David Brazdil | 5a61bb7 | 2018-01-19 16:59:46 +0000 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2018 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #ifndef ART_RUNTIME_HIDDEN_API_H_ |
| 18 | #define ART_RUNTIME_HIDDEN_API_H_ |
| 19 | |
Andreas Gampe | 0dbc8be | 2018-04-11 20:45:16 +0000 | [diff] [blame] | 20 | #include "art_field-inl.h" |
| 21 | #include "art_method-inl.h" |
Andreas Gampe | 80f5fe5 | 2018-03-28 16:23:24 -0700 | [diff] [blame] | 22 | #include "base/mutex.h" |
David Sehr | 67bf42e | 2018-02-26 16:43:04 -0800 | [diff] [blame] | 23 | #include "dex/hidden_api_access_flags.h" |
David Brazdil | 6ca80d2 | 2018-03-12 18:01:18 +0000 | [diff] [blame] | 24 | #include "mirror/class-inl.h" |
David Brazdil | 5a61bb7 | 2018-01-19 16:59:46 +0000 | [diff] [blame] | 25 | #include "reflection.h" |
| 26 | #include "runtime.h" |
| 27 | |
| 28 | namespace art { |
| 29 | namespace hiddenapi { |
| 30 | |
Mathew Inwood | a5dc52c | 2018-02-19 15:30:51 +0000 | [diff] [blame] | 31 | // Hidden API enforcement policy |
| 32 | // This must be kept in sync with ApplicationInfo.ApiEnforcementPolicy in |
| 33 | // frameworks/base/core/java/android/content/pm/ApplicationInfo.java |
| 34 | enum class EnforcementPolicy { |
| 35 | kNoChecks = 0, |
Mathew Inwood | 6869369 | 2018-04-05 16:10:25 +0100 | [diff] [blame] | 36 | kJustWarn = 1, // keep checks enabled, but allow everything (enables logging) |
Mathew Inwood | a5dc52c | 2018-02-19 15:30:51 +0000 | [diff] [blame] | 37 | kDarkGreyAndBlackList = 2, // ban dark grey & blacklist |
| 38 | kBlacklistOnly = 3, // ban blacklist violations only |
| 39 | kMax = kBlacklistOnly, |
| 40 | }; |
| 41 | |
| 42 | inline EnforcementPolicy EnforcementPolicyFromInt(int api_policy_int) { |
| 43 | DCHECK_GE(api_policy_int, 0); |
| 44 | DCHECK_LE(api_policy_int, static_cast<int>(EnforcementPolicy::kMax)); |
| 45 | return static_cast<EnforcementPolicy>(api_policy_int); |
| 46 | } |
| 47 | |
David Brazdil | a02cb11 | 2018-01-31 11:36:39 +0000 | [diff] [blame] | 48 | enum Action { |
| 49 | kAllow, |
| 50 | kAllowButWarn, |
David Brazdil | 9226522 | 2018-02-02 11:21:40 +0000 | [diff] [blame] | 51 | kAllowButWarnAndToast, |
David Brazdil | a02cb11 | 2018-01-31 11:36:39 +0000 | [diff] [blame] | 52 | kDeny |
| 53 | }; |
David Brazdil | 5a61bb7 | 2018-01-19 16:59:46 +0000 | [diff] [blame] | 54 | |
David Brazdil | 068d68d | 2018-02-12 13:04:17 -0800 | [diff] [blame] | 55 | enum AccessMethod { |
Mathew Inwood | 2d4d62f | 2018-04-12 13:56:37 +0100 | [diff] [blame] | 56 | kNone, // internal test that does not correspond to an actual access by app |
| 57 | kReflection, |
| 58 | kJNI, |
| 59 | kLinking, |
Mathew Inwood | 73ddda4 | 2018-04-03 15:32:32 +0100 | [diff] [blame] | 60 | }; |
| 61 | |
| 62 | // Do not change the values of items in this enum, as they are written to the |
| 63 | // event log for offline analysis. Any changes will interfere with that analysis. |
| 64 | enum AccessContextFlags { |
| 65 | // Accessed member is a field if this bit is set, else a method |
| 66 | kMemberIsField = 1 << 0, |
| 67 | // Indicates if access was denied to the member, instead of just printing a warning. |
| 68 | kAccessDenied = 1 << 1, |
David Brazdil | 068d68d | 2018-02-12 13:04:17 -0800 | [diff] [blame] | 69 | }; |
| 70 | |
David Brazdil | 14c212a | 2018-04-23 13:50:38 +0100 | [diff] [blame] | 71 | inline Action GetActionFromAccessFlags(HiddenApiAccessFlags::ApiList api_list) { |
| 72 | if (api_list == HiddenApiAccessFlags::kWhitelist) { |
| 73 | return kAllow; |
| 74 | } |
| 75 | |
Mathew Inwood | a5dc52c | 2018-02-19 15:30:51 +0000 | [diff] [blame] | 76 | EnforcementPolicy policy = Runtime::Current()->GetHiddenApiEnforcementPolicy(); |
| 77 | if (policy == EnforcementPolicy::kNoChecks) { |
| 78 | // Exit early. Nothing to enforce. |
| 79 | return kAllow; |
| 80 | } |
| 81 | |
Mathew Inwood | 6869369 | 2018-04-05 16:10:25 +0100 | [diff] [blame] | 82 | // if policy is "just warn", always warn. We returned above for whitelist APIs. |
| 83 | if (policy == EnforcementPolicy::kJustWarn) { |
| 84 | return kAllowButWarn; |
| 85 | } |
| 86 | DCHECK(policy >= EnforcementPolicy::kDarkGreyAndBlackList); |
Mathew Inwood | a5dc52c | 2018-02-19 15:30:51 +0000 | [diff] [blame] | 87 | // The logic below relies on equality of values in the enums EnforcementPolicy and |
Andreas Gampe | 80f5fe5 | 2018-03-28 16:23:24 -0700 | [diff] [blame] | 88 | // HiddenApiAccessFlags::ApiList, and their ordering. Assertions are in hidden_api.cc. |
Mathew Inwood | a5dc52c | 2018-02-19 15:30:51 +0000 | [diff] [blame] | 89 | if (static_cast<int>(policy) > static_cast<int>(api_list)) { |
| 90 | return api_list == HiddenApiAccessFlags::kDarkGreylist |
| 91 | ? kAllowButWarnAndToast |
| 92 | : kAllowButWarn; |
| 93 | } else { |
| 94 | return kDeny; |
David Brazdil | 5a61bb7 | 2018-01-19 16:59:46 +0000 | [diff] [blame] | 95 | } |
| 96 | } |
| 97 | |
Andreas Gampe | 80f5fe5 | 2018-03-28 16:23:24 -0700 | [diff] [blame] | 98 | // Implementation details. DO NOT ACCESS DIRECTLY. |
| 99 | namespace detail { |
David Brazdil | ee7d2fd | 2018-01-20 17:25:23 +0000 | [diff] [blame] | 100 | |
Mathew Inwood | 3383aa5 | 2018-03-16 14:18:33 +0000 | [diff] [blame] | 101 | // Class to encapsulate the signature of a member (ArtField or ArtMethod). This |
| 102 | // is used as a helper when matching prefixes, and when logging the signature. |
| 103 | class MemberSignature { |
| 104 | private: |
Mathew Inwood | 73ddda4 | 2018-04-03 15:32:32 +0100 | [diff] [blame] | 105 | enum MemberType { |
| 106 | kField, |
| 107 | kMethod, |
| 108 | }; |
| 109 | |
| 110 | std::string class_name_; |
| 111 | std::string member_name_; |
| 112 | std::string type_signature_; |
Mathew Inwood | 3383aa5 | 2018-03-16 14:18:33 +0000 | [diff] [blame] | 113 | std::string tmp_; |
Mathew Inwood | 73ddda4 | 2018-04-03 15:32:32 +0100 | [diff] [blame] | 114 | MemberType type_; |
| 115 | |
| 116 | inline std::vector<const char*> GetSignatureParts() const; |
Mathew Inwood | 3383aa5 | 2018-03-16 14:18:33 +0000 | [diff] [blame] | 117 | |
| 118 | public: |
Andreas Gampe | 80f5fe5 | 2018-03-28 16:23:24 -0700 | [diff] [blame] | 119 | explicit MemberSignature(ArtField* field) REQUIRES_SHARED(Locks::mutator_lock_); |
| 120 | explicit MemberSignature(ArtMethod* method) REQUIRES_SHARED(Locks::mutator_lock_); |
Mathew Inwood | 3383aa5 | 2018-03-16 14:18:33 +0000 | [diff] [blame] | 121 | |
Andreas Gampe | 80f5fe5 | 2018-03-28 16:23:24 -0700 | [diff] [blame] | 122 | void Dump(std::ostream& os) const; |
Mathew Inwood | 3383aa5 | 2018-03-16 14:18:33 +0000 | [diff] [blame] | 123 | |
Mathew Inwood | 3383aa5 | 2018-03-16 14:18:33 +0000 | [diff] [blame] | 124 | // Performs prefix match on this member. Since the full member signature is |
| 125 | // composed of several parts, we match each part in turn (rather than |
| 126 | // building the entire thing in memory and performing a simple prefix match) |
Andreas Gampe | 80f5fe5 | 2018-03-28 16:23:24 -0700 | [diff] [blame] | 127 | bool DoesPrefixMatch(const std::string& prefix) const; |
Mathew Inwood | 3383aa5 | 2018-03-16 14:18:33 +0000 | [diff] [blame] | 128 | |
Andreas Gampe | 80f5fe5 | 2018-03-28 16:23:24 -0700 | [diff] [blame] | 129 | bool IsExempted(const std::vector<std::string>& exemptions); |
Mathew Inwood | 3383aa5 | 2018-03-16 14:18:33 +0000 | [diff] [blame] | 130 | |
Andreas Gampe | 80f5fe5 | 2018-03-28 16:23:24 -0700 | [diff] [blame] | 131 | void WarnAboutAccess(AccessMethod access_method, HiddenApiAccessFlags::ApiList list); |
Mathew Inwood | 73ddda4 | 2018-04-03 15:32:32 +0100 | [diff] [blame] | 132 | |
| 133 | void LogAccessToEventLog(AccessMethod access_method, Action action_taken); |
Mathew Inwood | 3383aa5 | 2018-03-16 14:18:33 +0000 | [diff] [blame] | 134 | }; |
David Brazdil | ee7d2fd | 2018-01-20 17:25:23 +0000 | [diff] [blame] | 135 | |
Andreas Gampe | 80f5fe5 | 2018-03-28 16:23:24 -0700 | [diff] [blame] | 136 | template<typename T> |
David Brazdil | b8c6619 | 2018-04-23 13:51:16 +0100 | [diff] [blame] | 137 | Action GetMemberActionImpl(T* member, |
| 138 | HiddenApiAccessFlags::ApiList api_list, |
| 139 | Action action, |
| 140 | AccessMethod access_method) |
Andreas Gampe | 80f5fe5 | 2018-03-28 16:23:24 -0700 | [diff] [blame] | 141 | REQUIRES_SHARED(Locks::mutator_lock_); |
| 142 | |
| 143 | // Returns true if the caller is either loaded by the boot strap class loader or comes from |
| 144 | // a dex file located in ${ANDROID_ROOT}/framework/. |
| 145 | ALWAYS_INLINE |
| 146 | inline bool IsCallerInPlatformDex(ObjPtr<mirror::ClassLoader> caller_class_loader, |
| 147 | ObjPtr<mirror::DexCache> caller_dex_cache) |
| 148 | REQUIRES_SHARED(Locks::mutator_lock_) { |
| 149 | if (caller_class_loader.IsNull()) { |
| 150 | return true; |
| 151 | } else if (caller_dex_cache.IsNull()) { |
| 152 | return false; |
| 153 | } else { |
| 154 | const DexFile* caller_dex_file = caller_dex_cache->GetDexFile(); |
| 155 | return caller_dex_file != nullptr && caller_dex_file->IsPlatformDexFile(); |
| 156 | } |
| 157 | } |
| 158 | |
| 159 | } // namespace detail |
| 160 | |
David Brazdil | a02cb11 | 2018-01-31 11:36:39 +0000 | [diff] [blame] | 161 | // Returns true if access to `member` should be denied to the caller of the |
David Brazdil | f2a300b | 2018-03-27 08:14:25 +0000 | [diff] [blame] | 162 | // reflective query. The decision is based on whether the caller is in the |
| 163 | // platform or not. Because different users of this function determine this |
| 164 | // in a different way, `fn_caller_in_platform(self)` is called and should |
| 165 | // return true if the caller is located in the platform. |
David Brazdil | 6ca80d2 | 2018-03-12 18:01:18 +0000 | [diff] [blame] | 166 | // This function might print warnings into the log if the member is hidden. |
David Brazdil | ee7d2fd | 2018-01-20 17:25:23 +0000 | [diff] [blame] | 167 | template<typename T> |
Narayan Kamath | e453a8d | 2018-04-03 15:23:46 +0100 | [diff] [blame] | 168 | inline Action GetMemberAction(T* member, |
| 169 | Thread* self, |
| 170 | std::function<bool(Thread*)> fn_caller_in_platform, |
| 171 | AccessMethod access_method) |
David Brazdil | ee7d2fd | 2018-01-20 17:25:23 +0000 | [diff] [blame] | 172 | REQUIRES_SHARED(Locks::mutator_lock_) { |
| 173 | DCHECK(member != nullptr); |
David Brazdil | ee7d2fd | 2018-01-20 17:25:23 +0000 | [diff] [blame] | 174 | |
David Brazdil | 14c212a | 2018-04-23 13:50:38 +0100 | [diff] [blame] | 175 | // Decode hidden API access flags. |
| 176 | // NB Multiple threads might try to access (and overwrite) these simultaneously, |
| 177 | // causing a race. We only do that if access has not been denied, so the race |
| 178 | // cannot change Java semantics. We should, however, decode the access flags |
| 179 | // once and use it throughout this function, otherwise we may get inconsistent |
| 180 | // results, e.g. print whitelist warnings (b/78327881). |
| 181 | HiddenApiAccessFlags::ApiList api_list = member->GetHiddenApiAccessFlags(); |
| 182 | |
| 183 | Action action = GetActionFromAccessFlags(member->GetHiddenApiAccessFlags()); |
David Brazdil | a02cb11 | 2018-01-31 11:36:39 +0000 | [diff] [blame] | 184 | if (action == kAllow) { |
| 185 | // Nothing to do. |
Narayan Kamath | e453a8d | 2018-04-03 15:23:46 +0100 | [diff] [blame] | 186 | return action; |
David Brazdil | a02cb11 | 2018-01-31 11:36:39 +0000 | [diff] [blame] | 187 | } |
| 188 | |
David Brazdil | f2a300b | 2018-03-27 08:14:25 +0000 | [diff] [blame] | 189 | // Member is hidden. Invoke `fn_caller_in_platform` and find the origin of the access. |
David Brazdil | a02cb11 | 2018-01-31 11:36:39 +0000 | [diff] [blame] | 190 | // This can be *very* expensive. Save it for last. |
David Brazdil | f2a300b | 2018-03-27 08:14:25 +0000 | [diff] [blame] | 191 | if (fn_caller_in_platform(self)) { |
| 192 | // Caller in the platform. Exit. |
Narayan Kamath | e453a8d | 2018-04-03 15:23:46 +0100 | [diff] [blame] | 193 | return kAllow; |
David Brazdil | a02cb11 | 2018-01-31 11:36:39 +0000 | [diff] [blame] | 194 | } |
| 195 | |
David Brazdil | f2a300b | 2018-03-27 08:14:25 +0000 | [diff] [blame] | 196 | // Member is hidden and caller is not in the platform. |
David Brazdil | b8c6619 | 2018-04-23 13:51:16 +0100 | [diff] [blame] | 197 | return detail::GetMemberActionImpl(member, api_list, action, access_method); |
David Brazdil | f2a300b | 2018-03-27 08:14:25 +0000 | [diff] [blame] | 198 | } |
| 199 | |
| 200 | inline bool IsCallerInPlatformDex(ObjPtr<mirror::Class> caller) |
| 201 | REQUIRES_SHARED(Locks::mutator_lock_) { |
Andreas Gampe | 80f5fe5 | 2018-03-28 16:23:24 -0700 | [diff] [blame] | 202 | return !caller.IsNull() && |
| 203 | detail::IsCallerInPlatformDex(caller->GetClassLoader(), caller->GetDexCache()); |
David Brazdil | f2a300b | 2018-03-27 08:14:25 +0000 | [diff] [blame] | 204 | } |
| 205 | |
David Brazdil | 6ca80d2 | 2018-03-12 18:01:18 +0000 | [diff] [blame] | 206 | // Returns true if access to `member` should be denied to a caller loaded with |
| 207 | // `caller_class_loader`. |
| 208 | // This function might print warnings into the log if the member is hidden. |
| 209 | template<typename T> |
Narayan Kamath | e453a8d | 2018-04-03 15:23:46 +0100 | [diff] [blame] | 210 | inline Action GetMemberAction(T* member, |
| 211 | ObjPtr<mirror::ClassLoader> caller_class_loader, |
| 212 | ObjPtr<mirror::DexCache> caller_dex_cache, |
| 213 | AccessMethod access_method) |
David Brazdil | ee7d2fd | 2018-01-20 17:25:23 +0000 | [diff] [blame] | 214 | REQUIRES_SHARED(Locks::mutator_lock_) { |
Andreas Gampe | 80f5fe5 | 2018-03-28 16:23:24 -0700 | [diff] [blame] | 215 | bool caller_in_platform = detail::IsCallerInPlatformDex(caller_class_loader, caller_dex_cache); |
Narayan Kamath | e453a8d | 2018-04-03 15:23:46 +0100 | [diff] [blame] | 216 | return GetMemberAction(member, |
| 217 | /* thread */ nullptr, |
| 218 | [caller_in_platform] (Thread*) { return caller_in_platform; }, |
| 219 | access_method); |
David Brazdil | ee7d2fd | 2018-01-20 17:25:23 +0000 | [diff] [blame] | 220 | } |
| 221 | |
Narayan Kamath | e453a8d | 2018-04-03 15:23:46 +0100 | [diff] [blame] | 222 | // Calls back into managed code to notify VMRuntime.nonSdkApiUsageConsumer that |
| 223 | // |member| was accessed. This is usually called when an API is on the black, |
| 224 | // dark grey or light grey lists. Given that the callback can execute arbitrary |
| 225 | // code, a call to this method can result in thread suspension. |
| 226 | template<typename T> void NotifyHiddenApiListener(T* member) |
| 227 | REQUIRES_SHARED(Locks::mutator_lock_); |
| 228 | |
| 229 | |
David Brazdil | 5a61bb7 | 2018-01-19 16:59:46 +0000 | [diff] [blame] | 230 | } // namespace hiddenapi |
| 231 | } // namespace art |
| 232 | |
| 233 | #endif // ART_RUNTIME_HIDDEN_API_H_ |