Full local backup infrastructure

This is the basic infrastructure for pulling a full(*) backup of the
device's data over an adb(**) connection to the local device.  The
basic process consists of these interacting pieces:

1. The framework's BackupManagerService, which coordinates the
   collection of app data and routing to the destination.

2. A new framework-provided BackupAgent implementation called
   FullBackupAgent, which is instantiated in the target applications'
   processes in turn, and knows how to emit a datastream that contains
   all of the app's saved data files.

3. A new shell-level program called "bu" that is used to bridge from
   adb to the framework's Backup Manager.

4. adb itself, which now knows how to use 'bu' to kick off a backup
   operation and pull the resulting data stream to the desktop host.

5. A system-provided application that verifies with the user that
   an attempted backup/restore operation is in fact expected and to
   be allowed.

The full agent implementation is not used during normal operation of
the delta-based app-customized remote backup process.  Instead it's
used during user-confirmed *full* backup of applications and all their
data to a local destination, e.g. via the adb connection.

The output format is 'tar'.  This makes it very easy for the end
user to examine the resulting dataset, e.g. for purpose of extracting
files for debug purposes; as well as making it easy to contemplate
adding things like a direct gzip stage to the data pipeline during
backup/restore.  It also makes it convenient to construct and maintain
synthetic backup datasets for testing purposes.

Within the tar format, certain artificial conventions are used.
All files are stored within top-level directories according to
their semantic origin:

apps/pkgname/a/  : Application .apk file itself
apps/pkgname/obb/: The application's associated .obb containers
apps/pkgname/f/  : The subtree rooted at the getFilesDir() location
apps/pkgname/db/ : The subtree rooted at the getDatabasePath() parent
apps/pkgname/sp/ : The subtree rooted at the getSharedPrefsFile() parent
apps/pkgname/r/  : Files stored relative to the root of the app's file tree
apps/pkgname/c/  : Reserved for the app's getCacheDir() tree; not stored.

For each package, the first entry in the tar stream is a file called
"_manifest", nominally rooted at apps/pkgname.  This file contains some
metadata about the package whose data is stored in the archive.

The contents of shared storage can optionally be included in the tar
stream. It is placed in the synthetic location:

shared/...

uid/gid are ignored; app uids are assigned at install time, and the
app's data is handled from within its own execution environment, so
will automatically have the app's correct uid.

Forward-locked .apk files are never backed up.  System-partition
.apk files are not backed up unless they have been overridden by a
post-factory upgrade, in which case the current .apk *is* backed up --
i.e. the .apk that matches the on-disk data.  The manifest preceding
each application's portion of the tar stream provides version numbers
and signature blocks for version checking, as well as an indication
of whether the restore logic should expect to install the .apk before
extracting the data.

System packages can designate their own full backup agents.  This is
to manage things like the settings provider which (a) cannot be shut
down on the fly in order to do a clean snapshot of their file trees,
and (b) manage data that is not only irrelevant but actively hostile
to non-identical devices -- CDMA telephony settings would seriously
mess up a GSM device if emplaced there blind, for example.

When a full backup or restore is initiated from adb, the system will
present a confirmation UI that the user must explicitly respond to
within a short [~ 30 seconds] timeout.  This is to avoid the
possibility of malicious desktop-side software secretly grabbing a copy
of all the user's data for nefarious purposes.

(*) The backup is not strictly a full mirror.  In particular, the
    settings database is not cloned; it is handled the same way that
    it is in cloud backup/restore.  This is because some settings
    are actively destructive if cloned onto a different (or
    especially a different-model) device: telephony settings and
    AndroidID are good examples of this.

(**) On the framework side it doesn't care that it's adb; it just
    sends the tar stream to a file descriptor.  This can easily be
    retargeted around whatever transport we might decide to use
    in the future.

KNOWN ISSUES:

* the security UI is desperately ugly; no proper designs have yet
  been done for it
* restore is not yet implemented
* shared storage backup is not yet implemented
* symlinks aren't yet handled, though some infrastructure for
  dealing with them has been put in place.

Change-Id: Ia8347611e23b398af36ea22c36dff0a276b1ce91

1 files changed, 237 insertions, 0 deletions

diff --git a/packages/BackupRestoreConfirmation/src/com/android/backupconfirm/BackupRestoreConfirmation.java b/packages/BackupRestoreConfirmation/src/com/android/backupconfirm/BackupRestoreConfirmation.java
new file mode 100644
index 0000000..805b905
--- /dev/null
+++ b/packages/BackupRestoreConfirmation/src/com/android/backupconfirm/BackupRestoreConfirmation.java
@@ -0,0 +1,237 @@
+/*
+ * Copyright (C) 2011 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.backupconfirm;
+
+import android.app.Activity;
+import android.app.backup.FullBackup;
+import android.app.backup.IBackupManager;
+import android.app.backup.IFullBackupRestoreObserver;
+import android.content.Context;
+import android.content.Intent;
+import android.os.Bundle;
+import android.os.Handler;
+import android.os.Looper;
+import android.os.Message;
+import android.os.RemoteException;
+import android.os.ServiceManager;
+import android.util.Slog;
+import android.view.View;
+import android.widget.Button;
+import android.widget.TextView;
+import android.widget.Toast;
+
+/**
+ * Confirm with the user that a requested full backup/restore operation is legitimate.
+ * Any attempt to perform a full backup/restore will launch this UI and wait for a
+ * designated timeout interval (nominally 30 seconds) for the user to confirm.  If the
+ * user fails to respond within the timeout period, or explicitly refuses the operation
+ * within the UI presented here, no data will be transferred off the device.
+ *
+ * Note that the fully scoped name of this class is baked into the backup manager service.
+ *
+ * @hide
+ */
+public class BackupRestoreConfirmation extends Activity {
+    static final String TAG = "BackupRestoreConfirmation";
+    static final boolean DEBUG = true;
+
+    static final int MSG_START_BACKUP = 1;
+    static final int MSG_BACKUP_PACKAGE = 2;
+    static final int MSG_END_BACKUP = 3;
+    static final int MSG_START_RESTORE = 11;
+    static final int MSG_RESTORE_PACKAGE = 12;
+    static final int MSG_END_RESTORE = 13;
+    static final int MSG_TIMEOUT = 100;
+
+    Handler mHandler;
+    IBackupManager mBackupManager;
+    FullObserver mObserver;
+    int mToken;
+
+    TextView mStatusView;
+    Button mAllowButton;
+    Button mDenyButton;
+
+    // Handler for dealing with observer callbacks on the main thread
+    class ObserverHandler extends Handler {
+        Context mContext;
+        ObserverHandler(Context context) {
+            mContext = context;
+        }
+
+        @Override
+        public void handleMessage(Message msg) {
+            switch (msg.what) {
+                case MSG_START_BACKUP: {
+                    Toast.makeText(mContext, "!!! Backup starting !!!", Toast.LENGTH_LONG);
+                }
+                break;
+
+                case MSG_BACKUP_PACKAGE: {
+                    String name = (String) msg.obj;
+                    mStatusView.setText(name);
+                }
+                break;
+
+                case MSG_END_BACKUP: {
+                    Toast.makeText(mContext, "!!! Backup ended !!!", Toast.LENGTH_SHORT);
+                }
+                break;
+
+                case MSG_START_RESTORE: {
+                    Toast.makeText(mContext, "!!! Restore starting !!!", Toast.LENGTH_LONG);
+                }
+                break;
+
+                case MSG_RESTORE_PACKAGE: {
+                }
+                break;
+
+                case MSG_END_RESTORE: {
+                    Toast.makeText(mContext, "!!! Restore ended !!!", Toast.LENGTH_SHORT);
+                }
+                break;
+
+                case MSG_TIMEOUT: {
+                }
+                break;
+            }
+        }
+    }
+    
+    @Override
+    public void onCreate(Bundle icicle) {
+        super.onCreate(icicle);
+
+        final Intent intent = getIntent();
+        final String action = intent.getAction();
+
+        int layoutId;
+        if (action.equals(FullBackup.FULL_BACKUP_INTENT_ACTION)) {
+            layoutId = R.layout.confirm_backup;
+        } else if (action.equals(FullBackup.FULL_RESTORE_INTENT_ACTION)) {
+            layoutId = R.layout.confirm_restore;
+        } else {
+            Slog.w(TAG, "Backup/restore confirmation activity launched with invalid action!");
+            finish();
+            return;
+        }
+
+        mToken = intent.getIntExtra(FullBackup.CONF_TOKEN_INTENT_EXTRA, -1);
+        if (mToken < 0) {
+            Slog.e(TAG, "Backup/restore confirmation requested but no token passed!");
+            finish();
+            return;
+        }
+
+        mBackupManager = IBackupManager.Stub.asInterface(ServiceManager.getService(Context.BACKUP_SERVICE));
+
+        mHandler = new ObserverHandler(getApplicationContext());
+        mObserver = new FullObserver();
+
+        setContentView(layoutId);
+
+        // Same resource IDs for each layout variant (backup / restore)
+        mStatusView = (TextView) findViewById(R.id.package_name);
+        mAllowButton = (Button) findViewById(R.id.button_allow);
+        mDenyButton = (Button) findViewById(R.id.button_deny);
+
+        mAllowButton.setOnClickListener(new View.OnClickListener() {
+            @Override
+            public void onClick(View v) {
+                try {
+                    mBackupManager.acknowledgeFullBackupOrRestore(mToken, true, mObserver);
+                } catch (RemoteException e) {
+                    // TODO: bail gracefully if we can't contact the backup manager
+                }
+                mAllowButton.setEnabled(false);
+                mDenyButton.setEnabled(false);
+            }
+        });
+
+        mDenyButton.setOnClickListener(new View.OnClickListener() {
+            @Override
+            public void onClick(View v) {
+                try {
+                    mBackupManager.acknowledgeFullBackupOrRestore(mToken, false, mObserver);
+                } catch (RemoteException e) {
+                    // TODO: bail gracefully if we can't contact the backup manager
+                }
+                mAllowButton.setEnabled(false);
+                mDenyButton.setEnabled(false);
+            }
+        });
+    }
+
+    @Override
+    public void onStop() {
+        super.onStop();
+
+        // We explicitly equate departure from the UI with refusal.  This includes the
+        // implicit configuration-changed stop/restart cycle.
+        try {
+            mBackupManager.acknowledgeFullBackupOrRestore(mToken, false, null);
+        } catch (RemoteException e) {
+            // if this fails we'll still time out with no acknowledgment
+        }
+        finish();
+    }
+
+    /**
+     * The observer binder for showing backup/restore progress.  This binder just bounces
+     * the notifications onto the main thread.
+     */
+    class FullObserver extends IFullBackupRestoreObserver.Stub {
+        //
+        // IFullBackupRestoreObserver implementation
+        //
+        @Override
+        public void onStartBackup() throws RemoteException {
+            mHandler.sendEmptyMessage(MSG_START_BACKUP);
+        }
+
+        @Override
+        public void onBackupPackage(String name) throws RemoteException {
+            mHandler.sendMessage(mHandler.obtainMessage(MSG_BACKUP_PACKAGE, name));
+        }
+
+        @Override
+        public void onEndBackup() throws RemoteException {
+            mHandler.sendEmptyMessage(MSG_END_BACKUP);
+        }
+
+        @Override
+        public void onStartRestore() throws RemoteException {
+            mHandler.sendEmptyMessage(MSG_START_RESTORE);
+        }
+
+        @Override
+        public void onRestorePackage(String name) throws RemoteException {
+            mHandler.sendMessage(mHandler.obtainMessage(MSG_RESTORE_PACKAGE, name));
+        }
+
+        @Override
+        public void onEndRestore() throws RemoteException {
+            mHandler.sendEmptyMessage(MSG_END_RESTORE);
+        }        
+
+        @Override
+        public void onTimeout() throws RemoteException {
+            mHandler.sendEmptyMessage(MSG_TIMEOUT);
+        }
+    }
+}