From c3c9052bc7bf7f55e66a7560a28800066a6e044b Mon Sep 17 00:00:00 2001 From: Nick Kralevich <nnk@google.com> Date: Fri, 25 Oct 2013 12:25:36 -0700 Subject: [PATCH] Make DEFAULT_SYSTEM_DEV_CERTIFICATE available in keys.conf In 9af6f1bd59ee2fb0622db8ff25c4806c5527a0b3, the -d option was dropped from insertkeys.py. This was done to allow an Android distribution to replace the default version of keys.conf distributed in external/sepolicy/keys.conf. keys.conf was modified to reference the publicly known test keys in build/target/product/security. Unfortunately, this broke Google's build of Android. Instead of incorporating our keys directory, we were using the default AOSP keys. As a result, apps were getting assigned to the wrong SELinux domain. (see "Steps to reproduce" below) This change continues to allow others to replace keys.conf, but makes DEFAULT_SYSTEM_DEV_CERTIFICATE available as an environment variable in case the customized version wants to make reference to it. This change also modifies the stock version of keys.conf to use DEFAULT_SYSTEM_DEV_CERTIFICATE, which should be appropriate for most Android distributions. It doesn't make any sense to force each OEM to have a copy of this file. Steps to reproduce. 1) Compile and boot Android. 2) Run the following command: "adb shell ps -Z | grep process.media" Expected: $ adb shell ps -Z | grep process.media u:r:media_app:s0 u0_a5 1332 202 android.process.media Actual: $ adb shell ps -Z | grep process.media u:r:untrusted_app:s0 u0_a5 3617 187 android.process.media Bug: 11327304 Change-Id: Ica24fb25c5f9c0e2f4d181718c757cf372467822 --- Android.mk | 3 ++- keys.conf | 12 ++++++------ 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/Android.mk b/Android.mk index 87cfe6107..0121b6e57 100644 --- a/Android.mk +++ b/Android.mk @@ -179,7 +179,8 @@ ALL_MAC_PERMS_FILES := $(call build_policy, $(LOCAL_MODULE)) $(LOCAL_BUILT_MODULE) : $(mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py $(ALL_MAC_PERMS_FILES) @mkdir -p $(dir $@) - $(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(ALL_MAC_PERMS_FILES) + $(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \ + $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(ALL_MAC_PERMS_FILES) mac_perms_keys.tmp := ################################## diff --git a/keys.conf b/keys.conf index c00289790..7a307b5de 100644 --- a/keys.conf +++ b/keys.conf @@ -9,17 +9,17 @@ # [@PLATFORM] -ALL : build/target/product/security/platform.x509.pem +ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/platform.x509.pem [@MEDIA] -ALL : build/target/product/security/media.x509.pem +ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/media.x509.pem [@SHARED] -ALL : build/target/product/security/shared.x509.pem +ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/shared.x509.pem # Example of ALL TARGET_BUILD_VARIANTS [@RELEASE] -ENG : build/target/product/security/testkey.x509.pem -USER : build/target/product/security/testkey.x509.pem -USERDEBUG : build/target/product/security/testkey.x509.pem +ENG : $DEFAULT_SYSTEM_DEV_CERTIFICATE/testkey.x509.pem +USER : $DEFAULT_SYSTEM_DEV_CERTIFICATE/testkey.x509.pem +USERDEBUG : $DEFAULT_SYSTEM_DEV_CERTIFICATE/testkey.x509.pem -- GitLab