src/com/android/managedprovisioning/task/VerifyAdminPackageTask.java

/*
 * Copyright (C) 2022 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package com.android.managedprovisioning.task;

import static com.android.internal.util.Preconditions.checkNotNull;

import static java.util.Objects.requireNonNull;

import android.content.Context;
import android.content.pm.PackageInfo;
import android.content.pm.PackageManager;

import com.android.internal.annotations.VisibleForTesting;
import com.android.managedprovisioning.analytics.MetricsWriterFactory;
import com.android.managedprovisioning.analytics.ProvisioningAnalyticsTracker;
import com.android.managedprovisioning.common.ManagedProvisioningSharedPreferences;
import com.android.managedprovisioning.common.ProvisionLogger;
import com.android.managedprovisioning.common.SettingsFacade;
import com.android.managedprovisioning.common.Utils;
import com.android.managedprovisioning.model.PackageDownloadInfo;
import com.android.managedprovisioning.model.ProvisioningParams;

import java.io.File;

/**
 * Verifies the management app apk downloaded previously in {@link DownloadPackageTask}.
 *
 * <p>The first check verifies that a {@link android.app.admin.DeviceAdminReceiver} is present in
 * the apk and that it corresponds to the one provided via
 * {@link ProvisioningParams#deviceAdminComponentName}.</p>
 *
 * <p>The second check verifies that the package or signature checksum matches the ones given via
 * {@link PackageDownloadInfo#packageChecksum} or {@link PackageDownloadInfo#signatureChecksum}
 * respectively. The package checksum takes priority in case both are present.</p>
 */
public class VerifyAdminPackageTask extends AbstractProvisioningTask {
    public static final int ERROR_HASH_MISMATCH = 0;
    public static final int ERROR_DEVICE_ADMIN_MISSING = 1;

    private final Utils mUtils;
    private final PackageLocationProvider mDownloadLocationProvider;
    private final PackageManager mPackageManager;
    private final PackageDownloadInfo mPackageDownloadInfo;
    private final ChecksumUtils mChecksumUtils;

    public VerifyAdminPackageTask(
            PackageLocationProvider downloadLocationProvider,
            Context context,
            ProvisioningParams params,
            PackageDownloadInfo packageDownloadInfo,
            Callback callback) {
        this(new Utils(), downloadLocationProvider, context, params, packageDownloadInfo, callback,
                new ProvisioningAnalyticsTracker(
                        MetricsWriterFactory.getMetricsWriter(context, new SettingsFacade()),
                        new ManagedProvisioningSharedPreferences(context)),
                new ChecksumUtils(new Utils()));
    }

    @VisibleForTesting
    VerifyAdminPackageTask(
            Utils utils,
            PackageLocationProvider downloadLocationProvider,
            Context context,
            ProvisioningParams params,
            PackageDownloadInfo packageDownloadInfo,
            Callback callback,
            ProvisioningAnalyticsTracker provisioningAnalyticsTracker,
            ChecksumUtils checksumUtils) {
        super(context, params, callback, provisioningAnalyticsTracker);

        mUtils = checkNotNull(utils);
        mDownloadLocationProvider = checkNotNull(downloadLocationProvider);
        mPackageManager = mContext.getPackageManager();
        mPackageDownloadInfo = checkNotNull(packageDownloadInfo);
        mChecksumUtils = requireNonNull(checksumUtils);
    }

    @Override
    public void run(int userId) {
        final File packageLocation = mDownloadLocationProvider.getPackageLocation();
        if (packageLocation == null) {
            ProvisionLogger.logw("VerifyPackageTask invoked, but package is null");
            success();
            return;
        }
        ProvisionLogger.logi("Verifying package from location " + packageLocation.getAbsolutePath()
                + " for user " + userId);

        PackageInfo packageInfo = mPackageManager.getPackageArchiveInfo(
                packageLocation.getAbsolutePath(),
                PackageManager.GET_SIGNATURES | PackageManager.GET_RECEIVERS);
        String packageName = mProvisioningParams.inferDeviceAdminPackageName();
        // Device admin package name can't be null
        if (packageInfo == null || packageName == null) {
            ProvisionLogger.loge("Device admin package info or name is null");
            error(ERROR_DEVICE_ADMIN_MISSING);
            return;
        }

        if (mUtils.findDeviceAdminInPackageInfo(packageName,
                mProvisioningParams.deviceAdminComponentName, packageInfo) == null) {
            error(ERROR_DEVICE_ADMIN_MISSING);
            return;
        }

        if (mPackageDownloadInfo.packageChecksum.length > 0) {
            if (!mChecksumUtils.doesPackageHashMatch(
                    packageLocation.getAbsolutePath(), mPackageDownloadInfo.packageChecksum)) {
                error(ERROR_HASH_MISMATCH);
                return;
            }
        } else {
            if (!mChecksumUtils.doesASignatureHashMatch(
                    packageInfo, mPackageDownloadInfo.signatureChecksum)) {
                error(ERROR_HASH_MISMATCH);
                return;
            }
        }

        success();
    }
}