LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge "Force only system uid can set uids allowed on restricted networks" into sc-dev

Browse Source
This commit is contained in:
Paul Hu
2021-07-02 10:46:19 +00:00
committed by Android (Google) Code Review
parent f5f8e4e3a5 03635b3ad5
commit 77739d37b3
2 changed files with 33 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
framework/src/android/net/ConnectivitySettingsManager.java
View File

@@ -29,6 +29,8 @@ import android.annotation.Nullable;
import android.annotation.SystemApi;
import android.content.Context;
import android.net.ConnectivityManager.MultipathPreference;
import android.os.Binder;
import android.os.Build;
import android.os.Process;
import android.os.UserHandle;
import android.provider.Settings;
@@ -1039,6 +1041,15 @@ public class ConnectivitySettingsManager {
return getUidSetFromString(uidList);
}
private static boolean isCallingFromSystem() {
final int uid = Binder.getCallingUid();
final int pid = Binder.getCallingPid();
if (uid == Process.SYSTEM_UID && pid == Process.myPid()) {
return true;
}
return false;
}
/**
* Set the list of uids(from {@link Settings}) that is allowed to use restricted networks.
*
@@ -1047,6 +1058,15 @@ public class ConnectivitySettingsManager {
*/
public static void setUidsAllowedOnRestrictedNetworks(@NonNull Context context,
@NonNull Set<Integer> uidList) {
final boolean calledFromSystem = isCallingFromSystem();
if (!calledFromSystem) {
// Enforce NETWORK_SETTINGS check if it's debug build. This is for MTS test only.
if (!Build.isDebuggable()) {
throw new SecurityException("Only system can set this setting.");
}
context.enforceCallingOrSelfPermission(android.Manifest.permission.NETWORK_SETTINGS,
"Requires NETWORK_SETTINGS permission");
}
final String uids = getUidStringFromSet(uidList);
Settings.Global.putString(context.getContentResolver(), UIDS_ALLOWED_ON_RESTRICTED_NETWORKS,
uids);

19
tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
View File

@@ -2896,6 +2896,10 @@ public class ConnectivityManagerTest {
public void testUidsAllowedOnRestrictedNetworks() throws Exception {
assumeTrue(TestUtils.shouldTestSApis());
// TODO (b/175199465): figure out a reasonable permission check for
// setUidsAllowedOnRestrictedNetworks that allows tests but not system-external callers.
assumeTrue(Build.isDebuggable());
final int uid = mPackageManager.getPackageUid(mContext.getPackageName(), 0 /* flag */);
final Set<Integer> originalUidsAllowedOnRestrictedNetworks =
ConnectivitySettingsManager.getUidsAllowedOnRestrictedNetworks(mContext);
@@ -2903,8 +2907,9 @@ public class ConnectivityManagerTest {
// because it has been just installed to device. In case the uid is existed in setting
// mistakenly, try to remove the uid and set correct uids to setting.
originalUidsAllowedOnRestrictedNetworks.remove(uid);
ConnectivitySettingsManager.setUidsAllowedOnRestrictedNetworks(mContext,
originalUidsAllowedOnRestrictedNetworks);
runWithShellPermissionIdentity(() ->
ConnectivitySettingsManager.setUidsAllowedOnRestrictedNetworks(
mContext, originalUidsAllowedOnRestrictedNetworks), NETWORK_SETTINGS);
final Handler h = new Handler(Looper.getMainLooper());
final TestableNetworkCallback testNetworkCb = new TestableNetworkCallback();
@@ -2951,8 +2956,9 @@ public class ConnectivityManagerTest {
final Set<Integer> newUidsAllowedOnRestrictedNetworks =
new ArraySet<>(originalUidsAllowedOnRestrictedNetworks);
newUidsAllowedOnRestrictedNetworks.add(uid);
ConnectivitySettingsManager.setUidsAllowedOnRestrictedNetworks(mContext,
newUidsAllowedOnRestrictedNetworks);
runWithShellPermissionIdentity(() ->
ConnectivitySettingsManager.setUidsAllowedOnRestrictedNetworks(
mContext, newUidsAllowedOnRestrictedNetworks), NETWORK_SETTINGS);
// Wait a while for sending allowed uids on the restricted network to netd.
// TODD: Have a significant signal to know the uids has been send to netd.
assertBindSocketToNetworkSuccess(network);
@@ -2961,8 +2967,9 @@ public class ConnectivityManagerTest {
agent.unregister();
// Restore setting.
ConnectivitySettingsManager.setUidsAllowedOnRestrictedNetworks(mContext,
originalUidsAllowedOnRestrictedNetworks);
runWithShellPermissionIdentity(() ->
ConnectivitySettingsManager.setUidsAllowedOnRestrictedNetworks(
mContext, originalUidsAllowedOnRestrictedNetworks), NETWORK_SETTINGS);
}
}
}