tree b20f400f7b598641a8731d3c9624c25ec4491d4b
parent 62ac8b56a9f7cf75f3f0677ec37d8acb8def475c
author Winson <chiuwinson@google.com> 1575487961 -0800
committer Winson <chiuwinson@google.com> 1582761584 -0800

Actor signature overlayable policy

There are cases where an app can ship overlays for itself,
but the "signature" policy as described would open up
a vulnerability by allowing the system actor to create
and sign any arbitrary overlay that will apply to the target.

To prevent this, redefine "signature" as target package only,
and introduce "actor" for checking against the actor signature.
Any app that wishes to use both can include both policies.

Bug: 130563563

Test: m aapt2_tests idmapt2_tests and run from host test output
Test: atest libandroidfw_tests

Change-Id: I1c583a5b37f4abbeb18fc6a35c502377d8977a41