Merge "Check system_server PID in NetworkStack calls" into qt-dev am: 0e740ae97e (d8c9e6a7) · Commits · e / os / android_packages_modules_NetworkStack

src/com/android/server/NetworkStackService.java

+3 −0

Original line number	Original line	Diff line number	Diff line
	@@ -195,6 +195,7 @@ public class NetworkStackService extends Service {
	@Override		@Override
	public void makeNetworkMonitor(Network network, String name, INetworkMonitorCallbacks cb)		public void makeNetworkMonitor(Network network, String name, INetworkMonitorCallbacks cb)
	throws RemoteException {		throws RemoteException {
			checkNetworkStackCallingPermission();
	updateSystemAidlVersion(cb.getInterfaceVersion());		updateSystemAidlVersion(cb.getInterfaceVersion());
	final SharedLog log = addValidationLogs(network, name);		final SharedLog log = addValidationLogs(network, name);
	final NetworkMonitor nm = new NetworkMonitor(mContext, cb, network, log);		final NetworkMonitor nm = new NetworkMonitor(mContext, cb, network, log);
	@@ -203,6 +204,7 @@ public class NetworkStackService extends Service {

	@Override		@Override
	public void makeIpClient(String ifName, IIpClientCallbacks cb) throws RemoteException {		public void makeIpClient(String ifName, IIpClientCallbacks cb) throws RemoteException {
			checkNetworkStackCallingPermission();
	updateSystemAidlVersion(cb.getInterfaceVersion());		updateSystemAidlVersion(cb.getInterfaceVersion());
	final IpClient ipClient = new IpClient(mContext, ifName, cb, mObserverRegistry, this);		final IpClient ipClient = new IpClient(mContext, ifName, cb, mObserverRegistry, this);

	@@ -228,6 +230,7 @@ public class NetworkStackService extends Service {
	@Override		@Override
	public void fetchIpMemoryStore(@NonNull final IIpMemoryStoreCallbacks cb)		public void fetchIpMemoryStore(@NonNull final IIpMemoryStoreCallbacks cb)
	throws RemoteException {		throws RemoteException {
			checkNetworkStackCallingPermission();
	updateSystemAidlVersion(cb.getInterfaceVersion());		updateSystemAidlVersion(cb.getInterfaceVersion());
	cb.onIpMemoryStoreFetched(mIpMemoryStoreService);		cb.onIpMemoryStoreFetched(mIpMemoryStoreService);
	}		}

src/com/android/server/util/PermissionUtil.java

+30 −4

Original line number	Original line	Diff line number	Diff line
	@@ -16,30 +16,56 @@

	package com.android.server.util;		package com.android.server.util;

			import static android.os.Binder.getCallingPid;
	import static android.os.Binder.getCallingUid;		import static android.os.Binder.getCallingUid;

	import android.os.Process;		import android.os.Process;
	import android.os.UserHandle;		import android.os.UserHandle;

			import java.util.concurrent.atomic.AtomicInteger;

	/**		/**
	* Utility class to check calling permissions on the network stack.		* Utility class to check calling permissions on the network stack.
	*/		*/
	public final class PermissionUtil {		public final class PermissionUtil {
			private static final AtomicInteger sSystemPid = new AtomicInteger(-1);

	/**		/**
	* Check that the caller is allowed to communicate with the network stack.		* Check that the caller is allowed to communicate with the network stack.
	* @throws SecurityException The caller is not allowed to communicate with the network stack.		* @throws SecurityException The caller is not allowed to communicate with the network stack.
	*/		*/
	public static void checkNetworkStackCallingPermission() {		public static void checkNetworkStackCallingPermission() {
	// TODO: check that the calling PID is the system server.
	final int caller = getCallingUid();		final int caller = getCallingUid();
	if (caller != Process.SYSTEM_UID		if (caller == Process.SYSTEM_UID) {
	&& UserHandle.getAppId(caller) != Process.BLUETOOTH_UID		checkConsistentSystemPid();
	&& UserHandle.getAppId(caller) != Process.PHONE_UID) {		return;
			}

			if (UserHandle.getAppId(caller) != Process.BLUETOOTH_UID) {
	throw new SecurityException("Invalid caller: " + caller);		throw new SecurityException("Invalid caller: " + caller);
	}		}
	}		}

			private static void checkConsistentSystemPid() {
			// Apart from the system server process, no process with a system UID should try to
			// communicate with the network stack. This is to ensure that the network stack does not
			// need to maintain behavior for clients it was not designed to work with.
			// Checking that all calls from a system UID originate from the same PID loosely enforces
			// this restriction as if another system process calls the network stack first, the system
			// server would lose access to the network stack and cause obvious failures. If the system
			// server calls the network stack first, other clients would lose access as expected.
			final int systemPid = getCallingPid();
			if (sSystemPid.compareAndSet(-1, systemPid)) {
			// sSystemPid was unset (-1): this was the first call
			return;
			}

			if (sSystemPid.get() != systemPid) {
			throw new SecurityException("Invalid PID for the system server, expected "
			+ sSystemPid.get() + " but was called from " + systemPid);
			}
			}

	/**		/**
	* Check that the caller is allowed to dump the network stack, e.g. dumpsys.		* Check that the caller is allowed to dump the network stack, e.g. dumpsys.
	* @throws SecurityException The caller is not allowed to dump the network stack.		* @throws SecurityException The caller is not allowed to dump the network stack.