f014ae2f2a
The current implementation uses MANAGE_USERS, CREATE_USERS, or
QUERY_USERS to check if the user is an admin. However,
QUERY_USERS is not a privileged permission until Android U.
This can cause issues on devices running older Android versions
(e.g., T) where the tethering module requires this check but
doesn't have the necessary permission, leading to crashes.
This change updates the code to use MANAGE_USERS, a privileged
permission since 2015, to reliably determine if the user is
an admin across different Android versions.
Test: Manual on T device:
1. Mock entitlement and enable hotspot
2. Check granted permissions of android.uid.networkstack
Fix: 366816004
Change-Id: Iee060f0225d23c62d836f0211c63b649e539f77b
65 lines
3.5 KiB
XML
65 lines
3.5 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!--
|
|
/*
|
|
* Copyright (C) 2019 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
-->
|
|
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
|
|
package="com.android.networkstack.tethering"
|
|
android:sharedUserId="android.uid.networkstack">
|
|
|
|
<!-- Permissions must be defined here, and not in the base manifest, as the tethering
|
|
running in the system server process does not need any permission, and having
|
|
privileged permissions added would cause crashes on startup unless they are also
|
|
added to the privileged permissions allowlist for that package. EntitlementManager
|
|
would set exact alarm but declare SCHEDULE_EXACT_ALARM is not necessary here because
|
|
privilege application would be in the allowlist. -->
|
|
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
|
|
<uses-permission android:name="android.permission.BLUETOOTH" />
|
|
<uses-permission android:name="android.permission.BLUETOOTH_CONNECT" />
|
|
<uses-permission android:name="android.permission.BLUETOOTH_PRIVILEGED" />
|
|
<uses-permission android:name="android.permission.BROADCAST_STICKY" />
|
|
<uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
|
|
<uses-permission android:name="android.permission.INTERACT_ACROSS_USERS"/>
|
|
<uses-permission android:name="android.permission.MANAGE_USB" />
|
|
<!-- MANAGE_USERS is for accessing multi-user APIs, note that QUERY_USERS should
|
|
not be used since it is not a privileged permission until U. -->
|
|
<uses-permission android:name="android.permission.MANAGE_USERS"/>
|
|
<uses-permission android:name="android.permission.MODIFY_PHONE_STATE" />
|
|
<uses-permission android:name="android.permission.READ_DEVICE_CONFIG" />
|
|
<uses-permission android:name="android.permission.READ_NETWORK_USAGE_HISTORY" />
|
|
<uses-permission android:name="android.permission.READ_PHONE_STATE"/>
|
|
<uses-permission android:name="android.permission.TETHER_PRIVILEGED" />
|
|
<uses-permission android:name="android.permission.UPDATE_APP_OPS_STATS" />
|
|
<uses-permission android:name="android.permission.UPDATE_DEVICE_STATS" />
|
|
<uses-permission android:name="android.permission.WRITE_SETTINGS" />
|
|
<uses-permission android:name="android.permission.POST_NOTIFICATIONS"/>
|
|
|
|
<!-- Sending non-protected broadcast from system uid is not allowed. -->
|
|
<protected-broadcast android:name="com.android.server.connectivity.tethering.DISABLE_TETHERING" />
|
|
|
|
<application
|
|
android:process="com.android.networkstack.process"
|
|
android:extractNativeLibs="false"
|
|
android:persistent="true">
|
|
<service android:name="com.android.networkstack.tethering.TetheringService"
|
|
android:permission="android.permission.MAINLINE_NETWORK_STACK"
|
|
android:exported="true">
|
|
<intent-filter>
|
|
<action android:name="android.net.ITetheringConnector"/>
|
|
</intent-filter>
|
|
</service>
|
|
</application>
|
|
</manifest>
|