Skip to content

Add checking signature process for "XR_EXTX_OVERLAY_EXTENSION_NAME"

Purpose

To increase security of AIDL interfaces of overlay service, add checking signature process for "XR_EXTX_OVERLAY_EXTENSION_NAME".

Design

image

Changes

  1. Check android signature for "XR_EXTX_OVERLAY_EXTENSION_NAME" when overlay service app calls "xrCreateInstance()". image
  2. Add system property "debug.openxr.runtime.checkOverlaySignature" to control this feature.
  3. Using "XRT_ANDROID_PACKAGE" which is set in cmake file to get runtime/spaces package name.

Verification

Prepare:

  1. monado: packed with signature, outOfProcess.
  2. hello_xr app: packed with signature, add "XR_EXTX_OVERLAY_EXTENSION_NAME" extension.

Test cases:

  1. setprop debug.openxr.runtime.checkOverlaySignature true
case result
monado + hello_xr app(with same signature) hello_xr can work
monado + hello_xr app(with different signatures) hello_xr cannot work
  1. setprop debug.openxr.runtime.checkOverlaySignature false
case result
monado + hello_xr app(with same signature) hello_xr can work
monado + hello_xr app(with different signatures) hello_xr can work

Other Impact

Once enable this feature, all apps using "XR_EXTX_OVERLAY_EXTENSION_NAME" will have to be signed with the same signature of "XRT_ANDROID_PACKAGE".

Edited by Zhisheng Lv

Merge request reports