Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Fix duplicate permission privilege escalation" into tm-dev am: 6953052d83

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/17749786

Change-Id: Idb3e60a0c4396ad0c8c21a2d3ffe741050cc1f71
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Manjeet Rulhania
2022-05-13 18:28:23 +00:00
committed by Automerger Merge Worker
parent 995561f15c 6953052d83
commit 5275acdb0d
2 changed files with 29 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java
View File

@@ -26,6 +26,7 @@ import android.content.res.Resources;
import android.content.res.TypedArray;
import android.content.res.XmlResourceParser;
import android.util.ArrayMap;
import android.util.EventLog;
import android.util.Slog;
import com.android.internal.R;
@@ -36,6 +37,7 @@ import org.xmlpull.v1.XmlPullParserException;
import java.io.IOException;
import java.util.List;
import java.util.Objects;
/**
* @hide
@@ -277,8 +279,28 @@ public class ParsedPermissionUtils {
}
/**
* @return {@code true} if the package declares duplicate permissions with different
* protection levels.
* Determines if a duplicate permission is malformed .i.e. defines different protection level
* or group.
*/
private static boolean isMalformedDuplicate(ParsedPermission p1, ParsedPermission p2) {
// Since a permission tree is also added as a permission with normal protection
// level, we need to skip if the parsedPermission is a permission tree.
if (p1 == null || p2 == null || p1.isTree() || p2.isTree()) {
return false;
}
if (p1.getProtectionLevel() != p2.getProtectionLevel()) {
return true;
}
if (!Objects.equals(p1.getGroup(), p2.getGroup())) {
return true;
}
return false;
}
/**
* @return {@code true} if the package declares malformed duplicate permissions.
*/
public static boolean declareDuplicatePermission(@NonNull ParsingPackage pkg) {
final List<ParsedPermission> permissions = pkg.getPermissions();
@@ -289,10 +311,10 @@ public class ParsedPermissionUtils {
final ParsedPermission parsedPermission = permissions.get(i);
final String name = parsedPermission.getName();
final ParsedPermission perm = checkDuplicatePerm.get(name);
// Since a permission tree is also added as a permission with normal protection
// level, we need to skip if the parsedPermission is a permission tree.
if (perm != null && !(perm.isTree() || parsedPermission.isTree())
&& perm.getProtectionLevel() != parsedPermission.getProtectionLevel()) {
if (isMalformedDuplicate(parsedPermission, perm)) {
// Fix for b/213323615
EventLog.writeEvent(0x534e4554, "213323615",
"The package " + pkg.getPackageName() + " seems malicious");
return true;
}
checkDuplicatePerm.put(name, parsedPermission);

2
services/core/java/com/android/server/pm/pkg/parsing/ParsingPackageUtils.java
View File

@@ -968,7 +968,7 @@ public class ParsingPackageUtils {
if (ParsedPermissionUtils.declareDuplicatePermission(pkg)) {
return input.error(
INSTALL_PARSE_FAILED_MANIFEST_MALFORMED,
"Declare duplicate permissions with different protection levels."
"Found duplicate permission with a different attribute value."
);
}