From 2b6a14ecf3f1fc644d43b9876a5ce518916c0d13 Mon Sep 17 00:00:00 2001 From: Benedict Wong Date: Thu, 13 Sep 2018 16:45:12 -0700 Subject: [PATCH] Re-enable checks for MANAGE_IPSEC_TUNNELS This patch ensures that creation and modification of IPsec tunnels requires the MANAGE_IPSEC_TUNNELS appop. Bug: 115685048 Test: IpSecManagerTunnelTest fails without appops set Change-Id: I6c60a2573ca521717877f36e28a392b0d3b62754 --- .../java/com/android/server/IpSecService.java | 24 ++++++++----------- 1 file changed, 10 insertions(+), 14 deletions(-) diff --git a/services/core/java/com/android/server/IpSecService.java b/services/core/java/com/android/server/IpSecService.java index 01e81525d5..8c5187e41e 100644 --- a/services/core/java/com/android/server/IpSecService.java +++ b/services/core/java/com/android/server/IpSecService.java @@ -1488,23 +1488,19 @@ public class IpSecService extends IIpSecService.Stub { } } - private static final String TUNNEL_OP = "STOPSHIP"; // = AppOpsManager.OP_MANAGE_IPSEC_TUNNELS; + private static final String TUNNEL_OP = AppOpsManager.OPSTR_MANAGE_IPSEC_TUNNELS; private void enforceTunnelPermissions(String callingPackage) { checkNotNull(callingPackage, "Null calling package cannot create IpSec tunnels"); - if (false) { // STOPSHIP if this line is present - switch (getAppOpsManager().noteOp( - TUNNEL_OP, - Binder.getCallingUid(), callingPackage)) { - case AppOpsManager.MODE_DEFAULT: - mContext.enforceCallingOrSelfPermission( - android.Manifest.permission.MANAGE_IPSEC_TUNNELS, "IpSecService"); - break; - case AppOpsManager.MODE_ALLOWED: - return; - default: - throw new SecurityException("Request to ignore AppOps for non-legacy API"); - } + switch (getAppOpsManager().noteOp(TUNNEL_OP, Binder.getCallingUid(), callingPackage)) { + case AppOpsManager.MODE_DEFAULT: + mContext.enforceCallingOrSelfPermission( + android.Manifest.permission.MANAGE_IPSEC_TUNNELS, "IpSecService"); + break; + case AppOpsManager.MODE_ALLOWED: + return; + default: + throw new SecurityException("Request to ignore AppOps for non-legacy API"); } }