Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't allow permission change to runtime

Browse Source 
Prevent apps to change permission protection level to dangerous
from any other type as this would allow a privilege escalation
where an app adds a normal permission in other app's group and
then redefines it as dangerous leading to the group auto-grant.

Test: Added a CTS test which passes.

bug:33860747

Change-Id: I1ccf546f78ee79ff027cb98124be81c8e5265a82
This commit is contained in:
Svetoslav Ganov
2016-12-27 18:55:29 -08:00
parent 0396cde363
commit 0f929c5320
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
services/core/java/com/android/server/pm/PackageManagerService.java
View File

@@ -15611,6 +15611,27 @@ public class PackageManagerService extends IPackageManager.Stub {
return;
}
// Prevent apps to change permission protection level to dangerous
// from any other type as this would allow a privilege escalation
// where an app adds a normal/signature permission in other app's
// group and later redefines it as dangerous leading to the group
// auto-grant.
final int permissionCount = pkg.permissions.size();
for (int i = 0; i < permissionCount; i++) {
PackageParser.Permission permission = pkg.permissions.get(i);
if ((permission.info.protectionLevel & PermissionInfo.PROTECTION_MASK_BASE)
== PermissionInfo.PROTECTION_DANGEROUS) {
BasePermission bp = mSettings.mPermissions.get(permission.info.name);
if (bp != null && !bp.isRuntime()) {
res.setError(PackageManager.INSTALL_PARSE_FAILED_BAD_MANIFEST,
"Package " + pkg.packageName + " trying to change a "
+ "non-runtime permission " + permission.info.name
+ " to runtime.");
return;
}
}
}
// Prevent installing of child packages
if (oldPackage.parentPackage != null) {
res.setError(PackageManager.INSTALL_PARSE_FAILED_BAD_PACKAGE_NAME,