joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Add more powerful CTS for allowedUids

Browse source 
This tests that the network providers are subject to appropriate
limitations as to what they can set as allowedUids – both in the
positive (can do) case, and the negative (can't do) case.

Test: this
Change-Id: I115e2a4bc02ddcd03ecf2f35130fcb0378da22bd
This commit is contained in:
Chalard Jean 2022-11-24 17:13:44 +09:00
commit 5301778ad8
1 changed files with 455 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

15
service/src/com/android/server/ConnectivityService.java
View file

@ -2649,6 +2649,13 @@ public class ConnectivityService extends IConnectivityManager.Stub
}
}
private boolean canSeeAllowedUids(final int pid, final int uid, final int netOwnerUid) {
return Process.SYSTEM_UID == uid
|| netOwnerUid == uid
|| checkAnyPermissionOf(mContext, pid, uid,
android.Manifest.permission.NETWORK_FACTORY);
}
@VisibleForTesting
NetworkCapabilities networkCapabilitiesRestrictedForCallerPermissions(
NetworkCapabilities nc, int callerPid, int callerUid) {
@ -2670,8 +2677,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK)) {
newNc.setAdministratorUids(new int[0]);
}
if (!checkAnyPermissionOf(mContext,
callerPid, callerUid, android.Manifest.permission.NETWORK_FACTORY)) {
if (!canSeeAllowedUids(callerPid, callerUid, newNc.getOwnerUid())) {
newNc.setAllowedUids(new ArraySet<>());
newNc.setSubscriptionIds(Collections.emptySet());
}
@ -3944,6 +3950,11 @@ public class ConnectivityService extends IConnectivityManager.Stub
pw.println();
dumpBpfProgramStatus(pw);
if (null != mCarrierPrivilegeAuthenticator) {
pw.println();
mCarrierPrivilegeAuthenticator.dump(pw);
}
pw.println();
if (!CollectionUtils.contains(args, SHORT_ARG)) {