Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4143779e authored by Paul Hu's avatar Paul Hu Committed by Automerger Merge Worker
Browse files

Merge "Revert "[RFPM04] Adjust hasRestrictedNetworkPermission method"" am: aad5331e 

Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1404653

Change-Id: I35fe76f9cfedf0619f64023e9111d9a50cc3c41c
parents 654c3284 aad5331e

services/core/java/com/android/server/connectivity/PermissionMonitor.java

+16 −17
Original line number Diff line number Diff line
@@ -171,8 +171,8 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse 
            mAllApps.add(UserHandle.getAppId(uid));



            final boolean isNetwork = hasPermission(CHANGE_NETWORK_STATE, uid);

            final boolean hasRestrictedPermission = hasRestrictedNetworkPermission(uid)

                    || isCarryoverPackage(app.applicationInfo);

            final boolean hasRestrictedPermission =

                    hasRestrictedNetworkPermission(app.applicationInfo);



            if (isNetwork || hasRestrictedPermission) {

                Boolean permission = mApps.get(uid);
@@ -200,7 +200,7 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse 
        for (int i = 0; i < systemPermission.size(); i++) {

            ArraySet<String> perms = systemPermission.valueAt(i);

            int uid = systemPermission.keyAt(i);

            int netdPermission = PERMISSION_NONE;

            int netdPermission = 0;

            // Get the uids of native services that have UPDATE_DEVICE_STATS or INTERNET permission.

            if (perms != null) {

                netdPermission |= perms.contains(UPDATE_DEVICE_STATS)
@@ -225,21 +225,20 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse 
    }



    @VisibleForTesting

    // TODO : remove this check in the future(b/162295056). All apps should just request the

    // appropriate permission for their use case since android Q.

    boolean isCarryoverPackage(@Nullable final ApplicationInfo appInfo) {

    boolean hasRestrictedNetworkPermission(@Nullable final ApplicationInfo appInfo) {

        if (appInfo == null)  return false;

        return (appInfo.targetSdkVersion < VERSION_Q && isVendorApp(appInfo))

        // TODO : remove this check in the future(b/162295056). All apps should just

        // request the appropriate permission for their use case since android Q.

        if ((appInfo.targetSdkVersion < VERSION_Q && isVendorApp(appInfo))

                // Backward compatibility for b/114245686, on devices that launched before Q daemons

                // and apps running as the system UID are exempted from this check.

                || (appInfo.uid == SYSTEM_UID && mDeps.getDeviceFirstSdkInt() < VERSION_Q);

                || (appInfo.uid == SYSTEM_UID && mDeps.getDeviceFirstSdkInt() < VERSION_Q)) {

            return true;

        }



    @VisibleForTesting

    boolean hasRestrictedNetworkPermission(final int uid) {

        return hasPermission(CONNECTIVITY_USE_RESTRICTED_NETWORKS, uid)

                || hasPermission(PERMISSION_MAINLINE_NETWORK_STACK, uid)

                || hasPermission(NETWORK_STACK, uid);

        return hasPermission(PERMISSION_MAINLINE_NETWORK_STACK, appInfo.uid)

                || hasPermission(NETWORK_STACK, appInfo.uid)

                || hasPermission(CONNECTIVITY_USE_RESTRICTED_NETWORKS, appInfo.uid);

    }



    /** Returns whether the given uid has using background network permission. */
@@ -329,8 +328,8 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse 
        try {

            final PackageInfo app = mPackageManager.getPackageInfo(name, GET_PERMISSIONS);

            final boolean isNetwork = hasPermission(CHANGE_NETWORK_STATE, uid);

            final boolean hasRestrictedPermission = hasRestrictedNetworkPermission(uid)

                    || isCarryoverPackage(app.applicationInfo);

            final boolean hasRestrictedPermission =

                    hasRestrictedNetworkPermission(app.applicationInfo);

            if (isNetwork || hasRestrictedPermission) {

                currentPermission = hasRestrictedPermission;

            }

tests/net/java/com/android/server/connectivity/PermissionMonitorTest.java

+65 −59
Original line number Diff line number Diff line
@@ -28,7 +28,6 @@ import static android.content.pm.ApplicationInfo.PRIVATE_FLAG_PRODUCT; 
import static android.content.pm.ApplicationInfo.PRIVATE_FLAG_VENDOR;

import static android.content.pm.PackageManager.GET_PERMISSIONS;

import static android.content.pm.PackageManager.MATCH_ANY_USER;

import static android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK;

import static android.os.Process.SYSTEM_UID;



import static com.android.server.connectivity.PermissionMonitor.NETWORK;
@@ -139,10 +138,17 @@ public class PermissionMonitorTest { 
        verify(mMockPmi).getPackageList(mPermissionMonitor);

    }



    private boolean wouldBeCarryoverPackage(String partition, int targetSdkVersion, int uid) {

    /**

     * Remove all permissions from the uid then build new package info and setup permissions to uid

     * for checking restricted network permission.

     */

    private boolean hasRestrictedNetworkPermission(String partition, int targetSdkVersion, int uid,

            String... permissions) {

        final PackageInfo packageInfo = buildPackageInfo(partition, uid, MOCK_USER1);

        packageInfo.applicationInfo.targetSdkVersion = targetSdkVersion;

        return mPermissionMonitor.isCarryoverPackage(packageInfo.applicationInfo);

        removeAllPermissions(uid);

        addPermissions(uid, permissions);

        return mPermissionMonitor.hasRestrictedNetworkPermission(packageInfo.applicationInfo);

    }



    private static PackageInfo packageInfoWithPartition(String partition) {
@@ -222,57 +228,61 @@ public class PermissionMonitorTest { 
        assertTrue(mPermissionMonitor.isVendorApp(app.applicationInfo));

    }



    /**

     * Remove all permissions from the uid then setup permissions to uid for checking restricted

     * network permission.

     */

    private void assertRestrictedNetworkPermission(boolean hasPermission, int uid,

            String... permissions) {

        removeAllPermissions(uid);

        addPermissions(uid, permissions);

        assertEquals(hasPermission, mPermissionMonitor.hasRestrictedNetworkPermission(uid));

    }



    @Test

    public void testHasRestrictedNetworkPermission() {

        assertRestrictedNetworkPermission(false, MOCK_UID1);

        assertRestrictedNetworkPermission(false, MOCK_UID1, CHANGE_NETWORK_STATE);

        assertRestrictedNetworkPermission(true, MOCK_UID1, NETWORK_STACK);

        assertRestrictedNetworkPermission(false, MOCK_UID1, CONNECTIVITY_INTERNAL);

        assertRestrictedNetworkPermission(true, MOCK_UID1, CONNECTIVITY_USE_RESTRICTED_NETWORKS);

        assertRestrictedNetworkPermission(false, MOCK_UID1, CHANGE_WIFI_STATE);

        assertRestrictedNetworkPermission(true, MOCK_UID1, PERMISSION_MAINLINE_NETWORK_STACK);



        assertFalse(mPermissionMonitor.hasRestrictedNetworkPermission(MOCK_UID2));

        assertFalse(mPermissionMonitor.hasRestrictedNetworkPermission(SYSTEM_UID));

        assertFalse(hasRestrictedNetworkPermission(PARTITION_SYSTEM, VERSION_P, MOCK_UID1));

        assertFalse(hasRestrictedNetworkPermission(

                PARTITION_SYSTEM, VERSION_P, MOCK_UID1, CHANGE_NETWORK_STATE));

        assertTrue(hasRestrictedNetworkPermission(

                PARTITION_SYSTEM, VERSION_P, MOCK_UID1, NETWORK_STACK));

        assertFalse(hasRestrictedNetworkPermission(

                PARTITION_SYSTEM, VERSION_P, MOCK_UID1, CONNECTIVITY_INTERNAL));

        assertTrue(hasRestrictedNetworkPermission(

                PARTITION_SYSTEM, VERSION_P, MOCK_UID1, CONNECTIVITY_USE_RESTRICTED_NETWORKS));

        assertFalse(hasRestrictedNetworkPermission(

                PARTITION_SYSTEM, VERSION_P, MOCK_UID1, CHANGE_WIFI_STATE));



        assertFalse(hasRestrictedNetworkPermission(PARTITION_SYSTEM, VERSION_Q, MOCK_UID1));

        assertFalse(hasRestrictedNetworkPermission(

                PARTITION_SYSTEM, VERSION_Q, MOCK_UID1, CONNECTIVITY_INTERNAL));

    }



    @Test

    public void testIsCarryoverPackage() {

    public void testHasRestrictedNetworkPermissionSystemUid() {

        doReturn(VERSION_P).when(mDeps).getDeviceFirstSdkInt();

        assertTrue(wouldBeCarryoverPackage(PARTITION_SYSTEM, VERSION_P, SYSTEM_UID));

        assertTrue(wouldBeCarryoverPackage(PARTITION_VENDOR, VERSION_P, SYSTEM_UID));

        assertFalse(wouldBeCarryoverPackage(PARTITION_SYSTEM, VERSION_P, MOCK_UID1));

        assertTrue(wouldBeCarryoverPackage(PARTITION_VENDOR, VERSION_P, MOCK_UID1));

        assertTrue(wouldBeCarryoverPackage(PARTITION_SYSTEM, VERSION_Q, SYSTEM_UID));

        assertTrue(wouldBeCarryoverPackage(PARTITION_VENDOR, VERSION_Q, SYSTEM_UID));

        assertFalse(wouldBeCarryoverPackage(PARTITION_SYSTEM, VERSION_Q, MOCK_UID1));

        assertFalse(wouldBeCarryoverPackage(PARTITION_VENDOR, VERSION_Q, MOCK_UID1));

        assertTrue(hasRestrictedNetworkPermission(PARTITION_SYSTEM, VERSION_P, SYSTEM_UID));

        assertTrue(hasRestrictedNetworkPermission(

                PARTITION_SYSTEM, VERSION_P, SYSTEM_UID, CONNECTIVITY_INTERNAL));

        assertTrue(hasRestrictedNetworkPermission(

                PARTITION_SYSTEM, VERSION_P, SYSTEM_UID, CONNECTIVITY_USE_RESTRICTED_NETWORKS));



        doReturn(VERSION_Q).when(mDeps).getDeviceFirstSdkInt();

        assertFalse(wouldBeCarryoverPackage(PARTITION_SYSTEM, VERSION_P, SYSTEM_UID));

        assertTrue(wouldBeCarryoverPackage(PARTITION_VENDOR, VERSION_P, SYSTEM_UID));

        assertFalse(wouldBeCarryoverPackage(PARTITION_SYSTEM, VERSION_P, MOCK_UID1));

        assertTrue(wouldBeCarryoverPackage(PARTITION_VENDOR, VERSION_P, MOCK_UID1));

        assertFalse(wouldBeCarryoverPackage(PARTITION_SYSTEM, VERSION_Q, SYSTEM_UID));

        assertFalse(wouldBeCarryoverPackage(PARTITION_VENDOR, VERSION_Q, SYSTEM_UID));

        assertFalse(wouldBeCarryoverPackage(PARTITION_SYSTEM, VERSION_Q, MOCK_UID1));

        assertFalse(wouldBeCarryoverPackage(PARTITION_VENDOR, VERSION_Q, MOCK_UID1));

        assertFalse(hasRestrictedNetworkPermission(PARTITION_SYSTEM, VERSION_Q, SYSTEM_UID));

        assertFalse(hasRestrictedNetworkPermission(

                PARTITION_SYSTEM, VERSION_Q, SYSTEM_UID, CONNECTIVITY_INTERNAL));

        assertTrue(hasRestrictedNetworkPermission(

                PARTITION_SYSTEM, VERSION_Q, SYSTEM_UID, CONNECTIVITY_USE_RESTRICTED_NETWORKS));

    }



        assertFalse(wouldBeCarryoverPackage(PARTITION_OEM, VERSION_Q, SYSTEM_UID));

        assertFalse(wouldBeCarryoverPackage(PARTITION_PRODUCT, VERSION_Q, SYSTEM_UID));

        assertFalse(wouldBeCarryoverPackage(PARTITION_OEM, VERSION_Q, MOCK_UID1));

        assertFalse(wouldBeCarryoverPackage(PARTITION_PRODUCT, VERSION_Q, MOCK_UID1));

    @Test

    public void testHasRestrictedNetworkPermissionVendorApp() {

        assertTrue(hasRestrictedNetworkPermission(PARTITION_VENDOR, VERSION_P, MOCK_UID1));

        assertTrue(hasRestrictedNetworkPermission(

                PARTITION_VENDOR, VERSION_P, MOCK_UID1, CHANGE_NETWORK_STATE));

        assertTrue(hasRestrictedNetworkPermission(

                PARTITION_VENDOR, VERSION_P, MOCK_UID1, NETWORK_STACK));

        assertTrue(hasRestrictedNetworkPermission(

                PARTITION_VENDOR, VERSION_P, MOCK_UID1, CONNECTIVITY_INTERNAL));

        assertTrue(hasRestrictedNetworkPermission(

                PARTITION_VENDOR, VERSION_P, MOCK_UID1, CONNECTIVITY_USE_RESTRICTED_NETWORKS));

        assertTrue(hasRestrictedNetworkPermission(

                PARTITION_VENDOR, VERSION_P, MOCK_UID1, CHANGE_WIFI_STATE));



        assertFalse(hasRestrictedNetworkPermission(PARTITION_VENDOR, VERSION_Q, MOCK_UID1));

        assertFalse(hasRestrictedNetworkPermission(

                PARTITION_VENDOR, VERSION_Q, MOCK_UID1, CONNECTIVITY_INTERNAL));

        assertFalse(hasRestrictedNetworkPermission(

                PARTITION_VENDOR, VERSION_Q, MOCK_UID1, CHANGE_NETWORK_STATE));

    }



    private void assertBackgroundPermission(boolean hasPermission, String name, int uid,
@@ -286,23 +296,19 @@ public class PermissionMonitorTest { 


    @Test

    public void testHasUseBackgroundNetworksPermission() throws Exception {

        doReturn(VERSION_Q).when(mDeps).getDeviceFirstSdkInt();

        assertFalse(mPermissionMonitor.hasUseBackgroundNetworksPermission(SYSTEM_UID));

        assertBackgroundPermission(false, "system1", SYSTEM_UID);

        assertBackgroundPermission(false, "system2", SYSTEM_UID, CONNECTIVITY_INTERNAL);

        assertBackgroundPermission(true, "system3", SYSTEM_UID, CHANGE_NETWORK_STATE);



        assertFalse(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID1));

        assertBackgroundPermission(false, "mock1", MOCK_UID1);

        assertBackgroundPermission(false, "mock2", MOCK_UID1, CONNECTIVITY_INTERNAL);

        assertBackgroundPermission(true, "mock3", MOCK_UID1, NETWORK_STACK);

        assertBackgroundPermission(true, "mock2", MOCK_UID1, CONNECTIVITY_USE_RESTRICTED_NETWORKS);



        assertFalse(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID2));

        assertBackgroundPermission(false, "mock4", MOCK_UID2);

        assertBackgroundPermission(true, "mock5", MOCK_UID2,

                CONNECTIVITY_USE_RESTRICTED_NETWORKS);



        doReturn(VERSION_Q).when(mDeps).getDeviceFirstSdkInt();

        assertFalse(mPermissionMonitor.hasUseBackgroundNetworksPermission(SYSTEM_UID));

        assertBackgroundPermission(false, "system1", SYSTEM_UID);

        assertBackgroundPermission(true, "system2", SYSTEM_UID, CHANGE_NETWORK_STATE);

        doReturn(VERSION_P).when(mDeps).getDeviceFirstSdkInt();

        removeAllPermissions(SYSTEM_UID);

        assertBackgroundPermission(true, "system3", SYSTEM_UID);

        assertBackgroundPermission(false, "mock3", MOCK_UID2, CONNECTIVITY_INTERNAL);

        assertBackgroundPermission(true, "mock4", MOCK_UID2, NETWORK_STACK);

    }



    private class NetdMonitor {