joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Use NETWORK_STACK permission for broadcast receivers

Browse source 
Use the NETWORK_STACK permission instead of null when registering
broadcast receivers in ConnectivityService, PermissionMonitor and
BroadcastReceiveHelper.
This ensures that only components with the NETWORK_STACK permission
can send these protected broadcasts, improving system security.
Tests were updated to reflect the new permission requirement.

Flag: EXEMPT trivial change
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.BroadcastReceiveHelperTest \
      ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.PermissionMonitorTest \
      --update-device
Fix: 425828059
Change-Id: I9761f9f454751761b346e255aac0d1c7d7a7e30c
This commit is contained in:
Junyu Lai 2025-06-28 02:34:14 +08:00
commit ca5a062321
5 changed files with 12 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

2
service/src/com/android/server/ConnectivityService.java
View file

@ -2174,7 +2174,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
final IntentFilter dataSaverIntentFilter =
new IntentFilter(ACTION_RESTRICT_BACKGROUND_CHANGED);
mUserAllContext.registerReceiver(mDataSaverReceiver, dataSaverIntentFilter,
null /* broadcastPermission */, mHandler);
android.Manifest.permission.NETWORK_STACK, mHandler);
}
// TrackMultiNetworkActivities feature should be enabled by trunk stable flag.

8
service/src/com/android/server/connectivity/BroadcastReceiveHelper.java
View file

@ -16,6 +16,8 @@
package com.android.server.connectivity;
import static android.Manifest.permission.NETWORK_STACK;
import android.annotation.NonNull;
import android.annotation.SuppressLint;
import android.content.BroadcastReceiver;
@ -134,7 +136,7 @@ public class BroadcastReceiveHelper {
userIntentFilter.addAction(Intent.ACTION_USER_ADDED);
userIntentFilter.addAction(Intent.ACTION_USER_REMOVED);
userAllContext.registerReceiver(mUserIntentReceiver, userIntentFilter,
null /* broadcastPermission */, mHandler);
NETWORK_STACK, mHandler);
// Listen to package change events.
final IntentFilter packageIntentFilter = new IntentFilter();
@ -143,7 +145,7 @@ public class BroadcastReceiveHelper {
packageIntentFilter.addAction(Intent.ACTION_PACKAGE_REPLACED);
packageIntentFilter.addDataScheme("package");
userAllContext.registerReceiver(mPackageIntentReceiver, packageIntentFilter,
null /* broadcastPermission */, mHandler);
NETWORK_STACK, mHandler);
// For PermissionMonitor, listen to EXTERNAL_APPLICATIONS_AVAILABLE is that an app
// becoming available means it may need to gain a permission. But an app that becomes
@ -152,7 +154,7 @@ public class BroadcastReceiveHelper {
final IntentFilter externalIntentFilter =
new IntentFilter(Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE);
userAllContext.registerReceiver(mExternalAppIntentReceiver, externalIntentFilter,
null /* broadcastPermission */, mHandler);
NETWORK_STACK, mHandler);
}
/**

6
service/src/com/android/server/connectivity/PermissionMonitor.java
View file

@ -489,7 +489,7 @@ public class PermissionMonitor {
intentFilter.addAction(Intent.ACTION_PACKAGE_REMOVED);
intentFilter.addDataScheme("package");
userAllContext.registerReceiver(
mIntentReceiver, intentFilter, null /* broadcastPermission */, handler);
mIntentReceiver, intentFilter, NETWORK_STACK, handler);
// Listen to EXTERNAL_APPLICATIONS_AVAILABLE is that an app becoming
// available means it may need to gain a permission. But an app that
@ -499,14 +499,14 @@ public class PermissionMonitor {
final IntentFilter externalIntentFilter =
new IntentFilter(Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE);
userAllContext.registerReceiver(
mIntentReceiver, externalIntentFilter, null /* broadcastPermission */, handler);
mIntentReceiver, externalIntentFilter, NETWORK_STACK, handler);
// Listen for user add/remove.
final IntentFilter userIntentFilter = new IntentFilter();
userIntentFilter.addAction(Intent.ACTION_USER_ADDED);
userIntentFilter.addAction(Intent.ACTION_USER_REMOVED);
userAllContext.registerReceiver(
mIntentReceiver, userIntentFilter, null /* broadcastPermission */, handler);
mIntentReceiver, userIntentFilter, NETWORK_STACK, handler);
}
// Register UIDS_ALLOWED_ON_RESTRICTED_NETWORKS setting observer

4
tests/unit/java/com/android/server/connectivity/BroadcastReceiveHelperTest.kt
View file

@ -16,6 +16,7 @@
package com.android.server.connectivity
import android.Manifest.permission.NETWORK_STACK
import android.content.BroadcastReceiver
import android.content.Context
import android.content.Intent
@ -33,7 +34,6 @@ import android.os.Handler
import android.os.HandlerThread
import android.os.UserHandle
import android.os.UserManager
import com.android.compatibility.common.util.MoreMatchers.anyOrNull
import com.android.server.connectivity.BroadcastReceiveHelper.Delegate
import com.android.testutils.DevSdkIgnoreRunner
import com.android.testutils.waitForIdle
@ -95,7 +95,7 @@ class BroadcastReceiveHelperTest {
verify(mockContext, times(1)).registerReceiver(
receiverCaptor.capture(),
argThat { it.hasAction(action) },
anyOrNull(String::class.java),
eq(NETWORK_STACK),
eq(handler)
)
// Return the first match.

2
tests/unit/java/com/android/server/connectivity/PermissionMonitorTest.java
View file

@ -1462,7 +1462,7 @@ public class PermissionMonitorTest {
}
}
return true;
}), any(), any());
}), eq(NETWORK_STACK), any());
final BroadcastReceiver originalReceiver = receiverCaptor.getValue();
return new BroadcastReceiver() {
@Override