You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
380 lines
13 KiB
380 lines
13 KiB
/*
|
|
* Copyright (C) 2010 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
//#define LOG_NDEBUG 0
|
|
#define LOG_TAG "DrmManagerService(Native)"
|
|
#include <utils/Log.h>
|
|
|
|
#include <private/android_filesystem_config.h>
|
|
#include <mediautils/MemoryLeakTrackUtil.h>
|
|
|
|
#include <errno.h>
|
|
#include <utils/threads.h>
|
|
#include <binder/IServiceManager.h>
|
|
#include <binder/IPCThreadState.h>
|
|
#include <sys/stat.h>
|
|
#include "DrmManagerService.h"
|
|
#include "DrmManager.h"
|
|
|
|
#include <selinux/android.h>
|
|
|
|
using namespace android;
|
|
|
|
static int selinux_enabled;
|
|
static char *drmserver_context;
|
|
static Vector<uid_t> trustedUids;
|
|
|
|
const char *const DrmManagerService::drm_perm_labels[] = {
|
|
"consumeRights",
|
|
"setPlaybackStatus",
|
|
"openDecryptSession",
|
|
"closeDecryptSession",
|
|
"initializeDecryptUnit",
|
|
"decrypt",
|
|
"finalizeDecryptUnit",
|
|
"pread"
|
|
};
|
|
|
|
const char *DrmManagerService::get_perm_label(drm_perm_t perm) {
|
|
unsigned int index = perm;
|
|
|
|
if (index >= (sizeof(drm_perm_labels) / sizeof(drm_perm_labels[0]))) {
|
|
ALOGE("SELinux: Failed to retrieve permission label(perm=%d).\n", perm);
|
|
abort();
|
|
}
|
|
return drm_perm_labels[index];
|
|
}
|
|
|
|
bool DrmManagerService::selinuxIsProtectedCallAllowed(pid_t spid, const char* ssid, drm_perm_t perm) {
|
|
if (selinux_enabled <= 0) {
|
|
return true;
|
|
}
|
|
|
|
char *sctx = NULL;
|
|
const char *selinux_class = "drmservice";
|
|
const char *str_perm = get_perm_label(perm);
|
|
|
|
if (ssid == NULL) {
|
|
android_errorWriteLog(0x534e4554, "121035042");
|
|
|
|
if (getpidcon(spid, &sctx) != 0) {
|
|
ALOGE("SELinux: getpidcon(pid=%d) failed.\n", spid);
|
|
return false;
|
|
}
|
|
}
|
|
|
|
bool allowed = (selinux_check_access(ssid ? ssid : sctx, drmserver_context,
|
|
selinux_class, str_perm, NULL) == 0);
|
|
freecon(sctx);
|
|
|
|
return allowed;
|
|
}
|
|
|
|
bool DrmManagerService::isProtectedCallAllowed(drm_perm_t perm) {
|
|
// TODO
|
|
// Following implementation is just for reference.
|
|
// Each OEM manufacturer should implement/replace with their own solutions.
|
|
IPCThreadState* ipcState = IPCThreadState::self();
|
|
uid_t uid = ipcState->getCallingUid();
|
|
pid_t spid = ipcState->getCallingPid();
|
|
const char* ssid = ipcState->getCallingSid();
|
|
|
|
for (unsigned int i = 0; i < trustedUids.size(); ++i) {
|
|
if (trustedUids[i] == uid) {
|
|
return selinuxIsProtectedCallAllowed(spid, ssid, perm);
|
|
}
|
|
}
|
|
return false;
|
|
}
|
|
|
|
void DrmManagerService::instantiate() {
|
|
ALOGV("instantiate");
|
|
sp<DrmManagerService> service = new DrmManagerService();
|
|
service->setRequestingSid(true);
|
|
defaultServiceManager()->addService(String16("drm.drmManager"), service);
|
|
|
|
if (0 >= trustedUids.size()) {
|
|
// TODO
|
|
// Following implementation is just for reference.
|
|
// Each OEM manufacturer should implement/replace with their own solutions.
|
|
|
|
// Add trusted uids here
|
|
trustedUids.push(AID_MEDIA);
|
|
}
|
|
|
|
selinux_enabled = is_selinux_enabled();
|
|
if (selinux_enabled > 0 && getcon(&drmserver_context) != 0) {
|
|
ALOGE("SELinux: DrmManagerService failed to get context for DrmManagerService. Aborting.\n");
|
|
abort();
|
|
}
|
|
|
|
union selinux_callback cb;
|
|
cb.func_log = selinux_log_callback;
|
|
selinux_set_callback(SELINUX_CB_LOG, cb);
|
|
}
|
|
|
|
DrmManagerService::DrmManagerService() :
|
|
mDrmManager(NULL) {
|
|
ALOGV("created");
|
|
mDrmManager = new DrmManager();
|
|
mDrmManager->initMetricsLooper();
|
|
mDrmManager->loadPlugIns();
|
|
}
|
|
|
|
DrmManagerService::~DrmManagerService() {
|
|
ALOGV("Destroyed");
|
|
mDrmManager->unloadPlugIns();
|
|
mDrmManager = NULL;
|
|
}
|
|
|
|
int DrmManagerService::addUniqueId(bool isNative) {
|
|
return mDrmManager->addUniqueId(isNative);
|
|
}
|
|
|
|
void DrmManagerService::removeUniqueId(int uniqueId) {
|
|
mDrmManager->removeUniqueId(uniqueId);
|
|
}
|
|
|
|
void DrmManagerService::addClient(int uniqueId) {
|
|
mDrmManager->addClient(uniqueId);
|
|
}
|
|
|
|
void DrmManagerService::removeClient(int uniqueId) {
|
|
mDrmManager->removeClient(uniqueId);
|
|
}
|
|
|
|
status_t DrmManagerService::setDrmServiceListener(
|
|
int uniqueId, const sp<IDrmServiceListener>& drmServiceListener) {
|
|
ALOGV("Entering setDrmServiceListener");
|
|
mDrmManager->setDrmServiceListener(uniqueId, drmServiceListener);
|
|
return DRM_NO_ERROR;
|
|
}
|
|
|
|
DrmConstraints* DrmManagerService::getConstraints(
|
|
int uniqueId, const String8* path, const int action) {
|
|
ALOGV("Entering getConstraints from content");
|
|
return mDrmManager->getConstraints(uniqueId, path, action);
|
|
}
|
|
|
|
DrmMetadata* DrmManagerService::getMetadata(int uniqueId, const String8* path) {
|
|
ALOGV("Entering getMetadata from content");
|
|
return mDrmManager->getMetadata(uniqueId, path);
|
|
}
|
|
|
|
bool DrmManagerService::canHandle(int uniqueId, const String8& path, const String8& mimeType) {
|
|
ALOGV("Entering canHandle");
|
|
return mDrmManager->canHandle(uniqueId, path, mimeType);
|
|
}
|
|
|
|
DrmInfoStatus* DrmManagerService::processDrmInfo(int uniqueId, const DrmInfo* drmInfo) {
|
|
ALOGV("Entering processDrmInfo");
|
|
return mDrmManager->processDrmInfo(uniqueId, drmInfo);
|
|
}
|
|
|
|
DrmInfo* DrmManagerService::acquireDrmInfo(int uniqueId, const DrmInfoRequest* drmInfoRequest) {
|
|
ALOGV("Entering acquireDrmInfo");
|
|
return mDrmManager->acquireDrmInfo(uniqueId, drmInfoRequest);
|
|
}
|
|
|
|
status_t DrmManagerService::saveRights(
|
|
int uniqueId, const DrmRights& drmRights,
|
|
const String8& rightsPath, const String8& contentPath) {
|
|
ALOGV("Entering saveRights");
|
|
return mDrmManager->saveRights(uniqueId, drmRights, rightsPath, contentPath);
|
|
}
|
|
|
|
String8 DrmManagerService::getOriginalMimeType(int uniqueId, const String8& path, int fd) {
|
|
ALOGV("Entering getOriginalMimeType");
|
|
return mDrmManager->getOriginalMimeType(uniqueId, path, fd);
|
|
}
|
|
|
|
int DrmManagerService::getDrmObjectType(
|
|
int uniqueId, const String8& path, const String8& mimeType) {
|
|
ALOGV("Entering getDrmObjectType");
|
|
return mDrmManager->getDrmObjectType(uniqueId, path, mimeType);
|
|
}
|
|
|
|
int DrmManagerService::checkRightsStatus(
|
|
int uniqueId, const String8& path, int action) {
|
|
ALOGV("Entering checkRightsStatus");
|
|
return mDrmManager->checkRightsStatus(uniqueId, path, action);
|
|
}
|
|
|
|
status_t DrmManagerService::consumeRights(
|
|
int uniqueId, sp<DecryptHandle>& decryptHandle, int action, bool reserve) {
|
|
ALOGV("Entering consumeRights");
|
|
if (!isProtectedCallAllowed(CONSUME_RIGHTS)) {
|
|
return DRM_ERROR_NO_PERMISSION;
|
|
}
|
|
return mDrmManager->consumeRights(uniqueId, decryptHandle, action, reserve);
|
|
}
|
|
|
|
status_t DrmManagerService::setPlaybackStatus(
|
|
int uniqueId, sp<DecryptHandle>& decryptHandle, int playbackStatus, int64_t position) {
|
|
ALOGV("Entering setPlaybackStatus");
|
|
if (!isProtectedCallAllowed(SET_PLAYBACK_STATUS)) {
|
|
return DRM_ERROR_NO_PERMISSION;
|
|
}
|
|
return mDrmManager->setPlaybackStatus(uniqueId, decryptHandle, playbackStatus, position);
|
|
}
|
|
|
|
bool DrmManagerService::validateAction(
|
|
int uniqueId, const String8& path,
|
|
int action, const ActionDescription& description) {
|
|
ALOGV("Entering validateAction");
|
|
return mDrmManager->validateAction(uniqueId, path, action, description);
|
|
}
|
|
|
|
status_t DrmManagerService::removeRights(int uniqueId, const String8& path) {
|
|
ALOGV("Entering removeRights");
|
|
return mDrmManager->removeRights(uniqueId, path);
|
|
}
|
|
|
|
status_t DrmManagerService::removeAllRights(int uniqueId) {
|
|
ALOGV("Entering removeAllRights");
|
|
return mDrmManager->removeAllRights(uniqueId);
|
|
}
|
|
|
|
int DrmManagerService::openConvertSession(int uniqueId, const String8& mimeType) {
|
|
ALOGV("Entering openConvertSession");
|
|
return mDrmManager->openConvertSession(uniqueId, mimeType);
|
|
}
|
|
|
|
DrmConvertedStatus* DrmManagerService::convertData(
|
|
int uniqueId, int convertId, const DrmBuffer* inputData) {
|
|
ALOGV("Entering convertData");
|
|
return mDrmManager->convertData(uniqueId, convertId, inputData);
|
|
}
|
|
|
|
DrmConvertedStatus* DrmManagerService::closeConvertSession(int uniqueId, int convertId) {
|
|
ALOGV("Entering closeConvertSession");
|
|
return mDrmManager->closeConvertSession(uniqueId, convertId);
|
|
}
|
|
|
|
status_t DrmManagerService::getAllSupportInfo(
|
|
int uniqueId, int* length, DrmSupportInfo** drmSupportInfoArray) {
|
|
ALOGV("Entering getAllSupportInfo");
|
|
return mDrmManager->getAllSupportInfo(uniqueId, length, drmSupportInfoArray);
|
|
}
|
|
|
|
sp<DecryptHandle> DrmManagerService::openDecryptSession(
|
|
int uniqueId, int fd, off64_t offset, off64_t length, const char* mime) {
|
|
ALOGV("Entering DrmManagerService::openDecryptSession");
|
|
if (isProtectedCallAllowed(OPEN_DECRYPT_SESSION)) {
|
|
return mDrmManager->openDecryptSession(uniqueId, fd, offset, length, mime);
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
sp<DecryptHandle> DrmManagerService::openDecryptSession(
|
|
int uniqueId, const char* uri, const char* mime) {
|
|
ALOGV("Entering DrmManagerService::openDecryptSession with uri");
|
|
if (isProtectedCallAllowed(OPEN_DECRYPT_SESSION)) {
|
|
return mDrmManager->openDecryptSession(uniqueId, uri, mime);
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
sp<DecryptHandle> DrmManagerService::openDecryptSession(
|
|
int uniqueId, const DrmBuffer& buf, const String8& mimeType) {
|
|
ALOGV("Entering DrmManagerService::openDecryptSession for streaming");
|
|
if (isProtectedCallAllowed(OPEN_DECRYPT_SESSION)) {
|
|
return mDrmManager->openDecryptSession(uniqueId, buf, mimeType);
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
status_t DrmManagerService::closeDecryptSession(int uniqueId, sp<DecryptHandle>& decryptHandle) {
|
|
ALOGV("Entering closeDecryptSession");
|
|
if (!isProtectedCallAllowed(CLOSE_DECRYPT_SESSION)) {
|
|
return DRM_ERROR_NO_PERMISSION;
|
|
}
|
|
return mDrmManager->closeDecryptSession(uniqueId, decryptHandle);
|
|
}
|
|
|
|
status_t DrmManagerService::initializeDecryptUnit(int uniqueId, sp<DecryptHandle>& decryptHandle,
|
|
int decryptUnitId, const DrmBuffer* headerInfo) {
|
|
ALOGV("Entering initializeDecryptUnit");
|
|
if (!isProtectedCallAllowed(INITIALIZE_DECRYPT_UNIT)) {
|
|
return DRM_ERROR_NO_PERMISSION;
|
|
}
|
|
return mDrmManager->initializeDecryptUnit(uniqueId,decryptHandle, decryptUnitId, headerInfo);
|
|
}
|
|
|
|
status_t DrmManagerService::decrypt(
|
|
int uniqueId, sp<DecryptHandle>& decryptHandle, int decryptUnitId,
|
|
const DrmBuffer* encBuffer, DrmBuffer** decBuffer, DrmBuffer* IV) {
|
|
ALOGV("Entering decrypt");
|
|
if (!isProtectedCallAllowed(DECRYPT)) {
|
|
return DRM_ERROR_NO_PERMISSION;
|
|
}
|
|
return mDrmManager->decrypt(uniqueId, decryptHandle, decryptUnitId, encBuffer, decBuffer, IV);
|
|
}
|
|
|
|
status_t DrmManagerService::finalizeDecryptUnit(
|
|
int uniqueId, sp<DecryptHandle>& decryptHandle, int decryptUnitId) {
|
|
ALOGV("Entering finalizeDecryptUnit");
|
|
if (!isProtectedCallAllowed(FINALIZE_DECRYPT_UNIT)) {
|
|
return DRM_ERROR_NO_PERMISSION;
|
|
}
|
|
return mDrmManager->finalizeDecryptUnit(uniqueId, decryptHandle, decryptUnitId);
|
|
}
|
|
|
|
ssize_t DrmManagerService::pread(int uniqueId, sp<DecryptHandle>& decryptHandle,
|
|
void* buffer, ssize_t numBytes, off64_t offset) {
|
|
ALOGV("Entering pread");
|
|
if (!isProtectedCallAllowed(PREAD)) {
|
|
return DRM_ERROR_NO_PERMISSION;
|
|
}
|
|
return mDrmManager->pread(uniqueId, decryptHandle, buffer, numBytes, offset);
|
|
}
|
|
|
|
status_t DrmManagerService::dump(int fd, const Vector<String16>& args)
|
|
{
|
|
const size_t SIZE = 256;
|
|
char buffer[SIZE];
|
|
String8 result;
|
|
if (checkCallingPermission(String16("android.permission.DUMP")) == false) {
|
|
snprintf(buffer, SIZE, "Permission Denial: "
|
|
"can't dump DrmManagerService from pid=%d, uid=%d\n",
|
|
IPCThreadState::self()->getCallingPid(),
|
|
IPCThreadState::self()->getCallingUid());
|
|
result.append(buffer);
|
|
} else {
|
|
#if DRM_MEMORY_LEAK_TRACK
|
|
bool dumpMem = false;
|
|
for (size_t i = 0; i < args.size(); i++) {
|
|
if (args[i] == String16("-m")) {
|
|
dumpMem = true;
|
|
}
|
|
}
|
|
if (dumpMem) {
|
|
result.append("\nDumping memory:\n");
|
|
std::string s = dumpMemoryAddresses(100 /* limit */);
|
|
result.append(s.c_str(), s.size());
|
|
}
|
|
#else
|
|
(void)args;
|
|
#endif
|
|
}
|
|
write(fd, result.string(), result.size());
|
|
return NO_ERROR;
|
|
}
|
|
|