Implement a stub permission server for Brillo tier 1.
This will allow removing some existing hardcoded checks, like
https://cs.corp.google.com/android/frameworks/native/libs/binder/IServiceManager.cpp?l=70
Also add a .clang-format file for Android Framework C++ style.
Bug: 25663983
Change-Id: Icc4473a6f7b8c7395cdb167dc3fdbb2f076e5960
diff --git a/services/nativeperms/.clang-format b/services/nativeperms/.clang-format
new file mode 100644
index 0000000..6006e6f
--- /dev/null
+++ b/services/nativeperms/.clang-format
@@ -0,0 +1,13 @@
+BasedOnStyle: Google
+AllowShortFunctionsOnASingleLine: Inline
+AllowShortIfStatementsOnASingleLine: true
+AllowShortLoopsOnASingleLine: true
+BinPackArguments: true
+BinPackParameters: true
+ColumnLimit: 80
+CommentPragmas: NOLINT:.*
+ContinuationIndentWidth: 8
+DerivePointerAlignment: false
+IndentWidth: 4
+PointerAlignment: Left
+TabWidth: 4
diff --git a/services/nativeperms/Android.mk b/services/nativeperms/Android.mk
new file mode 100644
index 0000000..6cde63a
--- /dev/null
+++ b/services/nativeperms/Android.mk
@@ -0,0 +1,32 @@
+# Copyright 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := nativeperms
+LOCAL_SRC_FILES := \
+ nativeperms.cpp \
+ android/os/IPermissionController.aidl
+LOCAL_CFLAGS := -Wall -Werror
+LOCAL_SHARED_LIBRARIES := \
+ libbinder \
+ libbrillo \
+ libbrillo-binder \
+ libchrome \
+ libutils
+# Commented out momentarily until SELinux policies land in a different repo.
+# LOCAL_INIT_RC := nativeperms.rc
+include $(BUILD_EXECUTABLE)
diff --git a/services/nativeperms/android/os/IPermissionController.aidl b/services/nativeperms/android/os/IPermissionController.aidl
new file mode 100644
index 0000000..89db85c
--- /dev/null
+++ b/services/nativeperms/android/os/IPermissionController.aidl
@@ -0,0 +1,25 @@
+/* //device/java/android/android/os/IPowerManager.aidl
+**
+** Copyright 2007, The Android Open Source Project
+**
+** Licensed under the Apache License, Version 2.0 (the "License");
+** you may not use this file except in compliance with the License.
+** You may obtain a copy of the License at
+**
+** http://www.apache.org/licenses/LICENSE-2.0
+**
+** Unless required by applicable law or agreed to in writing, software
+** distributed under the License is distributed on an "AS IS" BASIS,
+** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+** See the License for the specific language governing permissions and
+** limitations under the License.
+*/
+
+package android.os;
+
+/** @hide */
+interface IPermissionController {
+ boolean checkPermission(String permission, int pid, int uid);
+ String[] getPackagesForUid(int uid);
+ boolean isRuntimePermission(String permission);
+}
diff --git a/services/nativeperms/android/os/README b/services/nativeperms/android/os/README
new file mode 100644
index 0000000..e414499
--- /dev/null
+++ b/services/nativeperms/android/os/README
@@ -0,0 +1,4 @@
+IPermissionController.aidl in this directory is a verbatim copy of
+https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/os/IPermissionController.aidl,
+because some Brillo manifests do not currently include the frameworks/base repo.
+TODO(jorgelo): Figure out a way to use the .aidl file in frameworks/base.
diff --git a/services/nativeperms/nativeperms.cpp b/services/nativeperms/nativeperms.cpp
new file mode 100644
index 0000000..7f03bed
--- /dev/null
+++ b/services/nativeperms/nativeperms.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <base/at_exit.h>
+#include <base/logging.h>
+#include <base/message_loop/message_loop.h>
+#include <binder/IServiceManager.h>
+#include <binder/Status.h>
+#include <brillo/binder_watcher.h>
+#include <brillo/message_loops/base_message_loop.h>
+#include <brillo/syslog_logging.h>
+#include <utils/String16.h>
+
+#include "android/os/BnPermissionController.h"
+
+namespace {
+static android::String16 serviceName("permission");
+}
+
+namespace android {
+
+class PermissionService : public android::os::BnPermissionController {
+ public:
+ ::android::binder::Status checkPermission(
+ const ::android::String16& permission, int32_t pid, int32_t uid,
+ bool* _aidl_return) {
+ (void)permission;
+ (void)pid;
+ (void)uid;
+ *_aidl_return = true;
+ return binder::Status::ok();
+ }
+
+ ::android::binder::Status getPackagesForUid(
+ int32_t uid, ::std::vector<::android::String16>* _aidl_return) {
+ (void)uid;
+ // Brillo doesn't currently have installable packages.
+ if (_aidl_return) {
+ _aidl_return->clear();
+ }
+ return binder::Status::ok();
+ }
+
+ ::android::binder::Status isRuntimePermission(
+ const ::android::String16& permission, bool* _aidl_return) {
+ (void)permission;
+ // Brillo doesn't currently have runtime permissions.
+ *_aidl_return = false;
+ return binder::Status::ok();
+ }
+};
+
+} // namespace android
+
+int main() {
+ base::AtExitManager atExitManager;
+ brillo::InitLog(brillo::kLogToSyslog);
+ // Register the service with servicemanager.
+ android::status_t status = android::defaultServiceManager()->addService(
+ serviceName, new android::PermissionService());
+ CHECK(status == android::OK) << "Failed to get IPermissionController "
+ "binder from servicemanager.";
+
+ // Create a message loop.
+ base::MessageLoopForIO messageLoopForIo;
+ brillo::BaseMessageLoop messageLoop{&messageLoopForIo};
+
+ // Initialize a binder watcher.
+ brillo::BinderWatcher watcher(&messageLoop);
+ watcher.Init();
+
+ // Run the message loop.
+ messageLoop.Run();
+}
diff --git a/services/nativeperms/nativeperms.rc b/services/nativeperms/nativeperms.rc
new file mode 100644
index 0000000..704c0a2
--- /dev/null
+++ b/services/nativeperms/nativeperms.rc
@@ -0,0 +1,4 @@
+service nativeperms /system/bin/nativeperms
+ class main
+ user system
+ group system