joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Enforce package name belongs to the caller's uid

Browse source 
Ignore-AOSP-First: Security Fix
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.net.NetworkStatsServiceTest
Fix: 274443951
Fix: 243376076
Change-Id: I4ef7eff6567b848c8cfa52c51c734642ce929589
This commit is contained in:
Junyu Lai 2024-01-16 13:32:31 +08:00
commit 212c54b344
2 changed files with 57 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
service-t/src/com/android/server/net/NetworkStatsService.java
View file

@ -1436,7 +1436,11 @@ public class NetworkStatsService extends INetworkStatsService.Stub {
}
@Override
public INetworkStatsSession openSessionForUsageStats(int flags, String callingPackage) {
public INetworkStatsSession openSessionForUsageStats(
int flags, @NonNull String callingPackage) {
Objects.requireNonNull(callingPackage);
PermissionUtils.enforcePackageNameMatchesUid(
mContext, Binder.getCallingUid(), callingPackage);
return openSessionInternal(flags, callingPackage);
}
@ -1951,6 +1955,7 @@ public class NetworkStatsService extends INetworkStatsService.Stub {
final int callingPid = Binder.getCallingPid();
final int callingUid = Binder.getCallingUid();
PermissionUtils.enforcePackageNameMatchesUid(mContext, callingUid, callingPackage);
@NetworkStatsAccess.Level int accessLevel = checkAccessLevel(callingPackage);
DataUsageRequest normalizedRequest;
final long token = Binder.clearCallingIdentity();

52
tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java
View file

@ -64,6 +64,7 @@ import static android.text.format.DateUtils.HOUR_IN_MILLIS;
import static android.text.format.DateUtils.MINUTE_IN_MILLIS;
import static android.text.format.DateUtils.WEEK_IN_MILLIS;
import static com.android.dx.mockito.inline.extended.ExtendedMockito.doThrow;
import static com.android.server.net.NetworkStatsEventLogger.POLL_REASON_RAT_CHANGED;
import static com.android.server.net.NetworkStatsEventLogger.PollEvent.pollReasonNameOf;
import static com.android.server.net.NetworkStatsService.ACTION_NETWORK_STATS_POLL;
@ -98,6 +99,7 @@ import android.annotation.NonNull;
import android.app.AlarmManager;
import android.content.Context;
import android.content.Intent;
import android.content.pm.PackageManager;
import android.content.res.Resources;
import android.database.ContentObserver;
import android.net.DataUsageRequest;
@ -125,7 +127,9 @@ import android.os.HandlerThread;
import android.os.IBinder;
import android.os.Looper;
import android.os.PowerManager;
import android.os.Process;
import android.os.SimpleClock;
import android.os.UserHandle;
import android.provider.Settings;
import android.system.ErrnoException;
import android.telephony.TelephonyManager;
@ -245,6 +249,7 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
private static @Mock WifiInfo sWifiInfo;
private @Mock INetd mNetd;
private @Mock TetheringManager mTetheringManager;
private @Mock PackageManager mPm;
private @Mock NetworkStatsFactory mStatsFactory;
@NonNull
private final TestNetworkStatsSettings mSettings =
@ -304,6 +309,16 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
mBaseContext = base;
}
@Override
public PackageManager getPackageManager() {
return mPm;
}
@Override
public Context createContextAsUser(UserHandle user, int flags) {
return this;
}
@Override
public Object getSystemService(String name) {
if (Context.TELEPHONY_SERVICE.equals(name)) return mTelephonyManager;
@ -427,6 +442,9 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
any(), tetheringEventCbCaptor.capture());
mTetheringEventCallback = tetheringEventCbCaptor.getValue();
doReturn(Process.myUid()).when(mPm)
.getPackageUid(eq(mServiceContext.getPackageName()), anyInt());
mUsageCallback = new TestableUsageCallback(mUsageCallbackBinder);
}
@ -1593,7 +1611,7 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
// Register and verify request and that binder was called
DataUsageRequest request = mService.registerUsageCallback(
mServiceContext.getOpPackageName(), inputRequest, mUsageCallback);
mServiceContext.getPackageName(), inputRequest, mUsageCallback);
assertTrue(request.requestId > 0);
assertTrue(Objects.equals(sTemplateWifi, request.template));
long minThresholdInBytes = 2 * 1024 * 1024; // 2 MB
@ -2805,6 +2823,38 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
assertDumpContains(dump, pollReasonNameOf(POLL_REASON_RAT_CHANGED));
}
@Test
public void testEnforcePackageNameMatchesUid() throws Exception {
final String testMyPackageName = "test.package.myname";
final String testRedPackageName = "test.package.red";
final String testInvalidPackageName = "test.package.notfound";
doReturn(UID_RED).when(mPm).getPackageUid(eq(testRedPackageName), anyInt());
doReturn(Process.myUid()).when(mPm).getPackageUid(eq(testMyPackageName), anyInt());
doThrow(new PackageManager.NameNotFoundException()).when(mPm)
.getPackageUid(eq(testInvalidPackageName), anyInt());
assertThrows(SecurityException.class, () ->
mService.openSessionForUsageStats(0 /* flags */, testRedPackageName));
assertThrows(SecurityException.class, () ->
mService.openSessionForUsageStats(0 /* flags */, testInvalidPackageName));
assertThrows(NullPointerException.class, () ->
mService.openSessionForUsageStats(0 /* flags */, null));
// Verify package name belongs to ourselves does not throw.
mService.openSessionForUsageStats(0 /* flags */, testMyPackageName);
long thresholdInBytes = 10 * 1024 * 1024; // 10 MB
DataUsageRequest request = new DataUsageRequest(
2 /* requestId */, sTemplateImsi1, thresholdInBytes);
assertThrows(SecurityException.class, () ->
mService.registerUsageCallback(testRedPackageName, request, mUsageCallback));
assertThrows(SecurityException.class, () ->
mService.registerUsageCallback(testInvalidPackageName, request, mUsageCallback));
assertThrows(NullPointerException.class, () ->
mService.registerUsageCallback(null, request, mUsageCallback));
mService.registerUsageCallback(testMyPackageName, request, mUsageCallback);
}
@Test
public void testDumpSkDestroyListenerLogs() throws ErrnoException {
doAnswer((invocation) -> {