joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Clear the CallingIdentity before in the context of property check

Browse source 
Using packageManager from ConnectivityService context to get the caller
application info in binder calls can cause the permission issue. Calling
the Binder.clearCallingIdentity() before interact with packageManager
can fix the permission issue.

Test: atest CtsHostsideNetworkTests
Bug: 272165411
Change-Id: I0a289afc6fb0e42a92aa3ffa0c77ed396c4485c3
This commit is contained in:
Yuyang Huang 2023-03-13 12:27:40 +09:00
commit 2d13d437d0
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
service/src/com/android/server/ConnectivityService.java
View file

@ -911,7 +911,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
// This is the cache for the packageName -> ApplicationSelfCertifiedNetworkCapabilities. This
// value can be accessed from both handler thread and any random binder thread. Therefore,
// accessing this value requires holding a lock.
// accessing this value requires holding a lock. The cache is the same across all the users.
@GuardedBy("mSelfCertifiedCapabilityCache")
private final Map<String, ApplicationSelfCertifiedNetworkCapabilities>
mSelfCertifiedCapabilityCache = new HashMap<>();
@ -7001,6 +7001,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
return;
}
ApplicationSelfCertifiedNetworkCapabilities applicationNetworkCapabilities;
final long ident = Binder.clearCallingIdentity();
try {
synchronized (mSelfCertifiedCapabilityCache) {
applicationNetworkCapabilities = mSelfCertifiedCapabilityCache.get(
@ -7027,6 +7028,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
+ " property");
} catch (XmlPullParserException | IOException | InvalidTagException e) {
throw new SecurityException(e.getMessage());
} finally {
Binder.restoreCallingIdentity(ident);
}
applicationNetworkCapabilities.enforceSelfCertifiedNetworkCapabilitiesDeclared(