From ff65257bd07c791a5bfef2f54bf96ae224c03273 Mon Sep 17 00:00:00 2001 From: Patrick Rohr Date: Fri, 20 Dec 2024 09:52:33 -0800 Subject: [PATCH] Add missing permission check to offerNetwork The missing permission check means that an unauthorized app could have registered a network offer to intercept all NetworkRequests (by trivially guessing an existing provider ID) which would have leaked information about other apps on the system. This adds a NETWORK_FACTORY or MAINLINE_NETWORK_STACK permission check to offerNetwork per the API annotations in ConnectivityManager. Test networks can be offered when holding the MANAGE_TEST_NETWORKS permission which is consistent with similar APIs in this class. There can be no legitimate use of this API a) offerNetwork is @hide and only exposed via NetworkProvider, and b) it requires getting a provider ID by calling registerNetworkProvider which correctly enforces permissions. unofferNetwork does not currently require any permissions. Again, this is consistent with the API annotations in ConnectivityManager. Test: TH Change-Id: If71ce012f927a34c647d36b5eaf3723de2c01879 --- service/src/com/android/server/ConnectivityService.java | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java index bad7246fb2..544d309037 100644 --- a/service/src/com/android/server/ConnectivityService.java +++ b/service/src/com/android/server/ConnectivityService.java @@ -8897,6 +8897,11 @@ public class ConnectivityService extends IConnectivityManager.Stub Objects.requireNonNull(score); Objects.requireNonNull(caps); Objects.requireNonNull(callback); + if (caps.hasTransport(TRANSPORT_TEST)) { + enforceAnyPermissionOf(mContext, Manifest.permission.MANAGE_TEST_NETWORKS); + } else { + enforceNetworkFactoryPermission(); + } final boolean yieldToBadWiFi = caps.hasTransport(TRANSPORT_CELLULAR) && !avoidBadWifi(); final NetworkOffer offer = new NetworkOffer( FullScore.makeProspectiveScore(score, caps, yieldToBadWiFi),