joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Add UPDATE_CONFIG permission check when start CTJob

Browse source 
To prevent untrusted apps from abusing the CTDownloader.

Flag: com.android.net.ct.flags.certificate_transparency_service
Bug: 384869526
Test: atest NetworkSecurityUnitTests
Change-Id: I7c701af673309a1fb854d690c85bfbf0b834fdc3
This commit is contained in:
Sandro Montanari 2025-01-07 15:35:13 +00:00
commit 6f7013968b
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyJob.java
View file

@ -22,6 +22,7 @@ import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.content.IntentFilter;
import android.content.pm.PackageManager;
import android.os.Build;
import android.os.ConfigUpdate;
import android.os.SystemClock;
@ -32,6 +33,7 @@ import android.util.Log;
public class CertificateTransparencyJob extends BroadcastReceiver {
private static final String TAG = "CertificateTransparencyJob";
private static final String UPDATE_CONFIG_PERMISSION = "android.permission.UPDATE_CONFIG";
private final Context mContext;
private final DataStore mDataStore;
@ -91,6 +93,11 @@ public class CertificateTransparencyJob extends BroadcastReceiver {
Log.w(TAG, "Received unexpected broadcast with action " + intent);
return;
}
if (context.checkCallingOrSelfPermission(UPDATE_CONFIG_PERMISSION)
!= PackageManager.PERMISSION_GRANTED) {
Log.e(TAG, "Caller does not have UPDATE_CONFIG permission.");
return;
}
if (Config.DEBUG) {
Log.d(TAG, "Starting CT daily job.");
}