Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 99b6043d authored by Svet Ganov's avatar Svet Ganov
Browse files

Teach receivers, activities, providers, and services app ops. 

Perform app op check in addition to the permisison check for all four
paltform components - activities, content providers, broadcast receivers,
services - if they are guarded by a permssion that has an associated app
op. This ensures that legacy apps will behave correctly if the permission
of the caller has been revoked, i.e. the app op for that permission was
disabled.

bug:22199666

Change-Id: Ia22d1c38d58b3cd6aabdc655cb7c7bddd85da7a2
parent 2438c9b2

api/current.txt

+2 −0
Original line number Diff line number Diff line
@@ -3856,6 +3856,8 @@ package android.app { 
    method public void finishOp(java.lang.String, int, java.lang.String);

    method public int noteOp(java.lang.String, int, java.lang.String);

    method public int noteOpNoThrow(java.lang.String, int, java.lang.String);

    method public int noteProxyOp(java.lang.String, java.lang.String);

    method public int noteProxyOpNoThrow(java.lang.String, java.lang.String);

    method public static java.lang.String permissionToOp(java.lang.String);

    method public int startOp(java.lang.String, int, java.lang.String);

    method public int startOpNoThrow(java.lang.String, int, java.lang.String);

api/system-current.txt

+2 −0
Original line number Diff line number Diff line
@@ -3965,6 +3965,8 @@ package android.app { 
    method public void finishOp(java.lang.String, int, java.lang.String);

    method public int noteOp(java.lang.String, int, java.lang.String);

    method public int noteOpNoThrow(java.lang.String, int, java.lang.String);

    method public int noteProxyOp(java.lang.String, java.lang.String);

    method public int noteProxyOpNoThrow(java.lang.String, java.lang.String);

    method public static java.lang.String permissionToOp(java.lang.String);

    method public int startOp(java.lang.String, int, java.lang.String);

    method public int startOpNoThrow(java.lang.String, int, java.lang.String);

cmds/am/src/com/android/commands/am/Am.java

+1 −1
Original line number Diff line number Diff line
@@ -767,7 +767,7 @@ public class Am extends BaseCommand { 
            return;

        }

        System.out.println("Starting service: " + intent);

        ComponentName cn = mAm.startService(null, intent, intent.getType(), mUserId);

        ComponentName cn = mAm.startService(null, intent, intent.getType(), null, mUserId);

        if (cn == null) {

            System.err.println("Error: Not found; no service started.");

        } else if (cn.getPackageName().equals("!")) {

core/java/android/app/ActivityManagerNative.java

+14 −6
Original line number Diff line number Diff line
@@ -921,8 +921,9 @@ public abstract class ActivityManagerNative extends Binder implements IActivityM 
            IApplicationThread app = ApplicationThreadNative.asInterface(b);

            Intent service = Intent.CREATOR.createFromParcel(data);

            String resolvedType = data.readString();

            String callingPackage = data.readString();

            int userId = data.readInt();

            ComponentName cn = startService(app, service, resolvedType, userId);

            ComponentName cn = startService(app, service, resolvedType, callingPackage, userId);

            reply.writeNoException();

            ComponentName.writeToParcel(cn, reply);

            return true;
@@ -976,9 +977,11 @@ public abstract class ActivityManagerNative extends Binder implements IActivityM 
            String resolvedType = data.readString();

            b = data.readStrongBinder();

            int fl = data.readInt();

            String callingPackage = data.readString();

            int userId = data.readInt();

            IServiceConnection conn = IServiceConnection.Stub.asInterface(b);

            int res = bindService(app, token, service, resolvedType, conn, fl, userId);

            int res = bindService(app, token, service, resolvedType, conn, fl,

                    callingPackage, userId);

            reply.writeNoException();

            reply.writeInt(res);

            return true;
@@ -1568,7 +1571,8 @@ public abstract class ActivityManagerNative extends Binder implements IActivityM 
            data.enforceInterface(IActivityManager.descriptor);

            Intent service = Intent.CREATOR.createFromParcel(data);

            String resolvedType = data.readString();

            IBinder binder = peekService(service, resolvedType);

            String callingPackage = data.readString();

            IBinder binder = peekService(service, resolvedType, callingPackage);

            reply.writeNoException();

            reply.writeStrongBinder(binder);

            return true;
@@ -3638,7 +3642,7 @@ class ActivityManagerProxy implements IActivityManager 
    }



    public ComponentName startService(IApplicationThread caller, Intent service,

            String resolvedType, int userId) throws RemoteException

            String resolvedType, String callingPackage, int userId) throws RemoteException

    {

        Parcel data = Parcel.obtain();

        Parcel reply = Parcel.obtain();
@@ -3646,6 +3650,7 @@ class ActivityManagerProxy implements IActivityManager 
        data.writeStrongBinder(caller != null ? caller.asBinder() : null);

        service.writeToParcel(data, 0);

        data.writeString(resolvedType);

        data.writeString(callingPackage);

        data.writeInt(userId);

        mRemote.transact(START_SERVICE_TRANSACTION, data, reply, 0);

        reply.readException();
@@ -3708,7 +3713,7 @@ class ActivityManagerProxy implements IActivityManager 
    }

    public int bindService(IApplicationThread caller, IBinder token,

            Intent service, String resolvedType, IServiceConnection connection,

            int flags, int userId) throws RemoteException {

            int flags,  String callingPackage, int userId) throws RemoteException {

        Parcel data = Parcel.obtain();

        Parcel reply = Parcel.obtain();

        data.writeInterfaceToken(IActivityManager.descriptor);
@@ -3718,6 +3723,7 @@ class ActivityManagerProxy implements IActivityManager 
        data.writeString(resolvedType);

        data.writeStrongBinder(connection.asBinder());

        data.writeInt(flags);

        data.writeString(callingPackage);

        data.writeInt(userId);

        mRemote.transact(BIND_SERVICE_TRANSACTION, data, reply, 0);

        reply.readException();
@@ -3783,12 +3789,14 @@ class ActivityManagerProxy implements IActivityManager 
        reply.recycle();

    }



    public IBinder peekService(Intent service, String resolvedType) throws RemoteException {

    public IBinder peekService(Intent service, String resolvedType, String callingPackage)

            throws RemoteException {

        Parcel data = Parcel.obtain();

        Parcel reply = Parcel.obtain();

        data.writeInterfaceToken(IActivityManager.descriptor);

        service.writeToParcel(data, 0);

        data.writeString(resolvedType);

        data.writeString(callingPackage);

        mRemote.transact(PEEK_SERVICE_TRANSACTION, data, reply, 0);

        reply.readException();

        IBinder binder = reply.readStrongBinder();

core/java/android/app/AppOpsManager.java

+92 −5
Original line number Diff line number Diff line
@@ -1082,13 +1082,18 @@ public class AppOpsManager { 
        private final long mTime;

        private final long mRejectTime;

        private final int mDuration;

        private final int mProxyUid;

        private final String mProxyPackageName;



        public OpEntry(int op, int mode, long time, long rejectTime, int duration) {

        public OpEntry(int op, int mode, long time, long rejectTime, int duration,

                int proxyUid, String proxyPackage) {

            mOp = op;

            mMode = mode;

            mTime = time;

            mRejectTime = rejectTime;

            mDuration = duration;

            mProxyUid = proxyUid;

            mProxyPackageName = proxyPackage;

        }



        public int getOp() {
@@ -1115,6 +1120,14 @@ public class AppOpsManager { 
            return mDuration == -1 ? (int)(System.currentTimeMillis()-mTime) : mDuration;

        }



        public int getProxyUid() {

            return  mProxyUid;

        }



        public String getProxyPackageName() {

            return mProxyPackageName;

        }



        @Override

        public int describeContents() {

            return 0;
@@ -1127,6 +1140,8 @@ public class AppOpsManager { 
            dest.writeLong(mTime);

            dest.writeLong(mRejectTime);

            dest.writeInt(mDuration);

            dest.writeInt(mProxyUid);

            dest.writeString(mProxyPackageName);

        }



        OpEntry(Parcel source) {
@@ -1135,6 +1150,8 @@ public class AppOpsManager { 
            mTime = source.readLong();

            mRejectTime = source.readLong();

            mDuration = source.readInt();

            mProxyUid = source.readInt();

            mProxyPackageName = source.readString();

        }



        public static final Creator<OpEntry> CREATOR = new Creator<OpEntry>() {
@@ -1378,6 +1395,33 @@ public class AppOpsManager { 
        return noteOpNoThrow(strOpToOp(op), uid, packageName);

    }



    /**

     * Make note of an application performing an operation on behalf of another

     * application when handling an IPC. Note that you must pass the package name

     * of the application that is being proxied while its UID will be inferred from

     * the IPC state; this function will verify that the calling uid and proxied

     * package name match, and if not, return {@link #MODE_IGNORED}. If this call

     * succeeds, the last execution time of the operation for the proxied app and

     * your app will be updated to the current time.

     * @param op The operation to note.  One of the OPSTR_* constants.

     * @param proxiedPackageName The name of the application calling into the proxy application.

     * @return Returns {@link #MODE_ALLOWED} if the operation is allowed, or

     * {@link #MODE_IGNORED} if it is not allowed and should be silently ignored (without

     * causing the app to crash).

     * @throws SecurityException If the app has been configured to crash on this op.

     */

    public int noteProxyOp(String op, String proxiedPackageName) {

        return noteProxyOp(strOpToOp(op), proxiedPackageName);

    }



    /**

     * Like {@link #noteProxyOp(String, String)} but instead

     * of throwing a {@link SecurityException} it returns {@link #MODE_ERRORED}.

     */

    public int noteProxyOpNoThrow(String op, String proxiedPackageName) {

        return noteProxyOpNoThrow(strOpToOp(op), proxiedPackageName);

    }



    /**

     * Report that an application has started executing a long-running operation.  Note that you

     * must pass in both the uid and name of the application to be checked; this function will
@@ -1455,7 +1499,7 @@ public class AppOpsManager { 
            return mService.checkOperation(op, uid, packageName);

        } catch (RemoteException e) {

        }

        return MODE_IGNORED;

        return MODE_ERRORED;

    }



    /**
@@ -1501,7 +1545,7 @@ public class AppOpsManager { 
            return mService.checkAudioOperation(op, stream, uid, packageName);

        } catch (RemoteException e) {

        }

        return MODE_IGNORED;

        return MODE_ERRORED;

    }



    /**
@@ -1531,6 +1575,49 @@ public class AppOpsManager { 
        return MODE_IGNORED;

    }



    /**

     * Make note of an application performing an operation on behalf of another

     * application when handling an IPC. Note that you must pass the package name

     * of the application that is being proxied while its UID will be inferred from

     * the IPC state; this function will verify that the calling uid and proxied

     * package name match, and if not, return {@link #MODE_IGNORED}. If this call

     * succeeds, the last execution time of the operation for the proxied app and

     * your app will be updated to the current time.

     * @param op The operation to note. One of the OPSTR_* constants.

     * @param proxiedPackageName The name of the application calling into the proxy application.

     * @return Returns {@link #MODE_ALLOWED} if the operation is allowed, or

     * {@link #MODE_IGNORED} if it is not allowed and should be silently ignored (without

     * causing the app to crash).

     * @throws SecurityException If the proxy or proxied app has been configured to

     * crash on this op.

     *

     * @hide

     */

    public int noteProxyOp(int op, String proxiedPackageName) {

        int mode = noteProxyOpNoThrow(op, proxiedPackageName);

        if (mode == MODE_ERRORED) {

            throw new SecurityException("Proxy package " + mContext.getOpPackageName()

                    + " from uid " + Process.myUid() + " or calling package "

                    + proxiedPackageName + " from uid " + Binder.getCallingUid()

                    + " not allowed to perform " + sOpNames[op]);

        }

        return mode;

    }



    /**

     * Like {@link #noteProxyOp(int, String)} but instead

     * of throwing a {@link SecurityException} it returns {@link #MODE_ERRORED}.

     * @hide

     */

    public int noteProxyOpNoThrow(int op, String proxiedPackageName) {

        try {

            return mService.noteProxyOperation(op, mContext.getOpPackageName(),

                    Binder.getCallingUid(), proxiedPackageName);

        } catch (RemoteException e) {

        }

        return MODE_ERRORED;

    }



    /**

     * Like {@link #noteOp} but instead of throwing a {@link SecurityException} it

     * returns {@link #MODE_ERRORED}.
@@ -1541,7 +1628,7 @@ public class AppOpsManager { 
            return mService.noteOperation(op, uid, packageName);

        } catch (RemoteException e) {

        }

        return MODE_IGNORED;

        return MODE_ERRORED;

    }



    /** @hide */
@@ -1603,7 +1690,7 @@ public class AppOpsManager { 
            return mService.startOperation(getToken(mService), op, uid, packageName);

        } catch (RemoteException e) {

        }

        return MODE_IGNORED;

        return MODE_ERRORED;

    }



    /** @hide */