Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce DISALLOW_MOUNT_PHYSICAL_MEDIA.

Browse Source 
Bug: 22697024
Change-Id: Ib7277e8850a49909e5d8d5ad5502cd9315cddf0b
This commit is contained in:
Jeff Sharkey
2015-07-27 14:19:54 -07:00
parent 71bfb27013
commit 2e606d7be5
1 changed files with 16 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
services/core/java/com/android/server/MountService.java
View File

@@ -146,8 +146,6 @@ import javax.crypto.spec.PBEKeySpec;
class MountService extends IMountService.Stub class MountService extends IMountService.Stub
implements INativeDaemonConnectorCallbacks, Watchdog.Monitor { implements INativeDaemonConnectorCallbacks, Watchdog.Monitor {
// TODO: finish enforcing UserManager.DISALLOW_MOUNT_PHYSICAL_MEDIA
// Static direct instance pointer for the tightly-coupled idle service to use // Static direct instance pointer for the tightly-coupled idle service to use
static MountService sSelf = null; static MountService sSelf = null;
@@ -631,6 +629,10 @@ class MountService extends IMountService.Stub
} }
case H_VOLUME_MOUNT: { case H_VOLUME_MOUNT: {
final VolumeInfo vol = (VolumeInfo) msg.obj; final VolumeInfo vol = (VolumeInfo) msg.obj;
if (isMountDisallowed(vol)) {
Slog.i(TAG, "Ignoring mount " + vol.getId() + " due to policy");
break;
}
try { try {
mConnector.execute("volume", "mount", vol.id, vol.mountFlags, mConnector.execute("volume", "mount", vol.id, vol.mountFlags,
vol.mountUserId); vol.mountUserId);
@@ -1305,10 +1307,16 @@ class MountService extends IMountService.Stub
mContext.enforceCallingOrSelfPermission(perm, perm); mContext.enforceCallingOrSelfPermission(perm, perm);
} }
private void enforceUserRestriction(String restriction) { /**
UserManager um = (UserManager) mContext.getSystemService(Context.USER_SERVICE); * Decide if volume is mountable per device policies.
if (um.hasUserRestriction(restriction, Binder.getCallingUserHandle())) { */
throw new SecurityException("User has restriction " + restriction); private boolean isMountDisallowed(VolumeInfo vol) {
if (vol.type == VolumeInfo.TYPE_PUBLIC || vol.type == VolumeInfo.TYPE_PRIVATE) {
final UserManager userManager = mContext.getSystemService(UserManager.class);
return userManager.hasUserRestriction(UserManager.DISALLOW_MOUNT_PHYSICAL_MEDIA,
Binder.getCallingUserHandle());
} else {
return false;
} }
} }
@@ -1586,8 +1594,8 @@ class MountService extends IMountService.Stub
waitForReady(); waitForReady();
final VolumeInfo vol = findVolumeByIdOrThrow(volId); final VolumeInfo vol = findVolumeByIdOrThrow(volId);
if (vol.type == VolumeInfo.TYPE_PUBLIC || vol.type == VolumeInfo.TYPE_PRIVATE) { if (isMountDisallowed(vol)) {
enforceUserRestriction(UserManager.DISALLOW_MOUNT_PHYSICAL_MEDIA); throw new SecurityException("Mounting " + volId + " restricted by policy");
} }
try { try {
mConnector.execute("volume", "mount", vol.id, vol.mountFlags, vol.mountUserId); mConnector.execute("volume", "mount", vol.id, vol.mountFlags, vol.mountUserId);