Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8cabf350 authored by Benedict Wong's avatar Benedict Wong Committed by Automerger Merge Worker
Browse files

Merge "Set correct owner UID for VPN agentConnect()" am: 7efd5a48 

Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1326493

Change-Id: I04609b41c9e878e1e3ca8f128d86290012d4ede7
parents a7d0cbe7 7efd5a48

core/java/android/net/NetworkCapabilities.java

+22 −5
Original line number Diff line number Diff line
@@ -900,9 +900,17 @@ public final class NetworkCapabilities implements Parcelable { 
     * <p>For NetworkCapability instances being sent from ConnectivityService, this value MUST be

     * reset to Process.INVALID_UID unless all the following conditions are met:

     *

     * <p>The caller is the network owner, AND one of the following sets of requirements is met:

     *

     * <ol>

     *   <li>The described Network is a VPN

     * </ol>

     *

     * <p>OR:

     *

     * <ol>

     *   <li>The destination app is the network owner

     *   <li>The destination app has the ACCESS_FINE_LOCATION permission granted

     *   <li>The calling app is the network owner

     *   <li>The calling app has the ACCESS_FINE_LOCATION permission granted

     *   <li>The user's location toggle is on

     * </ol>

     *
@@ -928,7 +936,16 @@ public final class NetworkCapabilities implements Parcelable { 
    /**

     * Retrieves the UID of the app that owns this network.

     *

     * <p>For user privacy reasons, this field will only be populated if:

     * <p>For user privacy reasons, this field will only be populated if the following conditions

     * are met:

     *

     * <p>The caller is the network owner, AND one of the following sets of requirements is met:

     *

     * <ol>

     *   <li>The described Network is a VPN

     * </ol>

     *

     * <p>OR:

     *

     * <ol>

     *   <li>The calling app is the network owner
@@ -936,8 +953,8 @@ public final class NetworkCapabilities implements Parcelable { 
     *   <li>The user's location toggle is on

     * </ol>

     *

     * Instances of NetworkCapabilities sent to apps without the appropriate permissions will

     * have this field cleared out.

     * Instances of NetworkCapabilities sent to apps without the appropriate permissions will have

     * this field cleared out.

     */

    public int getOwnerUid() {

        return mOwnerUid;

services/core/java/com/android/server/ConnectivityService.java

+6 −0
Original line number Diff line number Diff line
@@ -1698,6 +1698,12 @@ public class ConnectivityService extends IConnectivityManager.Stub 
            return newNc;

        }



        // Allow VPNs to see ownership of their own VPN networks - not location sensitive.

        if (nc.hasTransport(TRANSPORT_VPN)) {

            // Owner UIDs already checked above. No need to re-check.

            return newNc;

        }



        Binder.withCleanCallingIdentity(

                () -> {

                    if (!mLocationPermissionChecker.checkLocationPermission(

services/core/java/com/android/server/connectivity/Vpn.java

+2 −1
Original line number Diff line number Diff line
@@ -1106,7 +1106,8 @@ public class Vpn { 
        NetworkAgentConfig networkAgentConfig = new NetworkAgentConfig();

        networkAgentConfig.allowBypass = mConfig.allowBypass && !mLockdown;



        mNetworkCapabilities.setOwnerUid(Binder.getCallingUid());

        mNetworkCapabilities.setOwnerUid(mOwnerUID);

        mNetworkCapabilities.setAdministratorUids(new int[] {mOwnerUID});

        mNetworkCapabilities.setUids(createUserAndRestrictedProfilesRanges(mUserHandle,

                mConfig.allowedApplications, mConfig.disallowedApplications));

        long token = Binder.clearCallingIdentity();