Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a4919a56 authored by Chiachang Wang's avatar Chiachang Wang
Browse files

Restrict the permission for accessing vpn profile 

These vpn profile accessing methods are designed for priviledge
or the owner apps, and they should not be accessible for any
app without correct permission. As these methods are not yet
fully depolyed, restrict these methods with NETWORK_STACK or
PERMISSION_MAINLINE_NETWORK_STACK permission to prevent them
from being accessed from the unexpected apps.

Bug: 341046194
Bug: 341253275
Flag: EXEMPT bugfix
Test: atest VpnManagerServiceTest
Test: Enable vpn from a vpn app and accessing API without
      corresponding permission from other apps. Verify
      result by accessing these hidden methods.
Change-Id: If6fd058f40da88a4801b59187631e0c68b236ff5
parent 76b5b552

services/core/java/com/android/server/VpnManagerService.java

+9 −0
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ package com.android.server; 
import static android.Manifest.permission.NETWORK_STACK;



import static com.android.net.module.util.PermissionUtils.enforceAnyPermissionOf;

import static com.android.net.module.util.PermissionUtils.enforceNetworkStackPermission;



import android.annotation.NonNull;

import android.annotation.Nullable;
@@ -1020,6 +1021,8 @@ public class VpnManagerService extends IVpnManager.Stub { 
    @Override

    @Nullable

    public byte[] getFromVpnProfileStore(@NonNull String name) {

        // TODO(b/307903113): Replace NETWORK_STACK permission and adopt proper permission

        enforceNetworkStackPermission(mContext);

        return mVpnProfileStore.get(name);

    }
@@ -1037,6 +1040,8 @@ public class VpnManagerService extends IVpnManager.Stub { 
     */

    @Override

    public boolean putIntoVpnProfileStore(@NonNull String name, @NonNull byte[] blob) {

        // TODO(b/307903113): Replace NETWORK_STACK permission and adopt proper permission

        enforceNetworkStackPermission(mContext);

        return mVpnProfileStore.put(name, blob);

    }
@@ -1052,6 +1057,8 @@ public class VpnManagerService extends IVpnManager.Stub { 
     */

    @Override

    public boolean removeFromVpnProfileStore(@NonNull String name) {

        // TODO(b/307903113): Replace NETWORK_STACK permission and adopt proper permission

        enforceNetworkStackPermission(mContext);

        return mVpnProfileStore.remove(name);

    }
@@ -1069,6 +1076,8 @@ public class VpnManagerService extends IVpnManager.Stub { 
    @Override

    @NonNull

    public String[] listFromVpnProfileStore(@NonNull String prefix) {

        // TODO(b/307903113): Replace NETWORK_STACK permission and adopt proper permission

        enforceNetworkStackPermission(mContext);

        return mVpnProfileStore.list(prefix);

    }