -0800 Subject: Check for missing values in mIsolatedOwners This change ensures that when we're looking up the owner of an isolated uid, we correctly block access when we don't find it. The default prior to this was 0, essentially giving root visibility to an isolated calling process. As a result, we now log error in such a scenario. This should help in root causing the underlying condition. Bug: 180418767 Test: manual; run webview apps and confirm presence of logs during startup Change-Id: I536f72d4ed53f316ba5b4bc98c6eb7f9ba0a62b8 --- .../com/android/server/pm/PackageManagerService.java | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index 706e3c5ddeb4..a7bb308a2122 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -3550,7 +3550,7 @@ public class PackageManagerService extends IPackageManager.Stub public String getInstantAppPackageName(int callingUid) { // If the caller is an isolated app use the owner's uid for the lookup. if (Process.isIsolated(callingUid)) { - callingUid = mIsolatedOwners.get(callingUid); + callingUid = getIsolatedOwner(callingUid); } final int appId = UserHandle.getAppId(callingUid); final Object obj = mSettings.getSettingLPr(appId); @@ -3562,6 +3562,19 @@ public class PackageManagerService extends IPackageManager.Stub return null; } + /** + * Finds the owner for the provided isolated UID. Throws IllegalStateException if no such + * isolated UID is found. + */ + private int getIsolatedOwner(int isolatedUid) { + final int ownerUid = mIsolatedOwners.get(isolatedUid, -1); + if (ownerUid == -1) { + throw new IllegalStateException( + "No owner UID found for isolated UID " + isolatedUid); + } + return ownerUid; + } + public String resolveExternalPackageNameLPr(AndroidPackage pkg) { if (pkg.getStaticSharedLibName() != null) { return pkg.getManifestPackageName(); @@ -3928,7 +3941,7 @@ public class PackageManagerService extends IPackageManager.Stub public boolean isInstantAppInternalBody(String packageName, @UserIdInt int userId, int callingUid) { if (Process.isIsolated(callingUid)) { - callingUid = mIsolatedOwners.get(callingUid); + callingUid = getIsolatedOwner(callingUid); } final PackageSetting ps = mSettings.getPackageLPr(packageName); final boolean returnAllowed = @@ -4082,7 +4095,7 @@ public class PackageManagerService extends IPackageManager.Stub @Nullable ComponentName component, @ComponentType int componentType, int userId) { // if we're in an isolated process, get the real calling UID if (Process.isIsolated(callingUid)) { - callingUid = mIsolatedOwners.get(callingUid); + callingUid = getIsolatedOwner(callingUid); } final String instantAppPkgName = getInstantAppPackageName(callingUid); final boolean callerIsInstantApp = instantAppPkgName != null; -- cgit v1.2.3-59-g8ed1b