LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Protect ConnectivityService from SecurityException in permission check.

Browse Source 
ConnectivityService currently calls
LocationPermissionChecker#checkLocationPermission. This method call
throws a SecurityException if the given package name and UID do not
match. This permission check is made from the ConnectivityService
Thread, so any Exception being thrown will crash the SystemServer. This
is not acceptable, so surround the permission check in a try-catch in
case any SecurityExceptions are thrown.

Bug: 149119324
Test: atest ConnectivityServiceTest
Change-Id: Ibe2874f2a5249432270aa1b9eb7d004bbba35ac2
Merged-In: Ibe2874f2a5249432270aa1b9eb7d004bbba35ac2
(cherry picked from commit 9eacc855b63b36f5b937e703b20d4b0bb077ab75)
This commit is contained in:
Automerger Merge Worker
2020-03-16 15:48:50 +00:00
committed by Cody Kesting
parent 22d0bfd7c4
commit 1c7f159f44
2 changed files with 29 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
services/core/java/com/android/server/ConnectivityService.java
View File

@@ -7892,10 +7892,17 @@ public class ConnectivityService extends IConnectivityManager.Stub
return true;
}
// LocationPermissionChecker#checkLocationPermission can throw SecurityException if the uid
// and package name don't match. Throwing on the CS thread is not acceptable, so wrap the
// call in a try-catch.
try {
if (!mLocationPermissionChecker.checkLocationPermission(
callbackPackageName, null /* featureId */, callbackUid, null /* message */)) {
return false;
}
} catch (SecurityException e) {
return false;
}
synchronized (mVpns) {
if (getVpnIfOwner(callbackUid) != null) {

20
tests/net/java/com/android/server/ConnectivityServiceTest.java
View File

@@ -6788,6 +6788,26 @@ public class ConnectivityServiceTest {
mContext.getOpPackageName()));
}
@Test
public void testCheckConnectivityDiagnosticsPermissionsWrongUidPackageName() throws Exception {
final NetworkAgentInfo naiWithoutUid =
new NetworkAgentInfo(
null, null, null, null, null, new NetworkCapabilities(), 0,
mServiceContext, null, null, mService, null, null, null, 0);
mServiceContext.setPermission(android.Manifest.permission.NETWORK_STACK, PERMISSION_DENIED);
try {
assertFalse(
"Mismatched uid/package name should not pass the location permission check",
mService.checkConnectivityDiagnosticsPermissions(
Process.myPid() + 1, Process.myUid() + 1, naiWithoutUid,
mContext.getOpPackageName()));
} catch (SecurityException e) {
fail("checkConnectivityDiagnosticsPermissions shouldn't surface a SecurityException");
}
}
@Test
public void testCheckConnectivityDiagnosticsPermissionsNoLocationPermission() throws Exception {
final NetworkAgentInfo naiWithoutUid =