LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Gate exemptFromEentitlementCheck by Network_STACK permission

Browse Source 
Shell has TETHER_PRIVILEGED permission. To avoid any service to adopt
shell identity by lunching service with Shell process, gate
exemptFromEentitlementCheck by NETWORK_STACK.

Bug: 157702014
Test: atest TetheringCoverageTests
Change-Id: I6ddfda23d36ea9981e3e1eb5a87767f452a65852
This commit is contained in:
markchien
2020-05-29 14:36:36 +08:00
committed by Mark Chien
parent 908518d8e2
commit 9e790873d9
3 changed files with 35 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
Tethering/src/com/android/networkstack/tethering/TetheringService.java
View File

@@ -17,8 +17,10 @@
package com.android.networkstack.tethering;
import static android.Manifest.permission.ACCESS_NETWORK_STATE;
import static android.Manifest.permission.NETWORK_STACK;
import static android.Manifest.permission.TETHER_PRIVILEGED;
import static android.content.pm.PackageManager.PERMISSION_GRANTED;
import static android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK;
import static android.net.TetheringManager.TETHER_ERROR_NO_ACCESS_TETHERING_PERMISSION;
import static android.net.TetheringManager.TETHER_ERROR_NO_CHANGE_TETHERING_PERMISSION;
import static android.net.TetheringManager.TETHER_ERROR_NO_ERROR;
@@ -253,15 +255,26 @@ public class TetheringService extends Service {
return false;
}
private boolean hasNetworkStackPermission() {
return checkCallingOrSelfPermission(NETWORK_STACK)
|| checkCallingOrSelfPermission(PERMISSION_MAINLINE_NETWORK_STACK);
}
private boolean hasTetherPrivilegedPermission() {
return mService.checkCallingOrSelfPermission(TETHER_PRIVILEGED) == PERMISSION_GRANTED;
return checkCallingOrSelfPermission(TETHER_PRIVILEGED);
}
private boolean checkCallingOrSelfPermission(final String permission) {
return mService.checkCallingOrSelfPermission(permission) == PERMISSION_GRANTED;
}
private boolean hasTetherChangePermission(final String callerPkg,
final String callingAttributionTag, final boolean onlyAllowPrivileged) {
if (onlyAllowPrivileged && !hasNetworkStackPermission()) return false;
if (hasTetherPrivilegedPermission()) return true;
if (onlyAllowPrivileged || mTethering.isTetherProvisioningRequired()) return false;
if (mTethering.isTetherProvisioningRequired()) return false;
int uid = Binder.getCallingUid();

4
Tethering/tests/integration/src/android/net/EthernetTetheringTest.java
View File

@@ -339,7 +339,7 @@ public class EthernetTetheringTest {
private MyTetheringEventCallback enableEthernetTethering(String iface) throws Exception {
return enableEthernetTethering(iface,
new TetheringRequest.Builder(TETHERING_ETHERNET)
.setExemptFromEntitlementCheck(true).build());
.setShouldShowEntitlementUi(false).build());
}
private int getMTU(TestNetworkInterface iface) throws SocketException {
@@ -510,7 +510,7 @@ public class EthernetTetheringTest {
LinkAddress clientAddr = client == null ? null : new LinkAddress(client);
return new TetheringRequest.Builder(TETHERING_ETHERNET)
.setStaticIpv4Addresses(localAddr, clientAddr)
.setExemptFromEntitlementCheck(true).build();
.setShouldShowEntitlementUi(false).build();
}
private void assertInvalidStaticIpv4Request(String iface, String local, String client)

25
Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringServiceTest.java
View File

@@ -281,22 +281,33 @@ public final class TetheringServiceTest {
});
}
private void runStartTetheringAndVerifyNoPermission(final TestTetheringResult result)
throws Exception {
final TetheringRequestParcel request = new TetheringRequestParcel();
request.tetheringType = TETHERING_WIFI;
request.exemptFromEntitlementCheck = true;
mTetheringConnector.startTethering(request, TEST_CALLER_PKG, TEST_ATTRIBUTION_TAG,
result);
result.assertResult(TETHER_ERROR_NO_CHANGE_TETHERING_PERMISSION);
verifyNoMoreInteractionsForTethering();
}
@Test
public void testStartTetheringWithExemptFromEntitlementCheck() throws Exception {
public void testFailToBypassEntitlementWithoutNeworkStackPermission() throws Exception {
final TetheringRequestParcel request = new TetheringRequestParcel();
request.tetheringType = TETHERING_WIFI;
request.exemptFromEntitlementCheck = true;
runAsNoPermission((result) -> {
runStartTetheringAndVerifyNoPermission(result);
});
runAsTetherPrivileged((result) -> {
runStartTethering(result, request);
verifyNoMoreInteractionsForTethering();
runStartTetheringAndVerifyNoPermission(result);
});
runAsWriteSettings((result) -> {
mTetheringConnector.startTethering(request, TEST_CALLER_PKG, TEST_ATTRIBUTION_TAG,
result);
result.assertResult(TETHER_ERROR_NO_CHANGE_TETHERING_PERMISSION);
verifyNoMoreInteractionsForTethering();
runStartTetheringAndVerifyNoPermission(result);
});
}