Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 58c07921 authored by Lucas Lin's avatar Lucas Lin Committed by Automerger Merge Worker
Browse files

Merge "Grant the ACTIVATE_PLATFORM_VPN appop if VPN app has CONTROL_VPN" am: 41142d72 

Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/2141595



Change-Id: I4b7c0e255e10015cb7680106fdeb6b17b89e49fd
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents b0bbe9b5 41142d72

services/core/java/com/android/server/connectivity/Vpn.java

+9 −3
Original line number Diff line number Diff line
@@ -1095,7 +1095,7 @@ public class Vpn { 
        // Except for Settings and VpnDialogs, the caller should be matched one of oldPackage or

        // newPackage. Otherwise, non VPN owner might get the VPN always-on status of the VPN owner.

        // See b/191382886.

        if (mContext.checkCallingOrSelfPermission(CONTROL_VPN) != PERMISSION_GRANTED) {

        if (!hasControlVpnPermission()) {

            if (oldPackage != null) {

                verifyCallingUidAndPackage(oldPackage);

            }
@@ -2045,6 +2045,10 @@ public class Vpn { 
                "Unauthorized Caller");

    }



    private boolean hasControlVpnPermission() {

        return mContext.checkCallingOrSelfPermission(CONTROL_VPN) == PERMISSION_GRANTED;

    }



    private class Connection implements ServiceConnection {

        private IBinder mService;
@@ -3846,8 +3850,10 @@ public class Vpn { 
            Binder.restoreCallingIdentity(token);

        }



        // TODO: if package has CONTROL_VPN, grant the ACTIVATE_PLATFORM_VPN appop.

        // This mirrors the prepareAndAuthorize that is used by VpnService.

        // If package has CONTROL_VPN, grant the ACTIVATE_PLATFORM_VPN appop.

        if (hasControlVpnPermission()) {

            setPackageAuthorization(packageName, VpnManager.TYPE_VPN_PLATFORM);

        }



        // Return whether the app is already pre-consented

        return isVpnProfilePreConsented(mContext, packageName);