Merge "[RFPM03] Check permission by uid." am: ce4d7d9493 (a33a3a3a) · Commits · e / os / android_frameworks_base

services/core/java/com/android/server/connectivity/PermissionMonitor.java

+73 −89

Original line number	Original line	Diff line number	Diff line
	@@ -21,14 +21,23 @@ import static android.Manifest.permission.CONNECTIVITY_USE_RESTRICTED_NETWORKS;
	import static android.Manifest.permission.INTERNET;		import static android.Manifest.permission.INTERNET;
	import static android.Manifest.permission.NETWORK_STACK;		import static android.Manifest.permission.NETWORK_STACK;
	import static android.Manifest.permission.UPDATE_DEVICE_STATS;		import static android.Manifest.permission.UPDATE_DEVICE_STATS;
	import static android.content.pm.PackageInfo.REQUESTED_PERMISSION_GRANTED;
	import static android.content.pm.PackageManager.GET_PERMISSIONS;		import static android.content.pm.PackageManager.GET_PERMISSIONS;
	import static android.content.pm.PackageManager.MATCH_ANY_USER;		import static android.content.pm.PackageManager.MATCH_ANY_USER;
			import static android.net.INetd.PERMISSION_INTERNET;
			import static android.net.INetd.PERMISSION_NETWORK;
			import static android.net.INetd.PERMISSION_NONE;
			import static android.net.INetd.PERMISSION_SYSTEM;
			import static android.net.INetd.PERMISSION_UNINSTALLED;
			import static android.net.INetd.PERMISSION_UPDATE_DEVICE_STATS;
	import static android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK;		import static android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK;
	import static android.os.Process.INVALID_UID;		import static android.os.Process.INVALID_UID;
	import static android.os.Process.SYSTEM_UID;		import static android.os.Process.SYSTEM_UID;

			import static com.android.internal.util.ArrayUtils.convertToIntArray;

	import android.annotation.NonNull;		import android.annotation.NonNull;
			import android.annotation.Nullable;
			import android.app.ActivityManager;
	import android.content.Context;		import android.content.Context;
	import android.content.pm.ApplicationInfo;		import android.content.pm.ApplicationInfo;
	import android.content.pm.PackageInfo;		import android.content.pm.PackageInfo;
	@@ -51,7 +60,6 @@ import android.util.SparseIntArray;

	import com.android.internal.annotations.GuardedBy;		import com.android.internal.annotations.GuardedBy;
	import com.android.internal.annotations.VisibleForTesting;		import com.android.internal.annotations.VisibleForTesting;
	import com.android.internal.util.ArrayUtils;
	import com.android.internal.util.IndentingPrintWriter;		import com.android.internal.util.IndentingPrintWriter;
	import com.android.server.LocalServices;		import com.android.server.LocalServices;
	import com.android.server.SystemConfig;		import com.android.server.SystemConfig;
	@@ -65,7 +73,6 @@ import java.util.Map;
	import java.util.Map.Entry;		import java.util.Map.Entry;
	import java.util.Set;		import java.util.Set;


	/**		/**
	* A utility class to inform Netd of UID permisisons.		* A utility class to inform Netd of UID permisisons.
	* Does a mass update at boot and then monitors for app install/remove.		* Does a mass update at boot and then monitors for app install/remove.
	@@ -114,6 +121,13 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse
	public int getDeviceFirstSdkInt() {		public int getDeviceFirstSdkInt() {
	return Build.VERSION.FIRST_SDK_INT;		return Build.VERSION.FIRST_SDK_INT;
	}		}

			/**
			* Check whether given uid has specific permission.
			*/
			public int uidPermission(@NonNull final String permission, final int uid) {
			return ActivityManager.checkUidPermission(permission, uid);
			}
	}		}

	public PermissionMonitor(@NonNull final Context context, @NonNull final INetd netd) {		public PermissionMonitor(@NonNull final Context context, @NonNull final INetd netd) {
	@@ -156,8 +170,9 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse
	}		}
	mAllApps.add(UserHandle.getAppId(uid));		mAllApps.add(UserHandle.getAppId(uid));

	boolean isNetwork = hasNetworkPermission(app);		final boolean isNetwork = hasPermission(CHANGE_NETWORK_STATE, uid);
	boolean hasRestrictedPermission = hasRestrictedNetworkPermission(app);		final boolean hasRestrictedPermission =
			hasRestrictedNetworkPermission(app.applicationInfo);

	if (isNetwork \|\| hasRestrictedPermission) {		if (isNetwork \|\| hasRestrictedPermission) {
	Boolean permission = mApps.get(uid);		Boolean permission = mApps.get(uid);
	@@ -169,8 +184,7 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse
	}		}

	//TODO: unify the management of the permissions into one codepath.		//TODO: unify the management of the permissions into one codepath.
	int otherNetdPerms = getNetdPermissionMask(app.requestedPermissions,		final int otherNetdPerms = getNetdPermissionMask(uid);
	app.requestedPermissionsFlags);
	netdPermsUids.put(uid, netdPermsUids.get(uid) \| otherNetdPerms);		netdPermsUids.put(uid, netdPermsUids.get(uid) \| otherNetdPerms);
	}		}

	@@ -190,9 +204,8 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse
	// Get the uids of native services that have UPDATE_DEVICE_STATS or INTERNET permission.		// Get the uids of native services that have UPDATE_DEVICE_STATS or INTERNET permission.
	if (perms != null) {		if (perms != null) {
	netdPermission \|= perms.contains(UPDATE_DEVICE_STATS)		netdPermission \|= perms.contains(UPDATE_DEVICE_STATS)
	? INetd.PERMISSION_UPDATE_DEVICE_STATS : 0;		? PERMISSION_UPDATE_DEVICE_STATS : 0;
	netdPermission \|= perms.contains(INTERNET)		netdPermission \|= perms.contains(INTERNET) ? PERMISSION_INTERNET : 0;
	? INetd.PERMISSION_INTERNET : 0;
	}		}
	netdPermsUids.put(uid, netdPermsUids.get(uid) \| netdPermission);		netdPermsUids.put(uid, netdPermsUids.get(uid) \| netdPermission);
	}		}
	@@ -207,48 +220,33 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse
	}		}

	@VisibleForTesting		@VisibleForTesting
	boolean hasPermission(@NonNull final PackageInfo app, @NonNull final String permission) {		boolean hasPermission(@NonNull final String permission, final int uid) {
	if (app.requestedPermissions == null \|\| app.requestedPermissionsFlags == null) {		return mDeps.uidPermission(permission, uid) == PackageManager.PERMISSION_GRANTED;
	return false;
	}
	final int index = ArrayUtils.indexOf(app.requestedPermissions, permission);
	if (index < 0 \|\| index >= app.requestedPermissionsFlags.length) return false;
	return (app.requestedPermissionsFlags[index] & REQUESTED_PERMISSION_GRANTED) != 0;
	}

	@VisibleForTesting
	boolean hasNetworkPermission(@NonNull final PackageInfo app) {
	return hasPermission(app, CHANGE_NETWORK_STATE);
	}		}

	@VisibleForTesting		@VisibleForTesting
	boolean hasRestrictedNetworkPermission(@NonNull final PackageInfo app) {		boolean hasRestrictedNetworkPermission(@Nullable final ApplicationInfo appInfo) {
	// TODO : remove this check in the future(b/31479477). All apps should just		if (appInfo == null) return false;
			// TODO : remove this check in the future(b/162295056). All apps should just
	// request the appropriate permission for their use case since android Q.		// request the appropriate permission for their use case since android Q.
	if (app.applicationInfo != null) {		if ((appInfo.targetSdkVersion < VERSION_Q && isVendorApp(appInfo))
	// Backward compatibility for b/114245686, on devices that launched before Q daemons		// Backward compatibility for b/114245686, on devices that launched before Q daemons
	// and apps running as the system UID are exempted from this check.		// and apps running as the system UID are exempted from this check.
	if (app.applicationInfo.uid == SYSTEM_UID && mDeps.getDeviceFirstSdkInt() < VERSION_Q) {		\|\| (appInfo.uid == SYSTEM_UID && mDeps.getDeviceFirstSdkInt() < VERSION_Q)) {
	return true;		return true;
	}		}

	if (app.applicationInfo.targetSdkVersion < VERSION_Q		return hasPermission(PERMISSION_MAINLINE_NETWORK_STACK, appInfo.uid)
	&& isVendorApp(app.applicationInfo)) {		\|\| hasPermission(NETWORK_STACK, appInfo.uid)
	return true;		\|\| hasPermission(CONNECTIVITY_USE_RESTRICTED_NETWORKS, appInfo.uid);
	}
	}

	return hasPermission(app, PERMISSION_MAINLINE_NETWORK_STACK)
	\|\| hasPermission(app, NETWORK_STACK)
	\|\| hasPermission(app, CONNECTIVITY_USE_RESTRICTED_NETWORKS);
	}		}

	/** Returns whether the given uid has using background network permission. */		/** Returns whether the given uid has using background network permission. */
	public synchronized boolean hasUseBackgroundNetworksPermission(final int uid) {		public synchronized boolean hasUseBackgroundNetworksPermission(final int uid) {
	// Apps with any of the CHANGE_NETWORK_STATE, NETWORK_STACK, CONNECTIVITY_INTERNAL or		// Apps with any of the CHANGE_NETWORK_STATE, NETWORK_STACK, CONNECTIVITY_INTERNAL or
	// CONNECTIVITY_USE_RESTRICTED_NETWORKS permission has the permission to use background		// CONNECTIVITY_USE_RESTRICTED_NETWORKS permission has the permission to use background
	// networks. mApps contains the result of checks for both hasNetworkPermission and		// networks. mApps contains the result of checks for both CHANGE_NETWORK_STATE permission
	// hasRestrictedNetworkPermission. If uid is in the mApps list that means uid has one of		// and hasRestrictedNetworkPermission. If uid is in the mApps list that means uid has one of
	// permissions at least.		// permissions at least.
	return mApps.containsKey(uid);		return mApps.containsKey(uid);
	}		}
	@@ -273,11 +271,11 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse
	}		}
	try {		try {
	if (add) {		if (add) {
	mNetd.networkSetPermissionForUser(INetd.PERMISSION_NETWORK, toIntArray(network));		mNetd.networkSetPermissionForUser(PERMISSION_NETWORK, convertToIntArray(network));
	mNetd.networkSetPermissionForUser(INetd.PERMISSION_SYSTEM, toIntArray(system));		mNetd.networkSetPermissionForUser(PERMISSION_SYSTEM, convertToIntArray(system));
	} else {		} else {
	mNetd.networkClearPermissionForUser(toIntArray(network));		mNetd.networkClearPermissionForUser(convertToIntArray(network));
	mNetd.networkClearPermissionForUser(toIntArray(system));		mNetd.networkClearPermissionForUser(convertToIntArray(system));
	}		}
	} catch (RemoteException e) {		} catch (RemoteException e) {
	loge("Exception when updating permissions: " + e);		loge("Exception when updating permissions: " + e);
	@@ -323,14 +321,15 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse
	}		}

	@VisibleForTesting		@VisibleForTesting
	protected Boolean highestPermissionForUid(Boolean currentPermission, String name) {		protected Boolean highestPermissionForUid(Boolean currentPermission, String name, int uid) {
	if (currentPermission == SYSTEM) {		if (currentPermission == SYSTEM) {
	return currentPermission;		return currentPermission;
	}		}
	try {		try {
	final PackageInfo app = mPackageManager.getPackageInfo(name, GET_PERMISSIONS);		final PackageInfo app = mPackageManager.getPackageInfo(name, GET_PERMISSIONS);
	final boolean isNetwork = hasNetworkPermission(app);		final boolean isNetwork = hasPermission(CHANGE_NETWORK_STATE, uid);
	final boolean hasRestrictedPermission = hasRestrictedNetworkPermission(app);		final boolean hasRestrictedPermission =
			hasRestrictedNetworkPermission(app.applicationInfo);
	if (isNetwork \|\| hasRestrictedPermission) {		if (isNetwork \|\| hasRestrictedPermission) {
	currentPermission = hasRestrictedPermission;		currentPermission = hasRestrictedPermission;
	}		}
	@@ -342,23 +341,14 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse
	}		}

	private int getPermissionForUid(final int uid) {		private int getPermissionForUid(final int uid) {
	int permission = INetd.PERMISSION_NONE;
	// Check all the packages for this UID. The UID has the permission if any of the		// Check all the packages for this UID. The UID has the permission if any of the
	// packages in it has the permission.		// packages in it has the permission.
	final String[] packages = mPackageManager.getPackagesForUid(uid);		final String[] packages = mPackageManager.getPackagesForUid(uid);
	if (packages != null && packages.length > 0) {		if (packages == null \|\| packages.length <= 0) {
	for (String name : packages) {
	final PackageInfo app = getPackageInfo(name);
	if (app != null && app.requestedPermissions != null) {
	permission \|= getNetdPermissionMask(app.requestedPermissions,
	app.requestedPermissionsFlags);
	}
	}
	} else {
	// The last package of this uid is removed from device. Clean the package up.		// The last package of this uid is removed from device. Clean the package up.
	permission = INetd.PERMISSION_UNINSTALLED;		return PERMISSION_UNINSTALLED;
	}		}
	return permission;		return getNetdPermissionMask(uid);
	}		}

	/**		/**
	@@ -375,7 +365,7 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse

	// If multiple packages share a UID (cf: android:sharedUserId) and ask for different		// If multiple packages share a UID (cf: android:sharedUserId) and ask for different
	// permissions, don't downgrade (i.e., if it's already SYSTEM, leave it as is).		// permissions, don't downgrade (i.e., if it's already SYSTEM, leave it as is).
	final Boolean permission = highestPermissionForUid(mApps.get(uid), packageName);		final Boolean permission = highestPermissionForUid(mApps.get(uid), packageName, uid);
	if (permission != mApps.get(uid)) {		if (permission != mApps.get(uid)) {
	mApps.put(uid, permission);		mApps.put(uid, permission);

	@@ -431,7 +421,7 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse
	String[] packages = mPackageManager.getPackagesForUid(uid);		String[] packages = mPackageManager.getPackagesForUid(uid);
	if (packages != null && packages.length > 0) {		if (packages != null && packages.length > 0) {
	for (String name : packages) {		for (String name : packages) {
	permission = highestPermissionForUid(permission, name);		permission = highestPermissionForUid(permission, name, uid);
	if (permission == SYSTEM) {		if (permission == SYSTEM) {
	// An app with this UID still has the SYSTEM permission.		// An app with this UID still has the SYSTEM permission.
	// Therefore, this UID must already have the SYSTEM permission.		// Therefore, this UID must already have the SYSTEM permission.
	@@ -467,19 +457,13 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse
	sendPackagePermissionsForUid(uid, getPermissionForUid(uid));		sendPackagePermissionsForUid(uid, getPermissionForUid(uid));
	}		}

	private static int getNetdPermissionMask(String[] requestedPermissions,		private int getNetdPermissionMask(final int uid) {
	int[] requestedPermissionsFlags) {		int permissions = PERMISSION_NONE;
	int permissions = 0;		if (hasPermission(INTERNET, uid)) {
	if (requestedPermissions == null \|\| requestedPermissionsFlags == null) return permissions;		permissions \|= PERMISSION_INTERNET;
	for (int i = 0; i < requestedPermissions.length; i++) {
	if (requestedPermissions[i].equals(INTERNET)
	&& ((requestedPermissionsFlags[i] & REQUESTED_PERMISSION_GRANTED) != 0)) {
	permissions \|= INetd.PERMISSION_INTERNET;
	}
	if (requestedPermissions[i].equals(UPDATE_DEVICE_STATS)
	&& ((requestedPermissionsFlags[i] & REQUESTED_PERMISSION_GRANTED) != 0)) {
	permissions \|= INetd.PERMISSION_UPDATE_DEVICE_STATS;
	}		}
			if (hasPermission(UPDATE_DEVICE_STATS, uid)) {
			permissions \|= PERMISSION_UPDATE_DEVICE_STATS;
	}		}
	return permissions;		return permissions;
	}		}
	@@ -648,19 +632,19 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse
	for (int i = 0; i < netdPermissionsAppIds.size(); i++) {		for (int i = 0; i < netdPermissionsAppIds.size(); i++) {
	int permissions = netdPermissionsAppIds.valueAt(i);		int permissions = netdPermissionsAppIds.valueAt(i);
	switch(permissions) {		switch(permissions) {
	case (INetd.PERMISSION_INTERNET \| INetd.PERMISSION_UPDATE_DEVICE_STATS):		case (PERMISSION_INTERNET \| PERMISSION_UPDATE_DEVICE_STATS):
	allPermissionAppIds.add(netdPermissionsAppIds.keyAt(i));		allPermissionAppIds.add(netdPermissionsAppIds.keyAt(i));
	break;		break;
	case INetd.PERMISSION_INTERNET:		case PERMISSION_INTERNET:
	internetPermissionAppIds.add(netdPermissionsAppIds.keyAt(i));		internetPermissionAppIds.add(netdPermissionsAppIds.keyAt(i));
	break;		break;
	case INetd.PERMISSION_UPDATE_DEVICE_STATS:		case PERMISSION_UPDATE_DEVICE_STATS:
	updateStatsPermissionAppIds.add(netdPermissionsAppIds.keyAt(i));		updateStatsPermissionAppIds.add(netdPermissionsAppIds.keyAt(i));
	break;		break;
	case INetd.PERMISSION_NONE:		case PERMISSION_NONE:
	noPermissionAppIds.add(netdPermissionsAppIds.keyAt(i));		noPermissionAppIds.add(netdPermissionsAppIds.keyAt(i));
	break;		break;
	case INetd.PERMISSION_UNINSTALLED:		case PERMISSION_UNINSTALLED:
	uninstalledAppIds.add(netdPermissionsAppIds.keyAt(i));		uninstalledAppIds.add(netdPermissionsAppIds.keyAt(i));
	default:		default:
	Log.e(TAG, "unknown permission type: " + permissions + "for uid: "		Log.e(TAG, "unknown permission type: " + permissions + "for uid: "
	@@ -671,24 +655,24 @@ public class PermissionMonitor implements PackageManagerInternal.PackageListObse
	// TODO: add a lock inside netd to protect IPC trafficSetNetPermForUids()		// TODO: add a lock inside netd to protect IPC trafficSetNetPermForUids()
	if (allPermissionAppIds.size() != 0) {		if (allPermissionAppIds.size() != 0) {
	mNetd.trafficSetNetPermForUids(		mNetd.trafficSetNetPermForUids(
	INetd.PERMISSION_INTERNET \| INetd.PERMISSION_UPDATE_DEVICE_STATS,		PERMISSION_INTERNET \| PERMISSION_UPDATE_DEVICE_STATS,
	ArrayUtils.convertToIntArray(allPermissionAppIds));		convertToIntArray(allPermissionAppIds));
	}		}
	if (internetPermissionAppIds.size() != 0) {		if (internetPermissionAppIds.size() != 0) {
	mNetd.trafficSetNetPermForUids(INetd.PERMISSION_INTERNET,		mNetd.trafficSetNetPermForUids(PERMISSION_INTERNET,
	ArrayUtils.convertToIntArray(internetPermissionAppIds));		convertToIntArray(internetPermissionAppIds));
	}		}
	if (updateStatsPermissionAppIds.size() != 0) {		if (updateStatsPermissionAppIds.size() != 0) {
	mNetd.trafficSetNetPermForUids(INetd.PERMISSION_UPDATE_DEVICE_STATS,		mNetd.trafficSetNetPermForUids(PERMISSION_UPDATE_DEVICE_STATS,
	ArrayUtils.convertToIntArray(updateStatsPermissionAppIds));		convertToIntArray(updateStatsPermissionAppIds));
	}		}
	if (noPermissionAppIds.size() != 0) {		if (noPermissionAppIds.size() != 0) {
	mNetd.trafficSetNetPermForUids(INetd.PERMISSION_NONE,		mNetd.trafficSetNetPermForUids(PERMISSION_NONE,
	ArrayUtils.convertToIntArray(noPermissionAppIds));		convertToIntArray(noPermissionAppIds));
	}		}
	if (uninstalledAppIds.size() != 0) {		if (uninstalledAppIds.size() != 0) {
	mNetd.trafficSetNetPermForUids(INetd.PERMISSION_UNINSTALLED,		mNetd.trafficSetNetPermForUids(PERMISSION_UNINSTALLED,
	ArrayUtils.convertToIntArray(uninstalledAppIds));		convertToIntArray(uninstalledAppIds));
	}		}
	} catch (RemoteException e) {		} catch (RemoteException e) {
	Log.e(TAG, "Pass appId list of special permission failed." + e);		Log.e(TAG, "Pass appId list of special permission failed." + e);

tests/net/java/com/android/server/connectivity/PermissionMonitorTest.java

+86 −122

File changed.

Preview size limit exceeded, changes collapsed.