From a3882a238b6f73e90c0d866204d94f75085094de Mon Sep 17 00:00:00 2001 From: Michael Groover Date: Mon, 18 Nov 2024 23:28:24 -0600 Subject: [PATCH] Add WRITE_ALLOWLISTED_DEVICE_CONFIG perm when modifying DeviceConfig Android 16 introduces restrictions on the DeviceConfig flags that can be modified by the shell user by removing the WRITE_DEVICE_CONFIG permission from this user and replacing it with the WRITE_ALLOWLISTED_DEVICE_CONFIG permission; with this permission, only those flags that have been allowlisted can be modified. This commit adds the ALLOWLISTED permission to any test that explicitly adopts the shell permission identity with the WRITE_DEVICE_CONFIG permission; the WRITE_DEVICE_CONFIG permission is not removed to ensure tests do not break when run on previous platform releases without the ALLOWLISTED permission. Bug: 364083026 Flag: TEST_ONLY Test: Manually ran all modified tests Change-Id: Iad68063550f99f3dc78ac2f0483dad98a8a93f2e --- .../fastpair/src/android/nearby/cts/NearbyManagerTest.java | 3 ++- .../com/android/server/nearby/NearbyConfigurationTest.java | 4 +++- .../src/com/android/server/nearby/NearbyServiceTest.java | 4 +++- .../nearby/managers/BroadcastProviderManagerTest.java | 4 +++- .../server/nearby/provider/ChreCommunicationTest.java | 4 +++- .../server/nearby/provider/ChreDiscoveryProviderTest.java | 4 +++- .../devicetests/com/android/testutils/DeviceConfigRule.kt | 6 ++++-- .../app/src/com/android/cts/net/hostside/VpnTest.java | 5 +++-- .../net/src/android/net/cts/NetworkValidationTestUtil.kt | 3 ++- 9 files changed, 26 insertions(+), 11 deletions(-) diff --git a/nearby/tests/cts/fastpair/src/android/nearby/cts/NearbyManagerTest.java b/nearby/tests/cts/fastpair/src/android/nearby/cts/NearbyManagerTest.java index 1e3667645f..329122364d 100644 --- a/nearby/tests/cts/fastpair/src/android/nearby/cts/NearbyManagerTest.java +++ b/nearby/tests/cts/fastpair/src/android/nearby/cts/NearbyManagerTest.java @@ -18,6 +18,7 @@ package android.nearby.cts; import static android.Manifest.permission.BLUETOOTH_PRIVILEGED; import static android.Manifest.permission.READ_DEVICE_CONFIG; +import static android.Manifest.permission.WRITE_ALLOWLISTED_DEVICE_CONFIG; import static android.Manifest.permission.WRITE_DEVICE_CONFIG; import static android.nearby.PresenceCredential.IDENTITY_TYPE_PRIVATE; import static android.nearby.ScanCallback.ERROR_UNSUPPORTED; @@ -121,7 +122,7 @@ public class NearbyManagerTest { @Before public void setUp() { mUiAutomation.adoptShellPermissionIdentity(READ_DEVICE_CONFIG, WRITE_DEVICE_CONFIG, - BLUETOOTH_PRIVILEGED); + WRITE_ALLOWLISTED_DEVICE_CONFIG, BLUETOOTH_PRIVILEGED); String nameSpace = SdkLevel.isAtLeastU() ? DeviceConfig.NAMESPACE_NEARBY : DeviceConfig.NAMESPACE_TETHERING; DeviceConfig.setProperty(nameSpace, diff --git a/nearby/tests/unit/src/com/android/server/nearby/NearbyConfigurationTest.java b/nearby/tests/unit/src/com/android/server/nearby/NearbyConfigurationTest.java index 644e178fdd..e0dfd31e85 100644 --- a/nearby/tests/unit/src/com/android/server/nearby/NearbyConfigurationTest.java +++ b/nearby/tests/unit/src/com/android/server/nearby/NearbyConfigurationTest.java @@ -18,6 +18,7 @@ package com.android.server.nearby; import static android.Manifest.permission.READ_DEVICE_CONFIG; import static android.Manifest.permission.WRITE_DEVICE_CONFIG; +import static android.Manifest.permission.WRITE_ALLOWLISTED_DEVICE_CONFIG; import static com.android.server.nearby.NearbyConfiguration.NEARBY_ENABLE_PRESENCE_BROADCAST_LEGACY; import static com.android.server.nearby.NearbyConfiguration.NEARBY_MAINLINE_NANO_APP_MIN_VERSION; @@ -42,7 +43,8 @@ public final class NearbyConfigurationTest { @Before public void setUp() { InstrumentationRegistry.getInstrumentation().getUiAutomation() - .adoptShellPermissionIdentity(WRITE_DEVICE_CONFIG, READ_DEVICE_CONFIG); + .adoptShellPermissionIdentity(WRITE_DEVICE_CONFIG, WRITE_ALLOWLISTED_DEVICE_CONFIG, + READ_DEVICE_CONFIG); } @Test diff --git a/nearby/tests/unit/src/com/android/server/nearby/NearbyServiceTest.java b/nearby/tests/unit/src/com/android/server/nearby/NearbyServiceTest.java index 5b640cc35c..891e941782 100644 --- a/nearby/tests/unit/src/com/android/server/nearby/NearbyServiceTest.java +++ b/nearby/tests/unit/src/com/android/server/nearby/NearbyServiceTest.java @@ -19,6 +19,7 @@ package com.android.server.nearby; import static android.Manifest.permission.BLUETOOTH_PRIVILEGED; import static android.Manifest.permission.READ_DEVICE_CONFIG; import static android.Manifest.permission.WRITE_DEVICE_CONFIG; +import static android.Manifest.permission.WRITE_ALLOWLISTED_DEVICE_CONFIG; import static com.android.server.nearby.NearbyConfiguration.NEARBY_SUPPORT_TEST_APP; @@ -71,7 +72,8 @@ public final class NearbyServiceTest { when(mScanListener.asBinder()).thenReturn(mIBinder); mUiAutomation.adoptShellPermissionIdentity( - READ_DEVICE_CONFIG, WRITE_DEVICE_CONFIG, BLUETOOTH_PRIVILEGED); + READ_DEVICE_CONFIG, WRITE_DEVICE_CONFIG, WRITE_ALLOWLISTED_DEVICE_CONFIG, + BLUETOOTH_PRIVILEGED); mContext = InstrumentationRegistry.getInstrumentation().getContext(); mService = new NearbyService(mContext); mScanRequest = createScanRequest(); diff --git a/nearby/tests/unit/src/com/android/server/nearby/managers/BroadcastProviderManagerTest.java b/nearby/tests/unit/src/com/android/server/nearby/managers/BroadcastProviderManagerTest.java index 7ff7b13ab5..faa32c0d3e 100644 --- a/nearby/tests/unit/src/com/android/server/nearby/managers/BroadcastProviderManagerTest.java +++ b/nearby/tests/unit/src/com/android/server/nearby/managers/BroadcastProviderManagerTest.java @@ -18,6 +18,7 @@ package com.android.server.nearby.managers; import static android.Manifest.permission.READ_DEVICE_CONFIG; import static android.Manifest.permission.WRITE_DEVICE_CONFIG; +import static android.Manifest.permission.WRITE_ALLOWLISTED_DEVICE_CONFIG; import static com.android.server.nearby.NearbyConfiguration.NEARBY_ENABLE_PRESENCE_BROADCAST_LEGACY; import static com.android.server.nearby.NearbyConfiguration.NEARBY_SUPPORT_TEST_APP; @@ -88,7 +89,8 @@ public class BroadcastProviderManagerTest { @Before public void setUp() { when(mBroadcastListener.asBinder()).thenReturn(mBinder); - mUiAutomation.adoptShellPermissionIdentity(WRITE_DEVICE_CONFIG, READ_DEVICE_CONFIG); + mUiAutomation.adoptShellPermissionIdentity(WRITE_DEVICE_CONFIG, + WRITE_ALLOWLISTED_DEVICE_CONFIG, READ_DEVICE_CONFIG); DeviceConfig.setProperty( NAMESPACE, NEARBY_ENABLE_PRESENCE_BROADCAST_LEGACY, "true", false); DeviceConfig.setProperty( diff --git a/nearby/tests/unit/src/com/android/server/nearby/provider/ChreCommunicationTest.java b/nearby/tests/unit/src/com/android/server/nearby/provider/ChreCommunicationTest.java index ce479c86da..01028bfab6 100644 --- a/nearby/tests/unit/src/com/android/server/nearby/provider/ChreCommunicationTest.java +++ b/nearby/tests/unit/src/com/android/server/nearby/provider/ChreCommunicationTest.java @@ -18,6 +18,7 @@ package com.android.server.nearby.provider; import static android.Manifest.permission.READ_DEVICE_CONFIG; import static android.Manifest.permission.WRITE_DEVICE_CONFIG; +import static android.Manifest.permission.WRITE_ALLOWLISTED_DEVICE_CONFIG; import static com.android.server.nearby.NearbyConfiguration.NEARBY_MAINLINE_NANO_APP_MIN_VERSION; import static com.android.server.nearby.provider.ChreCommunication.INVALID_NANO_APP_VERSION; @@ -76,7 +77,8 @@ public class ChreCommunicationTest { @Before public void setUp() { InstrumentationRegistry.getInstrumentation().getUiAutomation() - .adoptShellPermissionIdentity(WRITE_DEVICE_CONFIG, READ_DEVICE_CONFIG); + .adoptShellPermissionIdentity(WRITE_DEVICE_CONFIG, WRITE_ALLOWLISTED_DEVICE_CONFIG, + READ_DEVICE_CONFIG); DeviceConfig.setProperty( NAMESPACE, NEARBY_MAINLINE_NANO_APP_MIN_VERSION, "1", false); diff --git a/nearby/tests/unit/src/com/android/server/nearby/provider/ChreDiscoveryProviderTest.java b/nearby/tests/unit/src/com/android/server/nearby/provider/ChreDiscoveryProviderTest.java index 590a46ed3f..7f391f100f 100644 --- a/nearby/tests/unit/src/com/android/server/nearby/provider/ChreDiscoveryProviderTest.java +++ b/nearby/tests/unit/src/com/android/server/nearby/provider/ChreDiscoveryProviderTest.java @@ -18,6 +18,7 @@ package com.android.server.nearby.provider; import static android.Manifest.permission.READ_DEVICE_CONFIG; import static android.Manifest.permission.WRITE_DEVICE_CONFIG; +import static android.Manifest.permission.WRITE_ALLOWLISTED_DEVICE_CONFIG; import static com.android.server.nearby.NearbyConfiguration.NEARBY_SUPPORT_TEST_APP; @@ -84,7 +85,8 @@ public class ChreDiscoveryProviderTest { @Before public void setUp() { InstrumentationRegistry.getInstrumentation().getUiAutomation() - .adoptShellPermissionIdentity(WRITE_DEVICE_CONFIG, READ_DEVICE_CONFIG); + .adoptShellPermissionIdentity(WRITE_DEVICE_CONFIG, WRITE_ALLOWLISTED_DEVICE_CONFIG, + READ_DEVICE_CONFIG); MockitoAnnotations.initMocks(this); Context context = InstrumentationRegistry.getInstrumentation().getContext(); diff --git a/staticlibs/testutils/devicetests/com/android/testutils/DeviceConfigRule.kt b/staticlibs/testutils/devicetests/com/android/testutils/DeviceConfigRule.kt index 785e55a0ba..044b410a0f 100644 --- a/staticlibs/testutils/devicetests/com/android/testutils/DeviceConfigRule.kt +++ b/staticlibs/testutils/devicetests/com/android/testutils/DeviceConfigRule.kt @@ -18,6 +18,7 @@ package com.android.testutils import android.Manifest.permission.READ_DEVICE_CONFIG import android.Manifest.permission.WRITE_DEVICE_CONFIG +import android.Manifest.permission.WRITE_ALLOWLISTED_DEVICE_CONFIG import android.provider.DeviceConfig import android.util.Log import com.android.modules.utils.build.SdkLevel @@ -87,7 +88,7 @@ class DeviceConfigRule @JvmOverloads constructor( } throw e } cleanupStep { - runAsShell(WRITE_DEVICE_CONFIG) { + runAsShell(WRITE_DEVICE_CONFIG, WRITE_ALLOWLISTED_DEVICE_CONFIG) { originalConfig.forEach { (key, value) -> Log.i(TAG, "Resetting config \"${key.second}\" to \"$value\"") DeviceConfig.setProperty( @@ -116,7 +117,8 @@ class DeviceConfigRule @JvmOverloads constructor( */ fun setConfig(namespace: String, key: String, value: String?): String? { Log.i(TAG, "Setting config \"$key\" to \"$value\"") - val readWritePermissions = arrayOf(READ_DEVICE_CONFIG, WRITE_DEVICE_CONFIG) + val readWritePermissions = + arrayOf(READ_DEVICE_CONFIG, WRITE_DEVICE_CONFIG, WRITE_ALLOWLISTED_DEVICE_CONFIG) val keyPair = Pair(namespace, key) val existingValue = runAsShell(*readWritePermissions) { diff --git a/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java b/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java index d05a8d075c..34301966f3 100755 --- a/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java +++ b/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java @@ -20,6 +20,7 @@ import static android.Manifest.permission.MANAGE_TEST_NETWORKS; import static android.Manifest.permission.NETWORK_SETTINGS; import static android.Manifest.permission.READ_DEVICE_CONFIG; import static android.Manifest.permission.WRITE_DEVICE_CONFIG; +import static android.Manifest.permission.WRITE_ALLOWLISTED_DEVICE_CONFIG; import static android.content.Context.RECEIVER_EXPORTED; import static android.content.pm.PackageManager.FEATURE_TELEPHONY; import static android.content.pm.PackageManager.FEATURE_WIFI; @@ -1209,7 +1210,7 @@ public class VpnTest { AUTOMATIC_ON_OFF_KEEPALIVE_VERSION, AUTOMATIC_ON_OFF_KEEPALIVE_ENABLED, false /* makeDefault */); return mode; - }, READ_DEVICE_CONFIG, WRITE_DEVICE_CONFIG); + }, READ_DEVICE_CONFIG, WRITE_DEVICE_CONFIG, WRITE_ALLOWLISTED_DEVICE_CONFIG); final IpSecManager ipSec = mTargetContext.getSystemService(IpSecManager.class); SocketKeepalive kp = null; @@ -1249,7 +1250,7 @@ public class VpnTest { AUTOMATIC_ON_OFF_KEEPALIVE_VERSION, origMode, false); mCM.setTestLowTcpPollingTimerForKeepalive(0); - }, WRITE_DEVICE_CONFIG, NETWORK_SETTINGS); + }, WRITE_DEVICE_CONFIG, WRITE_ALLOWLISTED_DEVICE_CONFIG, NETWORK_SETTINGS); } } diff --git a/tests/cts/net/src/android/net/cts/NetworkValidationTestUtil.kt b/tests/cts/net/src/android/net/cts/NetworkValidationTestUtil.kt index a0b40aa7d4..d3d4f4d9ee 100644 --- a/tests/cts/net/src/android/net/cts/NetworkValidationTestUtil.kt +++ b/tests/cts/net/src/android/net/cts/NetworkValidationTestUtil.kt @@ -17,6 +17,7 @@ package android.net.cts import android.Manifest.permission.WRITE_DEVICE_CONFIG +import android.Manifest.permission.WRITE_ALLOWLISTED_DEVICE_CONFIG import android.provider.DeviceConfig import android.provider.DeviceConfig.NAMESPACE_CONNECTIVITY import com.android.net.module.util.NetworkStackConstants @@ -33,7 +34,7 @@ internal object NetworkValidationTestUtil { * Clear the test network validation URLs. */ @JvmStatic fun clearValidationTestUrlsDeviceConfig() { - runAsShell(WRITE_DEVICE_CONFIG) { + runAsShell(WRITE_DEVICE_CONFIG, WRITE_ALLOWLISTED_DEVICE_CONFIG) { DeviceConfig.setProperty(NAMESPACE_CONNECTIVITY, NetworkStackConstants.TEST_CAPTIVE_PORTAL_HTTPS_URL, null, false) DeviceConfig.setProperty(NAMESPACE_CONNECTIVITY,