Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Maintain map of nanoapps that are permanently denied

Browse Source 
If a broker's authentication state with a nanoapp is "force denied"
via CLI, it's possible that a future nanoapp permissions state check
could cause the client to transition back to the granted state which can
cause issues with tests. Remove this corner case by maintaining a map of
force denials that can be used to ensure that the authenitcation state
is always left as denied.

Bug: 179948640
Test: Run PTS
Change-Id: Ibe23764fb4a2f08d521a0b5d483f7afb01e1bf4b
This commit is contained in:
Anthony Stange
2021-03-12 15:35:28 +00:00
parent eb4aacc2c3
commit 1f78c98829
1 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
services/core/java/com/android/server/location/contexthub/ContextHubClientBroker.java
View File

@@ -47,9 +47,11 @@ import android.util.proto.ProtoOutputStream;
import com.android.server.location.ClientBrokerProto;
import java.util.Collections;
import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.atomic.AtomicBoolean;
import java.util.function.Supplier;
@@ -205,14 +207,19 @@ public class ContextHubClientBroker extends IContextHubClient.Stub
* allowed to communicate over that channel. A channel is defined to have been opened if the
* client has sent or received messages from the particular nanoapp.
*/
private final Map<Long, Integer> mMessageChannelNanoappIdMap =
new ConcurrentHashMap<Long, Integer>();
private final Map<Long, Integer> mMessageChannelNanoappIdMap = new ConcurrentHashMap<>();
/**
* Set containing all nanoapps that have been forcefully transitioned to the denied
* authorization state (via CLI) to ensure they don't transition back to the granted state
* later if, for example, a permission check is performed due to another nanoapp
*/
private final Set<Long> mForceDeniedNapps = new HashSet<>();
/**
* Map containing all nanoapps that have active auth state denial timers.
*/
private final Map<Long, AuthStateDenialTimer> mNappToAuthTimerMap =
new ConcurrentHashMap<Long, AuthStateDenialTimer>();
private final Map<Long, AuthStateDenialTimer> mNappToAuthTimerMap = new ConcurrentHashMap<>();
/**
* Callback used to obtain the latest set of nanoapp permissions and verify this client has
@@ -637,7 +644,8 @@ public class ContextHubClientBroker extends IContextHubClient.Stub
private int updateNanoAppAuthState(
long nanoAppId, List<String> nanoappPermissions, boolean gracePeriodExpired) {
return updateNanoAppAuthState(
nanoAppId, nanoappPermissions, gracePeriodExpired, false /* forceDenied */);
nanoAppId, nanoappPermissions, gracePeriodExpired,
mForceDeniedNapps.contains(nanoAppId) /* forceDenied */);
}
/**
@@ -679,6 +687,7 @@ public class ContextHubClientBroker extends IContextHubClient.Stub
// any state -> DENIED if "forceDenied" is true
if (forceDenied) {
newAuthState = AUTHORIZATION_DENIED;
mForceDeniedNapps.add(nanoAppId);
} else if (gracePeriodExpired) {
if (curAuthState == AUTHORIZATION_DENIED_GRACE_PERIOD) {
newAuthState = AUTHORIZATION_DENIED;