Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6f4f7061 authored by Jacky Kao's avatar Jacky Kao
Browse files

Don't allow an external service to be an A11y service 

When some applications create an external service and register this service
to be an A11y service, then this service can kill the system and restart
it continuously.
This is a security vulnerability and we add not allow an external service
to register as an A11y service to fix it.

Bug: 216115176
Test: a11y CTS & unit tests
Change-Id: If75b9c300df73e98be92d6c14d69301cc377b205
parent 5f5ab5a7

services/accessibility/java/com/android/server/accessibility/AccessibilitySecurityPolicy.java

+8 −0
Original line number Diff line number Diff line
@@ -647,6 +647,14 @@ public class AccessibilitySecurityPolicy { 
            return false;

        }



        if ((serviceInfo.flags & ServiceInfo.FLAG_EXTERNAL_SERVICE) != 0) {

            Slog.w(LOG_TAG, "Skipping accessibility service " + new ComponentName(

                    serviceInfo.packageName, serviceInfo.name).flattenToShortString()

                    + ": the service is the external one and doesn't allow to register as "

                    + "an accessibility service ");

            return false;

        }



        int servicePackageUid = serviceInfo.applicationInfo.uid;

        if (mAppOpsManager.noteOpNoThrow(AppOpsManager.OPSTR_BIND_ACCESSIBILITY_SERVICE,

                servicePackageUid, serviceInfo.packageName, null, null)

services/tests/servicestests/src/com/android/server/accessibility/AccessibilitySecurityPolicyTest.java

+12 −0
Original line number Diff line number Diff line
@@ -572,6 +572,18 @@ public class AccessibilitySecurityPolicyTest { 
                serviceInfo.applicationInfo.uid, serviceInfo.packageName, null, null);

    }



    @Test

    public void canRegisterService_isExternalService_returnFalse() {

        final ServiceInfo serviceInfo = new ServiceInfo();

        serviceInfo.applicationInfo = new ApplicationInfo();

        serviceInfo.packageName = PACKAGE_NAME;

        serviceInfo.name = AccessibilitySecurityPolicyTest.class.getSimpleName();

        serviceInfo.permission = android.Manifest.permission.BIND_ACCESSIBILITY_SERVICE;

        serviceInfo.flags |= ServiceInfo.FLAG_EXTERNAL_SERVICE;



        assertFalse(mA11ySecurityPolicy.canRegisterService(serviceInfo));

    }



    @Test

    public void checkAccessibilityAccess_shouldCheckAppOps() {

        final AccessibilityServiceInfo mockServiceInfo = Mockito.mock(