Disallow shell to mutate always-on vpn when DISALLOW_CONFIG_VPN user restriction is set (0181a6a6) · Commits · e / os / android_frameworks_base

packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java

+14 −3

Original line number	Diff line number	Diff line
		@@ -804,7 +804,8 @@ public class SettingsProvider extends ContentProvider {

		// If this is a setting that is currently restricted for this user, do not allow
		// unrestricting changes.
		if (isGlobalOrSecureSettingRestrictedForUser(name, callingUserId, value)) {
		if (isGlobalOrSecureSettingRestrictedForUser(name, callingUserId, value,
		Binder.getCallingUid())) {
		return false;
		}

		@@ -935,7 +936,8 @@ public class SettingsProvider extends ContentProvider {

		// If this is a setting that is currently restricted for this user, do not allow
		// unrestricting changes.
		if (isGlobalOrSecureSettingRestrictedForUser(name, callingUserId, value)) {
		if (isGlobalOrSecureSettingRestrictedForUser(name, callingUserId, value,
		Binder.getCallingUid())) {
		return false;
		}

		@@ -1158,7 +1160,7 @@ public class SettingsProvider extends ContentProvider {
		* @return true if the change is prohibited, false if the change is allowed.
		*/
		private boolean isGlobalOrSecureSettingRestrictedForUser(String setting, int userId,
		String value) {
		String value, int callingUid) {
		String restriction;
		switch (setting) {
		case Settings.Secure.LOCATION_MODE:
		@@ -1196,6 +1198,15 @@ public class SettingsProvider extends ContentProvider {
		restriction = UserManager.DISALLOW_CONFIG_MOBILE_NETWORKS;
		break;

		case Settings.Secure.ALWAYS_ON_VPN_APP:
		case Settings.Secure.ALWAYS_ON_VPN_LOCKDOWN:
		// Whitelist system uid (ConnectivityService) and root uid to change always-on vpn
		if (callingUid == Process.SYSTEM_UID \|\| callingUid == Process.ROOT_UID) {
		return false;
		}
		restriction = UserManager.DISALLOW_CONFIG_VPN;
		break;

		default:
		if (setting != null && setting.startsWith(Settings.Global.DATA_ROAMING)) {
		if ("0".equals(value)) return false;