Unbundled test apps can obtain virtual machine permissions
Currently, tests for pKVM are written as hode-side tests which interact
with the platform using the `vm` tool. However, that approach has cause
many problems:
* Can't test Java APIs; we were testing the command line interface of
the tool actually.
* Unreliable connection to adb; we had to add busy loops to work around
some of the flakes.
We should move on to the device-side tests. There will be a
self-instrumened test apk which will be driven by tradefed.
However, one blocker to the plan is that the Java APIs are not available
to test apps, as we don't have a plan to make the APIs public in TM and
therefore we put the APIs behind signature-protected permissions
(com.android.MANAGE_VIRTUAL_MACHINE, com.android.DEBUG_VIRTUAL_MACHINE).
Since test apps can't be signed with the platform key, our test apk
can't have the permission.
This CL fixes the problem by turning on the `development` bit in the
protection level of the permissions. Then the permission can be granted
to the test apps satisfying following conditions (all):
* test app has `android:testOnly="true"` in its manifest. The flag
prevents the app from being uploaded to Play or installed from there.
* the app has to be installed with the "-t" (`INSTALL_ALLOW_TEST`) flag
* the permission has to be explicitly granted via `pm grant <package>
<perm>` command`.
Bug: 203483081
Test: TARGET_BUILD_APPS="MicrodroidDemoApp" m apps_only dist
adb install --no-streaming -t out/dist/MicrodroidDemoApp.apk
adb shell
$ su; setenforce 0 // will be fixed
$ pm grant com.android.microdroid.demo
android.permission.MANAGE_VIRTUAL_MACHINE
run the demo app
Change-Id: Ic163a3bc745fc310d690faddde638405faad686c
diff --git a/demo/Android.bp b/demo/Android.bp
index 749ca90..1342a26 100644
--- a/demo/Android.bp
+++ b/demo/Android.bp
@@ -19,5 +19,4 @@
platform_apis: true,
use_embedded_native_libs: true,
v4_signature: true,
- certificate: "platform",
}
diff --git a/demo/AndroidManifest.xml b/demo/AndroidManifest.xml
index 7e1a58d..74ec210 100644
--- a/demo/AndroidManifest.xml
+++ b/demo/AndroidManifest.xml
@@ -6,7 +6,8 @@
<application
android:label="MicrodroidDemo"
- android:theme="@style/Theme.MicrodroidDemo">
+ android:theme="@style/Theme.MicrodroidDemo"
+ android:testOnly="true">
<uses-library android:name="android.system.virtualmachine" android:required="true" />
<activity android:name=".MainActivity" android:exported="true">
<intent-filter>
diff --git a/javalib/AndroidManifest.xml b/javalib/AndroidManifest.xml
index f96b39f..2a0b903 100644
--- a/javalib/AndroidManifest.xml
+++ b/javalib/AndroidManifest.xml
@@ -18,7 +18,7 @@
package="com.android.virtualmachine.res">
<permission android:name="android.permission.MANAGE_VIRTUAL_MACHINE"
- android:protectionLevel="signature" />
+ android:protectionLevel="signature|development" />
<permission android:name="android.permission.DEBUG_VIRTUAL_MACHINE"
android:protectionLevel="signature" />