joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Add missing permission check to offerNetwork

Browse source 
The missing permission check means that an unauthorized app could
have registered a network offer to intercept all NetworkRequests (by
trivially guessing an existing provider ID) which would have leaked
information about other apps on the system.

This adds a NETWORK_FACTORY or MAINLINE_NETWORK_STACK permission check
to offerNetwork per the API annotations in ConnectivityManager.
Test networks can be offered when holding the MANAGE_TEST_NETWORKS
permission which is consistent with similar APIs in this class.

There can be no legitimate use of this API a) offerNetwork is @hide
and only exposed via NetworkProvider, and b) it requires getting a
provider ID by calling registerNetworkProvider which correctly enforces
permissions.

unofferNetwork does not currently require any permissions. Again, this
is consistent with the API annotations in ConnectivityManager.

Test: TH
Change-Id: If71ce012f927a34c647d36b5eaf3723de2c01879
This commit is contained in:
Patrick Rohr 2024-12-20 09:52:33 -08:00
commit ff65257bd0
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
service/src/com/android/server/ConnectivityService.java
View file

@ -8897,6 +8897,11 @@ public class ConnectivityService extends IConnectivityManager.Stub
Objects.requireNonNull(score);
Objects.requireNonNull(caps);
Objects.requireNonNull(callback);
if (caps.hasTransport(TRANSPORT_TEST)) {
enforceAnyPermissionOf(mContext, Manifest.permission.MANAGE_TEST_NETWORKS);
} else {
enforceNetworkFactoryPermission();
}
final boolean yieldToBadWiFi = caps.hasTransport(TRANSPORT_CELLULAR) && !avoidBadWifi();
final NetworkOffer offer = new NetworkOffer(
FullScore.makeProspectiveScore(score, caps, yieldToBadWiFi),