* changes:
Fix issue with shared user permissions. just look in the requested permissions of packages within shared user setting rather than the granted permissions
kernel randomness pool. This helps increase the
quality / uniqueness of the random numbers, and is especially
important during the device's first boot, when insufficient
randomness is available.
We now record the version number of the app (drawn from its manifest versionCode
attribute) along with its signatures. At restore time, we compare the version
associated with the restore set with the version present on the device. If the
restore set is from a newer version of the app than is present on device, we do
not perform the restore operation.
Also fix the pending-backup iteration in 'dumpsys backup'.
Adds support for system properties:
ro.error.receiver.system.apps - default error report receiver for system apps
ro.error.receiver.default - fallback error report receiver
Merge commit 'fd5f087536dcb04ac9c46f2b19f87a37455390b0'
* commit 'fd5f087536dcb04ac9c46f2b19f87a37455390b0':
Make signature checks on restore work with unsigned apps
On restore now, the backup manager gets the signature blocks corresponding to
the restore set from the transport. It then validates those signatures against
the on-device app signatures, and refuses to restore data to an app whose
on-device sig block does not match the backup image's.
Also actually implement 'bmgr transport N' so that we can select the local
transport easily during runtime.
- Fix a bug where targetSdkVersion could not be set if minSdkVersion. Stupid, stupid.
Also make sure to fail if minSdkVersion is for a code name. Really stupid.
- Change the API for resize compatibility mode to be a bit in the flags field, instead
of a separate boolean.
- Implement delayed dexopting, to avoid the looong full dexopt during boot. This is
only enabled for "eng" builds. When in this mode, the activity manager will make
sure that a dexopt has been done before loading an .apk into a process, and will
try to avoid displaying ANRs if they are due to the dexopt causing some operation
to take longer than it normally would (though I make no guarantees about this
totally working).
- Add API to Context to get the ApplicationInfo for its package, for easy access to
things like targetSdkVersion.
Merge commit '167dbe0bf1f8d807d1ced400f146b7780eb6c721'
* commit '167dbe0bf1f8d807d1ced400f146b7780eb6c721':
Update RandomBlock to use RandomAccessFile. This helps
* changes:
Update RandomBlock to use RandomAccessFile. This helps prevent certain unusual conditions from corrupting the entropy file. (for example, if Android should happen to crash while a write is in progress)
Merge commit '07eac016446c63711bebe6e553e98c02d1fe55a5'
* commit '07eac016446c63711bebe6e553e98c02d1fe55a5':
Store the app signatures as part of the backup set
Under a pseudo-app for the Package Manager, we store the app signatures for all
participating applications installed on the device. At restore time we will
restore this first, then ensure that the current on-device signature chain is
compatible with the one in the backup set. If there's a mismatch, this may be a
spoof attempt and we will refuse to restore that app's data.
The restore side of this is not implemented, but the Package Manager agent is
here as well as the backup side theoretically pushing the data now.
Merge commit '5ad76ef5ee1b437b4c07ed0be78ec7cc16c81dfe'
* commit '5ad76ef5ee1b437b4c07ed0be78ec7cc16c81dfe':
load entropy data at boot. Periodically write entropy data to disk.
Merge commit 'c14b9ccdf13163cae5ce5d21bcf377010b37594b'
* commit 'c14b9ccdf13163cae5ce5d21bcf377010b37594b':
Extend Intent/Uri conversion for use by Browser
Merge commit '3c2f8e6651178742bc685e7bd62fa8a6ca409a74'
* commit '3c2f8e6651178742bc685e7bd62fa8a6ca409a74':
Replace the stub GoogleTransport with callout to the
This introduces a new Uri form of Intent with an "intent:" scheme, and a
corresponding update to the parser to handle these, so that the browser
can use this generic facility for starting activities based on the links
that are clicked and allow for web pages to link to arbitrary intents.
There is also a new "package" field on Intent which allows you to limit
the components it finds to a given package. This replaces the new method
that was added to PackageManger for doing this when resolving activities,
and implements it for all Intent queries against the package manager.
We now only increment the launch count when we are launching from one package
to another. Also the individual components in a package now have a count
of the number of times they have been entered, which likewise is only updated
when going to one component from another.
This requires a new data format (all old data is wiped) and new checkin
dump format (tools must be updated to read it).
Merge commit '07ca8c71f47ac8c61b3aef0210e44d2c48e62e48'
* commit '07ca8c71f47ac8c61b3aef0210e44d2c48e62e48':
Fix many of the ANRs introduced by scheduling classes.
Merge commit 'aa088447baadd2e0bbcfd18cc529645610c13ddc'
* commit 'aa088447baadd2e0bbcfd18cc529645610c13ddc':
Hold the current transport instantiated all the time.
Create a new public IntentSender class that can be used by PackageManager instead.
This new class uses IIntentSender internally and can only be created by PendingIntent for now.
Provide a new getIntentSender api in PendingIntent to create an instance of this class.
Move IIntentSender and IIntentReceiver from android.app to android.content
Change imports of IIntentSender and IIntentReceiver to reflect the new package name
The PackageManager api has been named as freeStorageWithIntent and will be renamed as freeStorage
once the older api(which has been deprecated) will be removed shortly.
Merge commit '63d2700036d0f73cbde27f0fa724d30045b4bb07'
* commit '63d2700036d0f73cbde27f0fa724d30045b4bb07':
Allow privileged callers to schedule a backup pass for any app.
We weren't bumping the oom_adj of processes receiving a registered broadcast. Previously
this wasn't a problem, because those processes are allowed to have their oom_adj
managed by whatever else is in them and if the registered receiver goes away no problem.
But now this is also controlling the scheduling class, so we need to bump them up.
This is probably good anyway, since the developer has the same assurance of their process
not being killing in the middle of registered receivers like it had always been for
manifest receivers.
Also fixed a small issue where we were not recomputing the oom_adh after finished with
a broadcast.
We no longer instantiate the transport just for the duration of handling a
backup or restore operation. Instead, we hold the object forever (replacing it
if instructed to do so). This makes it easier for transports to watch system
state and help set backup timing policy.
Also fixes up the IBackupTransport documentation a bit.
The 'list sets' and 'restore token#' commands from bmgr now do what they are
supposed to. At this point we see the restore target's data being cleared
properly and its agent being launched and invoked for restore.
