Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Validate pid can be trusted" into sc-dev am: 45312b8382 am: b14e524ffd

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/16461958

Change-Id: I3844f812cfdbdf51da4f2f849d16794bb9679b90
This commit is contained in:
Ganesh Olekar
2022-02-05 04:31:21 +00:00
committed by Automerger Merge Worker
parent 4f7c212c39 b14e524ffd
commit 4ff5bad43e
2 changed files with 43 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
core/api/test-current.txt
View File

@@ -681,6 +681,7 @@ package android.content {
ctor public AttributionSource(int, @Nullable String, @Nullable String);
ctor public AttributionSource(int, @Nullable String, @Nullable String, @NonNull android.os.IBinder);
ctor public AttributionSource(int, @Nullable String, @Nullable String, @Nullable java.util.Set<java.lang.String>, @Nullable android.content.AttributionSource);
method public void enforceCallingPid();
}
public final class AutofillOptions implements android.os.Parcelable {

46
core/java/android/content/AttributionSource.java
View File

@@ -155,8 +155,8 @@ public final class AttributionSource implements Parcelable {
this(AttributionSourceState.CREATOR.createFromParcel(in));
// Since we just unpacked this object as part of it transiting a Binder
// call, this is the perfect time to enforce that its UID can be trusted
enforceCallingUid();
// call, this is the perfect time to enforce that its UID and PID can be trusted
enforceCallingUidAndPid();
}
/** @hide */
@@ -258,14 +258,25 @@ public final class AttributionSource implements Parcelable {
}
}
/**
* If you are handling an IPC and you don't trust the caller you need to validate whether the
* attribution source is one for the calling app to prevent the caller to pass you a source from
* another app without including themselves in the attribution chain.
*
* @throws SecurityException if the attribution source cannot be trusted to be from the caller.
*/
private void enforceCallingUidAndPid() {
enforceCallingUid();
enforceCallingPid();
}
/**
* If you are handling an IPC and you don't trust the caller you need to validate
* whether the attribution source is one for the calling app to prevent the caller
* to pass you a source from another app without including themselves in the
* attribution chain.
*
* @throws SecurityException if the attribution source cannot be trusted to be
* from the caller.
* @throws SecurityException if the attribution source cannot be trusted to be from the caller.
*/
public void enforceCallingUid() {
if (!checkCallingUid()) {
@@ -294,6 +305,33 @@ public final class AttributionSource implements Parcelable {
return true;
}
/**
* Validate that the pid being claimed for the calling app is not spoofed
*
* @throws SecurityException if the attribution source cannot be trusted to be from the caller.
* @hide
*/
@TestApi
public void enforceCallingPid() {
if (!checkCallingPid()) {
throw new SecurityException("Calling pid: " + Binder.getCallingPid()
+ " doesn't match source pid: " + mAttributionSourceState.pid);
}
}
/**
* Validate that the pid being claimed for the calling app is not spoofed
*
* @return if the attribution source cannot be trusted to be from the caller.
*/
private boolean checkCallingPid() {
final int callingPid = Binder.getCallingPid();
if (mAttributionSourceState.pid != -1 && callingPid != mAttributionSourceState.pid) {
return false;
}
return true;
}
@Override
public String toString() {
if (Build.IS_DEBUGGABLE) {