From 0e3234777f310af64191fffaedf58a98958c663b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thi=C3=A9baud=20Weksteen?= <tweek@google.com>
Date: Tue, 6 Dec 2022 14:30:43 +1100
Subject: [PATCH] Mock permission checks for NetworkManagementServiceTest

NetworkManagementService has been migrated to use AIDL annotations for
permission enforcement. Mock the PermissionEnforcer to ensure the
control of which permission are checked. Pass down the current
PermissionEnforcer to the parent Stub class via the constructor.

Bug: 259341026
Test: atest FrameworksServicesTests:com.android.server.NetworkManagementServiceTest
Change-Id: I83aabf22cbf0d34a683c51f3d09110fbd5daae6d
---
 .../server/NetworkManagementService.java      |  5 ++--
 .../server/NetworkManagementServiceTest.java  | 29 +++++++++++++++++++
 2 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/services/core/java/com/android/server/NetworkManagementService.java b/services/core/java/com/android/server/NetworkManagementService.java
index 5d54b6c1c81f0..fc26f0989f450 100644
--- a/services/core/java/com/android/server/NetworkManagementService.java
+++ b/services/core/java/com/android/server/NetworkManagementService.java
@@ -17,9 +17,6 @@
 package com.android.server;
 
 import static android.Manifest.permission.CONNECTIVITY_INTERNAL;
-import static android.Manifest.permission.NETWORK_SETTINGS;
-import static android.Manifest.permission.OBSERVE_NETWORK_POLICY;
-import static android.Manifest.permission.SHUTDOWN;
 import static android.net.ConnectivityManager.FIREWALL_CHAIN_DOZABLE;
 import static android.net.ConnectivityManager.FIREWALL_CHAIN_LOW_POWER_STANDBY;
 import static android.net.ConnectivityManager.FIREWALL_CHAIN_POWERSAVE;
@@ -63,6 +60,7 @@ import android.os.Binder;
 import android.os.Handler;
 import android.os.IBinder;
 import android.os.INetworkManagementService;
+import android.os.PermissionEnforcer;
 import android.os.Process;
 import android.os.RemoteCallbackList;
 import android.os.RemoteException;
@@ -230,6 +228,7 @@ public class NetworkManagementService extends INetworkManagementService.Stub {
      */
     private NetworkManagementService(
             Context context, Dependencies deps) {
+        super(PermissionEnforcer.fromContext(context));
         mContext = context;
         mDeps = deps;
 
diff --git a/services/tests/servicestests/src/com/android/server/NetworkManagementServiceTest.java b/services/tests/servicestests/src/com/android/server/NetworkManagementServiceTest.java
index cbe6d2687a55d..17a587603009a 100644
--- a/services/tests/servicestests/src/com/android/server/NetworkManagementServiceTest.java
+++ b/services/tests/servicestests/src/com/android/server/NetworkManagementServiceTest.java
@@ -37,6 +37,7 @@ import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoMoreInteractions;
 
 import android.annotation.NonNull;
+import android.content.AttributionSource;
 import android.content.Context;
 import android.net.ConnectivityManager;
 import android.net.INetd;
@@ -46,8 +47,10 @@ import android.net.NetworkPolicyManager;
 import android.os.BatteryStats;
 import android.os.Binder;
 import android.os.IBinder;
+import android.os.PermissionEnforcer;
 import android.os.Process;
 import android.os.RemoteException;
+import android.permission.PermissionCheckerManager;
 import android.test.suitebuilder.annotation.SmallTest;
 import android.util.ArrayMap;
 
@@ -87,6 +90,7 @@ public class NetworkManagementServiceTest {
     private ArgumentCaptor<INetdUnsolicitedEventListener> mUnsolListenerCaptor;
 
     private final MockDependencies mDeps = new MockDependencies();
+    private final MockPermissionEnforcer mPermissionEnforcer = new MockPermissionEnforcer();
 
     private final class MockDependencies extends Dependencies {
         @Override
@@ -114,6 +118,24 @@ public class NetworkManagementServiceTest {
         }
     }
 
+    private static final class MockPermissionEnforcer extends PermissionEnforcer {
+        @Override
+        protected int checkPermission(@NonNull String permission,
+                @NonNull AttributionSource source) {
+            String[] granted = new String [] {
+                android.Manifest.permission.NETWORK_SETTINGS,
+                android.Manifest.permission.OBSERVE_NETWORK_POLICY,
+                android.Manifest.permission.SHUTDOWN
+            };
+            for (String p : granted) {
+                if (p.equals(permission)) {
+                    return PermissionCheckerManager.PERMISSION_GRANTED;
+                }
+            }
+            return PermissionCheckerManager.PERMISSION_HARD_DENIED;
+        }
+    }
+
     @Before
     public void setUp() throws Exception {
         MockitoAnnotations.initMocks(this);
@@ -122,6 +144,13 @@ public class NetworkManagementServiceTest {
         doReturn(Context.CONNECTIVITY_SERVICE).when(mContext).getSystemServiceName(
                 eq(ConnectivityManager.class));
         doReturn(mCm).when(mContext).getSystemService(eq(Context.CONNECTIVITY_SERVICE));
+        // The AIDL stub will use PermissionEnforcer to check permission from the caller.
+        // Mock the service. See MockPermissionEnforcer above.
+        doReturn(Context.PERMISSION_ENFORCER_SERVICE).when(mContext).getSystemServiceName(
+                eq(PermissionEnforcer.class));
+        doReturn(mPermissionEnforcer).when(mContext).getSystemService(
+                eq(Context.PERMISSION_ENFORCER_SERVICE));
+
         // Start the service and wait until it connects to our socket.
         mNMService = NetworkManagementService.create(mContext, mDeps);
     }