378fd10aa7
ActivityManager checks if there is any non-protected broadcast
sent from the system to prevent malwares sending the fake intent.
This could be fixed with declaring it as a protected broadcast
which is the current implementation. However, the uid in the
AndroidManifest for tethering is networkstack uid. Though system
only check whether the intent is defined as protected broadcast
or not regardless of where the protected intent is defined, it
is confusing to define the protected intent in tethering
AndroidManifest. Thus, update to alternative way to fulfill
the protection in ActivityManager to declare the required
permission in the broadcast filter and specify the expected
package name of the intent.
Bug: 269383522
Bug: 259000745
Test: atest FrameworksNetTests
Test: manually check no am_wtf log complains sending non-protected
broadcast from system
Change-Id: I04986aed4fb92f85adcbac8a61665f3f465e2eab
61 lines
3.2 KiB
XML
61 lines
3.2 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!--
|
|
/*
|
|
* Copyright (C) 2019 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
-->
|
|
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
|
|
package="com.android.networkstack.tethering"
|
|
android:sharedUserId="android.uid.networkstack">
|
|
|
|
<!-- Permissions must be defined here, and not in the base manifest, as the tethering
|
|
running in the system server process does not need any permission, and having
|
|
privileged permissions added would cause crashes on startup unless they are also
|
|
added to the privileged permissions allowlist for that package. EntitlementManager
|
|
would set exact alarm but declare SCHEDULE_EXACT_ALARM is not necessary here because
|
|
privilege application would be in the allowlist. -->
|
|
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
|
|
<uses-permission android:name="android.permission.BLUETOOTH" />
|
|
<uses-permission android:name="android.permission.BLUETOOTH_CONNECT" />
|
|
<uses-permission android:name="android.permission.BLUETOOTH_PRIVILEGED" />
|
|
<uses-permission android:name="android.permission.BROADCAST_STICKY" />
|
|
<uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
|
|
<uses-permission android:name="android.permission.MANAGE_USB" />
|
|
<uses-permission android:name="android.permission.MODIFY_PHONE_STATE" />
|
|
<uses-permission android:name="android.permission.READ_DEVICE_CONFIG" />
|
|
<uses-permission android:name="android.permission.READ_NETWORK_USAGE_HISTORY" />
|
|
<uses-permission android:name="android.permission.READ_PHONE_STATE"/>
|
|
<uses-permission android:name="android.permission.TETHER_PRIVILEGED" />
|
|
<uses-permission android:name="android.permission.UPDATE_APP_OPS_STATS" />
|
|
<uses-permission android:name="android.permission.UPDATE_DEVICE_STATS" />
|
|
<uses-permission android:name="android.permission.WRITE_SETTINGS" />
|
|
<uses-permission android:name="android.permission.POST_NOTIFICATIONS"/>
|
|
|
|
<!-- Sending non-protected broadcast from system uid is not allowed. -->
|
|
<protected-broadcast android:name="com.android.server.connectivity.tethering.DISABLE_TETHERING" />
|
|
|
|
<application
|
|
android:process="com.android.networkstack.process"
|
|
android:extractNativeLibs="false"
|
|
android:persistent="true">
|
|
<service android:name="com.android.networkstack.tethering.TetheringService"
|
|
android:permission="android.permission.MAINLINE_NETWORK_STACK"
|
|
android:exported="true">
|
|
<intent-filter>
|
|
<action android:name="android.net.ITetheringConnector"/>
|
|
</intent-filter>
|
|
</service>
|
|
</application>
|
|
</manifest>
|