joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Add helper method to enfore a package name belongs to an uid

Browse source 
This is no-op refactor to move utility methods from
ConnectivityService to a common place.

Test: atest NetworkStaticLibTests#com.android.net.moduletests.util.PermissionUtilsTest#testEnforcePackageNameMatchesUid
Bug: N/A
Change-Id: I5802dedcc91fa6e130a5c534bba5080ca37dbeec
This commit is contained in:
Junyu Lai 2024-01-16 11:19:43 +08:00
commit 8fdc4318c7
1 changed files with 62 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

23
service/src/com/android/server/ConnectivityService.java
View file

@ -3004,26 +3004,6 @@ public class ConnectivityService extends IConnectivityManager.Stub
return false;
}
private int getAppUid(final String app, final UserHandle user) {
final PackageManager pm =
mContext.createContextAsUser(user, 0 /* flags */).getPackageManager();
final long token = Binder.clearCallingIdentity();
try {
return pm.getPackageUid(app, 0 /* flags */);
} catch (PackageManager.NameNotFoundException e) {
return -1;
} finally {
Binder.restoreCallingIdentity(token);
}
}
private void verifyCallingUidAndPackage(String packageName, int callingUid) {
final UserHandle user = UserHandle.getUserHandleForUid(callingUid);
if (getAppUid(packageName, user) != callingUid) {
throw new SecurityException(packageName + " does not belong to uid " + callingUid);
}
}
/**
* Ensure that a network route exists to deliver traffic to the specified
* host via the specified network interface.
@ -3039,7 +3019,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
if (disallowedBecauseSystemCaller()) {
return false;
}
verifyCallingUidAndPackage(callingPackageName, mDeps.getCallingUid());
PermissionUtils.enforcePackageNameMatchesUid(
mContext, mDeps.getCallingUid(), callingPackageName);
enforceChangePermission(callingPackageName, callingAttributionTag);
if (mProtectedNetworks.contains(networkType)) {
enforceConnectivityRestrictedNetworksPermission(true /* checkUidsAllowedList */);