Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2016 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
Michal Karpinski | 6235a94 | 2016-03-15 12:07:23 +0000 | [diff] [blame] | 17 | package android.app.admin; |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 18 | |
| 19 | import android.annotation.IntDef; |
Naomi Musgrave | db980f4 | 2017-11-28 10:56:47 +0000 | [diff] [blame] | 20 | import android.annotation.TestApi; |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 21 | import android.content.ComponentName; |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 22 | import android.os.Parcel; |
| 23 | import android.os.Parcelable; |
| 24 | import android.os.SystemProperties; |
| 25 | import android.util.EventLog.Event; |
| 26 | |
| 27 | import java.io.IOException; |
| 28 | import java.lang.annotation.Retention; |
| 29 | import java.lang.annotation.RetentionPolicy; |
| 30 | import java.util.Collection; |
Naomi Musgrave | db980f4 | 2017-11-28 10:56:47 +0000 | [diff] [blame] | 31 | import java.util.Objects; |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 32 | |
Pavel Grafov | 73f747b | 2017-04-10 19:29:41 +0100 | [diff] [blame] | 33 | /** |
| 34 | * Definitions for working with security logs. |
| 35 | * |
| 36 | * <p>Device owner apps can control the logging with |
| 37 | * {@link DevicePolicyManager#setSecurityLoggingEnabled}. When security logs are enabled, device |
| 38 | * owner apps receive periodic callbacks from {@link DeviceAdminReceiver#onSecurityLogsAvailable}, |
| 39 | * at which time new batch of logs can be collected via |
| 40 | * {@link DevicePolicyManager#retrieveSecurityLogs}. {@link SecurityEvent} describes the type and |
| 41 | * format of security logs being collected. |
| 42 | */ |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 43 | public class SecurityLog { |
| 44 | |
| 45 | private static final String PROPERTY_LOGGING_ENABLED = "persist.logd.security"; |
| 46 | |
| 47 | /** @hide */ |
| 48 | @Retention(RetentionPolicy.SOURCE) |
Jeff Sharkey | ce8db99 | 2017-12-13 20:05:05 -0700 | [diff] [blame] | 49 | @IntDef(prefix = { "TAG_" }, value = { |
| 50 | TAG_ADB_SHELL_INTERACTIVE, |
| 51 | TAG_ADB_SHELL_CMD, |
| 52 | TAG_SYNC_RECV_FILE, |
| 53 | TAG_SYNC_SEND_FILE, |
| 54 | TAG_APP_PROCESS_START, |
| 55 | TAG_KEYGUARD_DISMISSED, |
| 56 | TAG_KEYGUARD_DISMISS_AUTH_ATTEMPT, |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 57 | TAG_KEYGUARD_SECURED, |
| 58 | TAG_OS_STARTUP, |
| 59 | TAG_OS_SHUTDOWN, |
| 60 | TAG_LOGGING_STARTED, |
| 61 | TAG_LOGGING_STOPPED, |
| 62 | TAG_MEDIA_MOUNT, |
| 63 | TAG_MEDIA_UNMOUNT, |
| 64 | TAG_LOG_BUFFER_SIZE_CRITICAL, |
| 65 | TAG_PASSWORD_EXPIRATION_SET, |
| 66 | TAG_PASSWORD_COMPLEXITY_SET, |
| 67 | TAG_PASSWORD_HISTORY_LENGTH_SET, |
| 68 | TAG_MAX_SCREEN_LOCK_TIMEOUT_SET, |
| 69 | TAG_MAX_PASSWORD_ATTEMPTS_SET, |
| 70 | TAG_KEYGUARD_DISABLED_FEATURES_SET, |
| 71 | TAG_REMOTE_LOCK, |
| 72 | TAG_USER_RESTRICTION_ADDED, |
| 73 | TAG_USER_RESTRICTION_REMOVED, |
| 74 | TAG_WIPE_FAILURE, |
| 75 | TAG_KEY_GENERATED, |
| 76 | TAG_KEY_IMPORT, |
| 77 | TAG_KEY_DESTRUCTION, |
| 78 | TAG_CERT_AUTHORITY_INSTALLED, |
| 79 | TAG_CERT_AUTHORITY_REMOVED, |
Jeff Sharkey | ce8db99 | 2017-12-13 20:05:05 -0700 | [diff] [blame] | 80 | }) |
| 81 | public @interface SecurityLogTag {} |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 82 | |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 83 | /** @hide */ |
| 84 | @Retention(RetentionPolicy.SOURCE) |
| 85 | @IntDef(prefix = { "LEVEL_" }, value = { |
| 86 | LEVEL_INFO, |
| 87 | LEVEL_WARNING, |
| 88 | LEVEL_ERROR |
| 89 | }) |
| 90 | public @interface SecurityLogLevel {} |
| 91 | |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 92 | /** |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 93 | * Indicates that an ADB interactive shell was opened via "adb shell". |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 94 | * There is no extra payload in the log event. |
| 95 | */ |
| 96 | public static final int TAG_ADB_SHELL_INTERACTIVE = |
| 97 | SecurityLogTags.SECURITY_ADB_SHELL_INTERACTIVE; |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 98 | |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 99 | /** |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 100 | * Indicates that a shell command was issued over ADB via {@code adb shell <command>} |
| 101 | * The log entry contains a {@code String} payload containing the shell command, accessible |
| 102 | * via {@link SecurityEvent#getData()}. |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 103 | */ |
| 104 | public static final int TAG_ADB_SHELL_CMD = SecurityLogTags.SECURITY_ADB_SHELL_COMMAND; |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 105 | |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 106 | /** |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 107 | * Indicates that a file was pulled from the device via the adb daemon, for example via |
| 108 | * {@code adb pull}. The log entry contains a {@code String} payload containing the path of the |
| 109 | * pulled file on the device, accessible via {@link SecurityEvent#getData()}. |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 110 | */ |
| 111 | public static final int TAG_SYNC_RECV_FILE = SecurityLogTags.SECURITY_ADB_SYNC_RECV; |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 112 | |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 113 | /** |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 114 | * Indicates that a file was pushed to the device via the adb daemon, for example via |
| 115 | * {@code adb push}. The log entry contains a {@code String} payload containing the destination |
| 116 | * path of the pushed file, accessible via {@link SecurityEvent#getData()}. |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 117 | */ |
| 118 | public static final int TAG_SYNC_SEND_FILE = SecurityLogTags.SECURITY_ADB_SYNC_SEND; |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 119 | |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 120 | /** |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 121 | * Indicates that an app process was started. The log entry contains the following |
Rubin Xu | 232990d | 2016-02-18 15:55:21 +0000 | [diff] [blame] | 122 | * information about the process encapsulated in an {@link Object} array, accessible via |
| 123 | * {@link SecurityEvent#getData()}: |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 124 | * <li> [0] process name ({@code String}) |
| 125 | * <li> [1] exact start time in milliseconds according to {@code System.currentTimeMillis()} |
| 126 | * ({@code Long}) |
| 127 | * <li> [2] app uid ({@code Integer}) |
| 128 | * <li> [3] app pid ({@code Integer}) |
| 129 | * <li> [4] seinfo tag ({@code String}) |
| 130 | * <li> [5] SHA-256 hash of the base APK in hexadecimal ({@code String}) |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 131 | */ |
| 132 | public static final int TAG_APP_PROCESS_START = SecurityLogTags.SECURITY_APP_PROCESS_START; |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 133 | |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 134 | /** |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 135 | * Indicates that keyguard has been dismissed. |
Michal Karpinski | 31502d3 | 2016-01-25 16:43:07 +0000 | [diff] [blame] | 136 | * There is no extra payload in the log event. |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 137 | */ |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 138 | public static final int TAG_KEYGUARD_DISMISSED = SecurityLogTags.SECURITY_KEYGUARD_DISMISSED; |
| 139 | |
Michal Karpinski | 31502d3 | 2016-01-25 16:43:07 +0000 | [diff] [blame] | 140 | /** |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 141 | * Indicates that there has been an authentication attempt to dismiss the keyguard. The log |
| 142 | * entry contains the following information about the attempt encapsulated in an {@link Object} |
| 143 | * array, accessible via {@link SecurityEvent#getData()}: |
| 144 | * <li> [0] attempt result ({@code Integer}, 1 for successful, 0 for unsuccessful) |
| 145 | * <li> [1] strength of authentication method ({@code Integer}, 1 if strong authentication |
| 146 | * method was used, 0 otherwise) |
Michal Karpinski | 31502d3 | 2016-01-25 16:43:07 +0000 | [diff] [blame] | 147 | */ |
| 148 | public static final int TAG_KEYGUARD_DISMISS_AUTH_ATTEMPT = |
| 149 | SecurityLogTags.SECURITY_KEYGUARD_DISMISS_AUTH_ATTEMPT; |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 150 | |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 151 | /** |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 152 | * Indicates that the device has been locked, either by the user or by a timeout. There is no |
| 153 | * extra payload in the log event. |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 154 | */ |
Michal Karpinski | 31502d3 | 2016-01-25 16:43:07 +0000 | [diff] [blame] | 155 | public static final int TAG_KEYGUARD_SECURED = SecurityLogTags.SECURITY_KEYGUARD_SECURED; |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 156 | |
| 157 | /** |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 158 | * Indicates that the Android OS has started. The log entry contains the following information |
| 159 | * about the startup time software integrity check encapsulated in an {@link Object} array, |
| 160 | * accessible via {@link SecurityEvent#getData()}: |
| 161 | * <li> [0] Verified Boot state ({@code String}) |
| 162 | * <li> [1] dm-verity mode ({@code String}). |
| 163 | * <p>Verified Boot state can be one of the following: |
| 164 | * <li> {@code green} indicates that there is a full chain of trust extending from the |
| 165 | * bootloader to verified partitions including the bootloader, boot partition, and all verified |
| 166 | * partitions. |
| 167 | * <li> {@code yellow} indicates that the boot partition has been verified using the embedded |
| 168 | * certificate and the signature is valid. |
| 169 | * <li> {@code orange} indicates that the device may be freely modified. Device integrity is |
| 170 | * left to the user to verify out-of-band. |
| 171 | * <p>dm-verity mode can be one of the following: |
| 172 | * <li> {@code enforcing} indicates that the device will be restarted when corruption is |
| 173 | * detected. |
| 174 | * <li> {@code eio} indicates that an I/O error will be returned for an attempt to read |
| 175 | * corrupted data blocks. |
| 176 | * For details see Verified Boot documentation. |
| 177 | */ |
| 178 | public static final int TAG_OS_STARTUP = SecurityLogTags.SECURITY_OS_STARTUP; |
| 179 | |
| 180 | /** |
| 181 | * Indicates that the Android OS has shutdown. There is no extra payload in the log event. |
| 182 | */ |
| 183 | public static final int TAG_OS_SHUTDOWN = SecurityLogTags.SECURITY_OS_SHUTDOWN; |
| 184 | |
| 185 | /** |
| 186 | * Indicates start-up of audit logging. There is no extra payload in the log event. |
| 187 | */ |
| 188 | public static final int TAG_LOGGING_STARTED = SecurityLogTags.SECURITY_LOGGING_STARTED; |
| 189 | |
| 190 | /** |
| 191 | * Indicates shutdown of audit logging. There is no extra payload in the log event. |
| 192 | */ |
| 193 | public static final int TAG_LOGGING_STOPPED = SecurityLogTags.SECURITY_LOGGING_STOPPED; |
| 194 | |
| 195 | /** |
| 196 | * Indicates that removable media has been mounted on the device. The log entry contains the |
| 197 | * following information about the event, encapsulated in an {@link Object} array and |
| 198 | * accessible via {@link SecurityEvent#getData()}: |
| 199 | * <li> [0] mount point ({@code String}) |
| 200 | * <li> [1] volume label ({@code String}). |
| 201 | */ |
| 202 | public static final int TAG_MEDIA_MOUNT = SecurityLogTags.SECURITY_MEDIA_MOUNTED; |
| 203 | |
| 204 | /** |
| 205 | * Indicates that removable media was unmounted from the device. The log entry contains the |
| 206 | * following information about the event, encapsulated in an {@link Object} array and |
| 207 | * accessible via {@link SecurityEvent#getData()}: |
| 208 | * <li> [0] mount point ({@code String}) |
| 209 | * <li> [1] volume label ({@code String}). |
| 210 | */ |
| 211 | public static final int TAG_MEDIA_UNMOUNT = SecurityLogTags.SECURITY_MEDIA_UNMOUNTED; |
| 212 | |
| 213 | /** |
| 214 | * Indicates that the audit log buffer has reached 90% of its capacity. There is no extra |
| 215 | * payload in the log event. |
| 216 | */ |
| 217 | public static final int TAG_LOG_BUFFER_SIZE_CRITICAL = |
| 218 | SecurityLogTags.SECURITY_LOG_BUFFER_SIZE_CRITICAL; |
| 219 | |
| 220 | /** |
| 221 | * Indicates that an admin has set a password expiration timeout. The log entry contains the |
| 222 | * following information about the event, encapsulated in an {@link Object} array and accessible |
| 223 | * via {@link SecurityEvent#getData()}: |
| 224 | * <li> [0] admin package name ({@code String}) |
| 225 | * <li> [1] admin user ID ({@code Integer}) |
| 226 | * <li> [2] target user ID ({@code Integer}) |
| 227 | * <li> [3] new password expiration timeout in milliseconds ({@code Long}). |
| 228 | * @see DevicePolicyManager#setPasswordExpirationTimeout(ComponentName, long) |
| 229 | */ |
| 230 | public static final int TAG_PASSWORD_EXPIRATION_SET = |
| 231 | SecurityLogTags.SECURITY_PASSWORD_EXPIRATION_SET; |
| 232 | |
| 233 | /** |
| 234 | * Indicates that an admin has set a requirement for password complexity. The log entry contains |
| 235 | * the following information about the event, encapsulated in an {@link Object} array and |
| 236 | * accessible via {@link SecurityEvent#getData()}: |
| 237 | * <li> [0] admin package name ({@code String}) |
| 238 | * <li> [1] admin user ID ({@code Integer}) |
| 239 | * <li> [2] target user ID ({@code Integer}) |
| 240 | * <li> [3] minimum password length ({@code Integer}) |
| 241 | * <li> [4] password quality constraint ({@code Integer}) |
| 242 | * <li> [5] minimum number of letters ({@code Integer}) |
| 243 | * <li> [6] minimum number of non-letters ({@code Integer}) |
| 244 | * <li> [7] minimum number of digits ({@code Integer}) |
| 245 | * <li> [8] minimum number of uppercase letters ({@code Integer}) |
| 246 | * <li> [9] minimum number of lowercase letters ({@code Integer}) |
| 247 | * <li> [10] minimum number of symbols ({@code Integer}) |
| 248 | * |
| 249 | * @see DevicePolicyManager#setPasswordMinimumLength(ComponentName, int) |
| 250 | * @see DevicePolicyManager#setPasswordQuality(ComponentName, int) |
| 251 | * @see DevicePolicyManager#setPasswordMinimumLetters(ComponentName, int) |
| 252 | * @see DevicePolicyManager#setPasswordMinimumNonLetter(ComponentName, int) |
| 253 | * @see DevicePolicyManager#setPasswordMinimumLowerCase(ComponentName, int) |
| 254 | * @see DevicePolicyManager#setPasswordMinimumUpperCase(ComponentName, int) |
| 255 | * @see DevicePolicyManager#setPasswordMinimumNumeric(ComponentName, int) |
| 256 | * @see DevicePolicyManager#setPasswordMinimumSymbols(ComponentName, int) |
| 257 | */ |
| 258 | public static final int TAG_PASSWORD_COMPLEXITY_SET = |
| 259 | SecurityLogTags.SECURITY_PASSWORD_COMPLEXITY_SET; |
| 260 | |
| 261 | /** |
| 262 | * Indicates that an admin has set a password history length. The log entry contains the |
| 263 | * following information about the event encapsulated in an {@link Object} array, accessible |
| 264 | * via {@link SecurityEvent#getData()}: |
| 265 | * <li> [0] admin package name ({@code String}) |
| 266 | * <li> [1] admin user ID ({@code Integer}) |
| 267 | * <li> [2] target user ID ({@code Integer}) |
| 268 | * <li> [3] new password history length value ({@code Integer}) |
| 269 | * @see DevicePolicyManager#setPasswordHistoryLength(ComponentName, int) |
| 270 | */ |
| 271 | public static final int TAG_PASSWORD_HISTORY_LENGTH_SET = |
| 272 | SecurityLogTags.SECURITY_PASSWORD_HISTORY_LENGTH_SET; |
| 273 | |
| 274 | /** |
| 275 | * Indicates that an admin has set a maximum screen lock timeout. The log entry contains the |
| 276 | * following information about the event encapsulated in an {@link Object} array, accessible |
| 277 | * via {@link SecurityEvent#getData()}: |
| 278 | * <li> [0] admin package name ({@code String}) |
| 279 | * <li> [1] admin user ID ({@code Integer}) |
| 280 | * <li> [2] target user ID ({@code Integer}) |
| 281 | * <li> [3] new screen lock timeout in milliseconds ({@code Long}) |
| 282 | * @see DevicePolicyManager#setMaximumTimeToLock(ComponentName, long) |
| 283 | */ |
| 284 | public static final int TAG_MAX_SCREEN_LOCK_TIMEOUT_SET = |
| 285 | SecurityLogTags.SECURITY_MAX_SCREEN_LOCK_TIMEOUT_SET; |
| 286 | |
| 287 | /** |
| 288 | * Indicates that an admin has set a maximum number of failed password attempts before wiping |
| 289 | * data. The log entry contains the following information about the event encapsulated in an |
| 290 | * {@link Object} array, accessible via {@link SecurityEvent#getData()}: |
| 291 | * <li> [0] admin package name ({@code String}) |
| 292 | * <li> [1] admin user ID ({@code Integer}) |
| 293 | * <li> [2] target user ID ({@code Integer}) |
| 294 | * <li> [3] new maximum number of failed password attempts ({@code Integer}) |
| 295 | * @see DevicePolicyManager#setMaximumTimeToLock(ComponentName, long) |
| 296 | */ |
| 297 | public static final int TAG_MAX_PASSWORD_ATTEMPTS_SET = |
| 298 | SecurityLogTags.SECURITY_MAX_PASSWORD_ATTEMPTS_SET; |
| 299 | |
| 300 | /** |
| 301 | * Indicates that an admin has set disabled keyguard features. The log entry contains the |
| 302 | * following information about the event encapsulated in an {@link Object} array, accessible via |
| 303 | * {@link SecurityEvent#getData()}: |
| 304 | * <li> [0] admin package name ({@code String}) |
| 305 | * <li> [1] admin user ID ({@code Integer}) |
| 306 | * <li> [2] target user ID ({@code Integer}) |
| 307 | * <li> [3] disabled keyguard feature mask ({@code Integer}). |
| 308 | * @see DevicePolicyManager#setKeyguardDisabledFeatures(ComponentName, int) |
| 309 | */ |
| 310 | public static final int TAG_KEYGUARD_DISABLED_FEATURES_SET = |
| 311 | SecurityLogTags.SECURITY_KEYGUARD_DISABLED_FEATURES_SET; |
| 312 | |
| 313 | /** |
| 314 | * Indicates that an admin remotely locked the device or profile. The log entry contains the |
| 315 | * following information about the event encapsulated in an {@link Object} array, accessible via |
| 316 | * {@link SecurityEvent#getData()}: |
| 317 | * <li> [0] admin package name ({@code String}), |
| 318 | * <li> [1] admin user ID ({@code Integer}). |
| 319 | */ |
| 320 | public static final int TAG_REMOTE_LOCK = SecurityLogTags.SECURITY_REMOTE_LOCK; |
| 321 | |
| 322 | /** |
| 323 | * Indicates a failure to wipe device or user data. There is no extra payload in the log event. |
| 324 | */ |
| 325 | public static final int TAG_WIPE_FAILURE = SecurityLogTags.SECURITY_WIPE_FAILED; |
| 326 | |
| 327 | /** |
| 328 | * Indicates that an authentication key was generated. The log entry contains the following |
| 329 | * information about the event, encapsulated in an {@link Object} array and accessible via |
| 330 | * {@link SecurityEvent#getData()}: |
| 331 | * <li> [0] result ({@code Integer}, 0 if operation failed, 1 if succeeded) |
| 332 | * <li> [1] alias of the key ({@code String}) |
| 333 | * <li> [2] requesting process uid ({@code Integer}). |
| 334 | */ |
| 335 | public static final int TAG_KEY_GENERATED = |
| 336 | SecurityLogTags.SECURITY_KEY_GENERATED; |
| 337 | |
| 338 | /** |
| 339 | * Indicates that a cryptographic key was imported. The log entry contains the following |
| 340 | * information about the event, encapsulated in an {@link Object} array and accessible via |
| 341 | * {@link SecurityEvent#getData()}: |
| 342 | * <li> [0] result ({@code Integer}, 0 if operation failed, 1 if succeeded) |
| 343 | * <li> [1] alias of the key ({@code String}) |
| 344 | * <li> [2] requesting process uid ({@code Integer}). |
| 345 | */ |
| 346 | public static final int TAG_KEY_IMPORT = SecurityLogTags.SECURITY_KEY_IMPORTED; |
| 347 | |
| 348 | /** |
| 349 | * Indicates that a cryptographic key was destroyed. The log entry contains the following |
| 350 | * information about the event, encapsulated in an {@link Object} array and accessible via |
| 351 | * {@link SecurityEvent#getData()}: |
| 352 | * <li> [0] result ({@code Integer}, 0 if operation failed, 1 if succeeded) |
| 353 | * <li> [1] alias of the key ({@code String}) |
| 354 | * <li> [2] requesting process uid ({@code Integer}). |
| 355 | */ |
| 356 | public static final int TAG_KEY_DESTRUCTION = SecurityLogTags.SECURITY_KEY_DESTROYED; |
| 357 | |
| 358 | /** |
| 359 | * Indicates that a new root certificate has been installed into system's trusted credential |
| 360 | * storage. The log entry contains the following information about the event, encapsulated in an |
| 361 | * {@link Object} array and accessible via {@link SecurityEvent#getData()}: |
| 362 | * <li> [0] result ({@code Integer}, 0 if operation failed, 1 if succeeded) |
| 363 | * <li> [1] subject of the certificate ({@code String}). |
| 364 | */ |
| 365 | public static final int TAG_CERT_AUTHORITY_INSTALLED = |
| 366 | SecurityLogTags.SECURITY_CERT_AUTHORITY_INSTALLED; |
| 367 | |
| 368 | /** |
| 369 | * Indicates that a new oot certificate has been removed from system's trusted credential |
| 370 | * storage. The log entry contains the following information about the event, encapsulated in an |
| 371 | * {@link Object} array and accessible via {@link SecurityEvent#getData()}: |
| 372 | * <li> [0] result ({@code Integer}, 0 if operation failed, 1 if succeeded) |
| 373 | * <li> [1] subject of the certificate ({@code String}). |
| 374 | */ |
| 375 | public static final int TAG_CERT_AUTHORITY_REMOVED = |
| 376 | SecurityLogTags.SECURITY_CERT_AUTHORITY_REMOVED; |
| 377 | |
| 378 | /** |
| 379 | * Indicates that an admin has set a user restriction. The log entry contains the following |
| 380 | * information about the event, encapsulated in an {@link Object} array and accessible via |
| 381 | * {@link SecurityEvent#getData()}: |
| 382 | * <li> [0] admin package name ({@code String}) |
| 383 | * <li> [1] admin user ID ({@code Integer}) |
| 384 | * <li> [2] user restriction ({@code String}) |
| 385 | * @see DevicePolicyManager#addUserRestriction(ComponentName, String) |
| 386 | */ |
| 387 | public static final int TAG_USER_RESTRICTION_ADDED = |
| 388 | SecurityLogTags.SECURITY_USER_RESTRICTION_ADDED; |
| 389 | |
| 390 | /** |
| 391 | * Indicates that an admin has removed a user restriction. The log entry contains the following |
| 392 | * information about the event, encapsulated in an {@link Object} array and accessible via |
| 393 | * {@link SecurityEvent#getData()}: |
| 394 | * <li> [0] admin package name ({@code String}) |
| 395 | * <li> [1] admin user ID ({@code Integer}) |
| 396 | * <li> [2] user restriction ({@code String}) |
| 397 | * @see DevicePolicyManager#clearUserRestriction(ComponentName, String) |
| 398 | */ |
| 399 | public static final int TAG_USER_RESTRICTION_REMOVED = |
| 400 | SecurityLogTags.SECURITY_USER_RESTRICTION_REMOVED; |
| 401 | |
| 402 | /** |
| 403 | * Event severity level indicating that the event corresponds to normal workflow. |
| 404 | */ |
| 405 | public static final int LEVEL_INFO = 1; |
| 406 | |
| 407 | /** |
| 408 | * Event severity level indicating that the event may require admin attention. |
| 409 | */ |
| 410 | public static final int LEVEL_WARNING = 2; |
| 411 | |
| 412 | /** |
| 413 | * Event severity level indicating that the event requires urgent admin action. |
| 414 | */ |
| 415 | public static final int LEVEL_ERROR = 3; |
| 416 | |
| 417 | /** |
Michal Karpinski | 6235a94 | 2016-03-15 12:07:23 +0000 | [diff] [blame] | 418 | * Returns if security logging is enabled. Log producers should only write new logs if this is |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 419 | * true. Under the hood this is the logical AND of whether device owner exists and whether |
| 420 | * it enables logging by setting the system property {@link #PROPERTY_LOGGING_ENABLED}. |
| 421 | * @hide |
| 422 | */ |
| 423 | public static native boolean isLoggingEnabled(); |
| 424 | |
| 425 | /** |
| 426 | * @hide |
| 427 | */ |
| 428 | public static void setLoggingEnabledProperty(boolean enabled) { |
| 429 | SystemProperties.set(PROPERTY_LOGGING_ENABLED, enabled ? "true" : "false"); |
| 430 | } |
| 431 | |
| 432 | /** |
| 433 | * @hide |
| 434 | */ |
| 435 | public static boolean getLoggingEnabledProperty() { |
| 436 | return SystemProperties.getBoolean(PROPERTY_LOGGING_ENABLED, false); |
| 437 | } |
| 438 | |
| 439 | /** |
| 440 | * A class representing a security event log entry. |
| 441 | */ |
Jeff Sharkey | 50d1c04 | 2016-02-29 16:34:46 -0700 | [diff] [blame] | 442 | public static final class SecurityEvent implements Parcelable { |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 443 | private Event mEvent; |
Naomi Musgrave | db980f4 | 2017-11-28 10:56:47 +0000 | [diff] [blame] | 444 | private long mId; |
| 445 | |
| 446 | /** |
| 447 | * Constructor used by native classes to generate SecurityEvent instances. |
| 448 | * @hide |
| 449 | */ |
| 450 | /* package */ SecurityEvent(byte[] data) { |
| 451 | this(0, data); |
| 452 | } |
| 453 | |
| 454 | /** |
| 455 | * Constructor used by Parcelable.Creator to generate SecurityEvent instances. |
| 456 | * @hide |
| 457 | */ |
| 458 | /* package */ SecurityEvent(Parcel source) { |
| 459 | this(source.readLong(), source.createByteArray()); |
| 460 | } |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 461 | |
| 462 | /** @hide */ |
Naomi Musgrave | db980f4 | 2017-11-28 10:56:47 +0000 | [diff] [blame] | 463 | @TestApi |
| 464 | public SecurityEvent(long id, byte[] data) { |
| 465 | mId = id; |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 466 | mEvent = Event.fromBytes(data); |
| 467 | } |
| 468 | |
| 469 | /** |
| 470 | * Returns the timestamp in nano seconds when this event was logged. |
| 471 | */ |
| 472 | public long getTimeNanos() { |
| 473 | return mEvent.getTimeNanos(); |
| 474 | } |
| 475 | |
| 476 | /** |
| 477 | * Returns the tag of this log entry, which specifies entry's semantics. |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 478 | */ |
Jeff Sharkey | ce8db99 | 2017-12-13 20:05:05 -0700 | [diff] [blame] | 479 | public @SecurityLogTag int getTag() { |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 480 | return mEvent.getTag(); |
| 481 | } |
| 482 | |
| 483 | /** |
Pavel Grafov | 739cda8 | 2017-02-02 12:41:20 +0000 | [diff] [blame] | 484 | * Returns the payload contained in this log entry or {@code null} if there is no payload. |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 485 | */ |
| 486 | public Object getData() { |
| 487 | return mEvent.getData(); |
| 488 | } |
| 489 | |
Naomi Musgrave | db980f4 | 2017-11-28 10:56:47 +0000 | [diff] [blame] | 490 | /** |
| 491 | * @hide |
| 492 | */ |
| 493 | public void setId(long id) { |
| 494 | this.mId = id; |
| 495 | } |
| 496 | |
| 497 | /** |
| 498 | * Returns the id of the event, where the id monotonically increases for each event. The id |
| 499 | * is reset when the device reboots, and when security logging is enabled. |
| 500 | */ |
| 501 | public long getId() { |
| 502 | return mId; |
| 503 | } |
| 504 | |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 505 | /** |
| 506 | * Returns severity level for the event. |
| 507 | */ |
| 508 | public @SecurityLogLevel int getLogLevel() { |
| 509 | switch (mEvent.getTag()) { |
| 510 | case TAG_ADB_SHELL_INTERACTIVE: |
| 511 | case TAG_ADB_SHELL_CMD: |
| 512 | case TAG_SYNC_RECV_FILE: |
| 513 | case TAG_SYNC_SEND_FILE: |
| 514 | case TAG_APP_PROCESS_START: |
| 515 | case TAG_KEYGUARD_DISMISSED: |
| 516 | case TAG_KEYGUARD_SECURED: |
| 517 | case TAG_OS_STARTUP: |
| 518 | case TAG_OS_SHUTDOWN: |
| 519 | case TAG_LOGGING_STARTED: |
| 520 | case TAG_LOGGING_STOPPED: |
| 521 | case TAG_MEDIA_MOUNT: |
| 522 | case TAG_MEDIA_UNMOUNT: |
| 523 | case TAG_PASSWORD_EXPIRATION_SET: |
| 524 | case TAG_PASSWORD_COMPLEXITY_SET: |
| 525 | case TAG_PASSWORD_HISTORY_LENGTH_SET: |
| 526 | case TAG_MAX_SCREEN_LOCK_TIMEOUT_SET: |
| 527 | case TAG_MAX_PASSWORD_ATTEMPTS_SET: |
| 528 | case TAG_USER_RESTRICTION_ADDED: |
| 529 | case TAG_USER_RESTRICTION_REMOVED: |
| 530 | return LEVEL_INFO; |
| 531 | case TAG_CERT_AUTHORITY_REMOVED: |
| 532 | return getSuccess() ? LEVEL_INFO : LEVEL_ERROR; |
| 533 | case TAG_CERT_AUTHORITY_INSTALLED: |
| 534 | case TAG_KEYGUARD_DISMISS_AUTH_ATTEMPT: |
| 535 | case TAG_KEY_IMPORT: |
| 536 | case TAG_KEY_DESTRUCTION: |
| 537 | case TAG_KEY_GENERATED: |
| 538 | return getSuccess() ? LEVEL_INFO : LEVEL_WARNING; |
| 539 | case TAG_LOG_BUFFER_SIZE_CRITICAL: |
| 540 | case TAG_WIPE_FAILURE: |
| 541 | return LEVEL_ERROR; |
| 542 | default: |
| 543 | return LEVEL_INFO; |
| 544 | } |
| 545 | } |
| 546 | |
| 547 | // Success/failure if present is encoded as an integer in the first (0th) element of data. |
| 548 | private boolean getSuccess() { |
| 549 | final Object data = getData(); |
| 550 | if (data == null || !(data instanceof Object[])) { |
| 551 | return false; |
| 552 | } |
| 553 | |
| 554 | final Object[] array = (Object[]) data; |
| 555 | return array.length >= 1 && array[0] instanceof Integer && (Integer) array[0] != 0; |
| 556 | } |
| 557 | |
| 558 | |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 559 | @Override |
| 560 | public int describeContents() { |
| 561 | return 0; |
| 562 | } |
| 563 | |
| 564 | @Override |
| 565 | public void writeToParcel(Parcel dest, int flags) { |
Naomi Musgrave | db980f4 | 2017-11-28 10:56:47 +0000 | [diff] [blame] | 566 | dest.writeLong(mId); |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 567 | dest.writeByteArray(mEvent.getBytes()); |
| 568 | } |
| 569 | |
| 570 | public static final Parcelable.Creator<SecurityEvent> CREATOR = |
| 571 | new Parcelable.Creator<SecurityEvent>() { |
| 572 | @Override |
| 573 | public SecurityEvent createFromParcel(Parcel source) { |
Naomi Musgrave | db980f4 | 2017-11-28 10:56:47 +0000 | [diff] [blame] | 574 | return new SecurityEvent(source); |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 575 | } |
| 576 | |
| 577 | @Override |
| 578 | public SecurityEvent[] newArray(int size) { |
| 579 | return new SecurityEvent[size]; |
| 580 | } |
| 581 | }; |
Pavel Grafov | 4ce59d4 | 2017-02-25 19:45:43 +0000 | [diff] [blame] | 582 | |
| 583 | /** |
| 584 | * @hide |
| 585 | */ |
| 586 | @Override |
| 587 | public boolean equals(Object o) { |
| 588 | if (this == o) return true; |
| 589 | if (o == null || getClass() != o.getClass()) return false; |
| 590 | SecurityEvent other = (SecurityEvent) o; |
Naomi Musgrave | db980f4 | 2017-11-28 10:56:47 +0000 | [diff] [blame] | 591 | return mEvent.equals(other.mEvent) && mId == other.mId; |
Pavel Grafov | 4ce59d4 | 2017-02-25 19:45:43 +0000 | [diff] [blame] | 592 | } |
| 593 | |
| 594 | /** |
| 595 | * @hide |
| 596 | */ |
| 597 | @Override |
| 598 | public int hashCode() { |
Naomi Musgrave | db980f4 | 2017-11-28 10:56:47 +0000 | [diff] [blame] | 599 | return Objects.hash(mEvent, mId); |
Pavel Grafov | 4ce59d4 | 2017-02-25 19:45:43 +0000 | [diff] [blame] | 600 | } |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 601 | } |
| 602 | /** |
| 603 | * Retrieve all security logs and return immediately. |
| 604 | * @hide |
| 605 | */ |
| 606 | public static native void readEvents(Collection<SecurityEvent> output) throws IOException; |
| 607 | |
| 608 | /** |
| 609 | * Retrieve all security logs since the given timestamp in nanoseconds and return immediately. |
| 610 | * @hide |
| 611 | */ |
| 612 | public static native void readEventsSince(long timestamp, Collection<SecurityEvent> output) |
| 613 | throws IOException; |
| 614 | |
| 615 | /** |
| 616 | * Retrieve all security logs before the last reboot. May return corrupted data due to |
| 617 | * unreliable pstore. |
| 618 | * @hide |
| 619 | */ |
| 620 | public static native void readPreviousEvents(Collection<SecurityEvent> output) |
| 621 | throws IOException; |
| 622 | |
| 623 | /** |
Pavel Grafov | ce72ef0 | 2018-01-10 17:14:11 +0000 | [diff] [blame] | 624 | * Retrieve all security logs whose timestamp is equal to or greater than the given timestamp in |
| 625 | * nanoseconds. This method will block until either the last log earlier than the given |
Rubin Xu | 75431fb | 2016-01-07 21:12:14 +0000 | [diff] [blame] | 626 | * timestamp is about to be pruned, or after a 2-hour timeout has passed. |
| 627 | * @hide |
| 628 | */ |
| 629 | public static native void readEventsOnWrapping(long timestamp, Collection<SecurityEvent> output) |
| 630 | throws IOException; |
| 631 | |
| 632 | /** |
| 633 | * Write a log entry to the underlying storage, with a string payload. |
| 634 | * @hide |
| 635 | */ |
| 636 | public static native int writeEvent(int tag, String str); |
| 637 | |
| 638 | /** |
| 639 | * Write a log entry to the underlying storage, with several payloads. |
| 640 | * Supported types of payload are: integer, long, float, string plus array of supported types. |
| 641 | * @hide |
| 642 | */ |
| 643 | public static native int writeEvent(int tag, Object... payloads); |
| 644 | } |