LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Restrict lockdown and firewall to AID_SYSTEM.

Browse Source 
Bug: 7076289
Change-Id: Iafa3054335e8b1c3c8c3b8db2a4191d4ed4c8c41
This commit is contained in:
Jeff Sharkey
2012-09-06 17:54:29 -07:00
parent e588ca1c19
commit 69fc5f8bd1
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
services/java/com/android/server/ConnectivityService.java
View File

@@ -77,6 +77,7 @@ import android.os.Looper;
import android.os.Message; import android.os.Message;
import android.os.ParcelFileDescriptor; import android.os.ParcelFileDescriptor;
import android.os.PowerManager; import android.os.PowerManager;
import android.os.Process;
import android.os.RemoteException; import android.os.RemoteException;
import android.os.ServiceManager; import android.os.ServiceManager;
import android.os.SystemClock; import android.os.SystemClock;
@@ -3370,7 +3371,7 @@ public class ConnectivityService extends IConnectivityManager.Stub {
@Override @Override
public boolean updateLockdownVpn() { public boolean updateLockdownVpn() {
mContext.enforceCallingOrSelfPermission(CONNECTIVITY_INTERNAL, TAG); enforceSystemUid();
// Tear down existing lockdown if profile was removed // Tear down existing lockdown if profile was removed
mLockdownEnabled = LockdownVpnTracker.isEnabled(); mLockdownEnabled = LockdownVpnTracker.isEnabled();
@@ -3421,4 +3422,11 @@ public class ConnectivityService extends IConnectivityManager.Stub {
throw new IllegalStateException("Unavailable in lockdown mode"); throw new IllegalStateException("Unavailable in lockdown mode");
} }
} }
private static void enforceSystemUid() {
final int uid = Binder.getCallingUid();
if (uid != Process.SYSTEM_UID) {
throw new SecurityException("Only available to AID_SYSTEM");
}
}
} }