From 6f7013968b4eb5ed1d1aba0ff6c653dc6ebdbc21 Mon Sep 17 00:00:00 2001 From: Sandro Montanari Date: Tue, 7 Jan 2025 15:35:13 +0000 Subject: [PATCH] Add UPDATE_CONFIG permission check when start CTJob To prevent untrusted apps from abusing the CTDownloader. Flag: com.android.net.ct.flags.certificate_transparency_service Bug: 384869526 Test: atest NetworkSecurityUnitTests Change-Id: I7c701af673309a1fb854d690c85bfbf0b834fdc3 --- .../android/server/net/ct/CertificateTransparencyJob.java | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyJob.java b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyJob.java index baca2e3e69..9c92d14eb5 100644 --- a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyJob.java +++ b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyJob.java @@ -22,6 +22,7 @@ import android.content.BroadcastReceiver; import android.content.Context; import android.content.Intent; import android.content.IntentFilter; +import android.content.pm.PackageManager; import android.os.Build; import android.os.ConfigUpdate; import android.os.SystemClock; @@ -32,6 +33,7 @@ import android.util.Log; public class CertificateTransparencyJob extends BroadcastReceiver { private static final String TAG = "CertificateTransparencyJob"; + private static final String UPDATE_CONFIG_PERMISSION = "android.permission.UPDATE_CONFIG"; private final Context mContext; private final DataStore mDataStore; @@ -91,6 +93,11 @@ public class CertificateTransparencyJob extends BroadcastReceiver { Log.w(TAG, "Received unexpected broadcast with action " + intent); return; } + if (context.checkCallingOrSelfPermission(UPDATE_CONFIG_PERMISSION) + != PackageManager.PERMISSION_GRANTED) { + Log.e(TAG, "Caller does not have UPDATE_CONFIG permission."); + return; + } if (Config.DEBUG) { Log.d(TAG, "Starting CT daily job."); }