Disallow Blank App Package Name on Q and Later

(This is a merge of http://go/wvgerrit/78105)

The Widevine Android CDM should not allow itself to be instantiated
without an app package name, as this breaks SPOID protection.
Unfortunately, pathways exist prior to Android Q that allow this to
happen, and we cannot break these devices by changing the behavior now.
As such, we will only refuse to allow instantiation without an app
package name on devices first launched with Q and later.

This change also migrates the WVDrmFactory and its tests away from
explicitly naming friend classes for individual test, in favor of the
now-recommended "test peer" pattern.

Bug: 65680731
Test: libwvdrmengine_hidl_test
Test: CTS NativeMediaDrmClearkeyTest
Change-Id: Icccd1d8b9972ef6ad7e5b0dbf2d37ec987656385
This commit is contained in:
John W. Bruce
2019-05-03 20:32:52 -07:00
committed by John Bruce
parent a1e94e2eb1
commit edccc13510
3 changed files with 43 additions and 3 deletions

View File

@@ -71,6 +71,13 @@ Return<void> WVDrmFactory::createPlugin(
return Void();
}
if (!isBlankAppPackageNameAllowed() && appPackageName.empty()) {
ALOGE("Widevine Drm HAL: Failed to create DRM Plugin, blank App Package "
"Name disallowed.");
_hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, plugin);
return Void();
}
plugin = new WVDrmPlugin(getCDM(), appPackageName.c_str(),
&sOemCryptoInterface, areSpoidsEnabled());
_hidl_cb(Status::OK, plugin);
@@ -78,6 +85,14 @@ Return<void> WVDrmFactory::createPlugin(
}
bool WVDrmFactory::areSpoidsEnabled() {
return firstApiLevel() >= 26; // Android O
}
bool WVDrmFactory::isBlankAppPackageNameAllowed() {
return firstApiLevel() < 29; // Android Q
}
int32_t WVDrmFactory::firstApiLevel() {
// Check what this device's first API level was.
int32_t firstApiLevel =
android::base::GetIntProperty<int32_t>("ro.product.first_api_level", 0);
@@ -87,7 +102,7 @@ bool WVDrmFactory::areSpoidsEnabled() {
firstApiLevel =
android::base::GetIntProperty<int32_t>("ro.build.version.sdk", 0);
}
return firstApiLevel >= 26; // Android O
return firstApiLevel;
}