Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Respect app-ops permission in FileIntegrityService" into rvc-dev am: 0e6240f8b9

Browse Source 
Change-Id: Ibf35ccd495fbcaebbdc8ffdf430e714f3a160a29
This commit is contained in:
TreeHugger Robot
2020-03-27 23:59:02 +00:00
committed by Automerger Merge Worker
parent 3ef28f756c 0e6240f8b9
commit 528f161483
4 changed files with 39 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
core/java/android/app/SystemServiceRegistry.java
View File

@@ -1310,7 +1310,7 @@ public final class SystemServiceRegistry {
throws ServiceNotFoundException { throws ServiceNotFoundException {
IBinder b = ServiceManager.getServiceOrThrow( IBinder b = ServiceManager.getServiceOrThrow(
Context.FILE_INTEGRITY_SERVICE); Context.FILE_INTEGRITY_SERVICE);
return new FileIntegrityManager( return new FileIntegrityManager(ctx.getOuterContext(),
IFileIntegrityService.Stub.asInterface(b)); IFileIntegrityService.Stub.asInterface(b));
}}); }});
//CHECKSTYLE:ON IndentationCheck //CHECKSTYLE:ON IndentationCheck

7
core/java/android/security/FileIntegrityManager.java
View File

@@ -31,9 +31,11 @@ import java.security.cert.X509Certificate;
@SystemService(Context.FILE_INTEGRITY_SERVICE) @SystemService(Context.FILE_INTEGRITY_SERVICE)
public final class FileIntegrityManager { public final class FileIntegrityManager {
@NonNull private final IFileIntegrityService mService; @NonNull private final IFileIntegrityService mService;
@NonNull private final Context mContext;
/** @hide */ /** @hide */
public FileIntegrityManager(@NonNull IFileIntegrityService service) { public FileIntegrityManager(@NonNull Context context, @NonNull IFileIntegrityService service) {
mContext = context;
mService = service; mService = service;
} }
@@ -69,7 +71,8 @@ public final class FileIntegrityManager {
public boolean isAppSourceCertificateTrusted(@NonNull X509Certificate certificate) public boolean isAppSourceCertificateTrusted(@NonNull X509Certificate certificate)
throws CertificateEncodingException { throws CertificateEncodingException {
try { try {
return mService.isAppSourceCertificateTrusted(certificate.getEncoded()); return mService.isAppSourceCertificateTrusted(
certificate.getEncoded(), mContext.getOpPackageName());
} catch (RemoteException e) { } catch (RemoteException e) {
throw e.rethrowFromSystemServer(); throw e.rethrowFromSystemServer();
} }

2
core/java/android/security/IFileIntegrityService.aidl
View File

@@ -22,5 +22,5 @@ package android.security;
*/ */
interface IFileIntegrityService { interface IFileIntegrityService {
boolean isApkVeritySupported(); boolean isApkVeritySupported();
boolean isAppSourceCertificateTrusted(in byte[] certificateBytes); boolean isAppSourceCertificateTrusted(in byte[] certificateBytes, in String packageName);
} }

37
services/core/java/com/android/server/security/FileIntegrityService.java
View File

@@ -18,14 +18,19 @@ package com.android.server.security;
import android.annotation.NonNull; import android.annotation.NonNull;
import android.annotation.Nullable; import android.annotation.Nullable;
import android.app.AppOpsManager;
import android.content.Context; import android.content.Context;
import android.content.pm.PackageManager; import android.content.pm.PackageManager;
import android.content.pm.PackageManagerInternal;
import android.os.Binder;
import android.os.Build; import android.os.Build;
import android.os.IBinder; import android.os.IBinder;
import android.os.SystemProperties; import android.os.SystemProperties;
import android.os.UserHandle;
import android.security.IFileIntegrityService; import android.security.IFileIntegrityService;
import android.util.Slog; import android.util.Slog;
import com.android.server.LocalServices;
import com.android.server.SystemService; import com.android.server.SystemService;
import java.io.ByteArrayInputStream; import java.io.ByteArrayInputStream;
@@ -58,10 +63,10 @@ public class FileIntegrityService extends SystemService {
} }
@Override @Override
public boolean isAppSourceCertificateTrusted(@Nullable byte[] certificateBytes) { public boolean isAppSourceCertificateTrusted(@Nullable byte[] certificateBytes,
enforceAnyCallingPermissions( @NonNull String packageName) {
android.Manifest.permission.REQUEST_INSTALL_PACKAGES, checkCallerPermission(packageName);
android.Manifest.permission.INSTALL_PACKAGES);
try { try {
if (!isApkVeritySupported()) { if (!isApkVeritySupported()) {
return false; return false;
@@ -77,14 +82,30 @@ public class FileIntegrityService extends SystemService {
} }
} }
private void enforceAnyCallingPermissions(String ...permissions) { private void checkCallerPermission(String packageName) {
for (String permission : permissions) { final int callingUid = Binder.getCallingUid();
if (getContext().checkCallingPermission(permission) final int callingUserId = UserHandle.getUserId(callingUid);
final PackageManagerInternal packageManager =
LocalServices.getService(PackageManagerInternal.class);
final int packageUid = packageManager.getPackageUid(
packageName, 0 /*flag*/, callingUserId);
if (callingUid != packageUid) {
throw new SecurityException(
"Calling uid " + callingUid + " does not own package " + packageName);
}
if (getContext().checkCallingPermission(android.Manifest.permission.INSTALL_PACKAGES)
== PackageManager.PERMISSION_GRANTED) { == PackageManager.PERMISSION_GRANTED) {
return; return;
} }
final AppOpsManager appOpsManager = getContext().getSystemService(AppOpsManager.class);
final int mode = appOpsManager.checkOpNoThrow(
AppOpsManager.OP_REQUEST_INSTALL_PACKAGES, callingUid, packageName);
if (mode != AppOpsManager.MODE_ALLOWED) {
throw new SecurityException(
"Caller should have INSTALL_PACKAGES or REQUEST_INSTALL_PACKAGES");
} }
throw new SecurityException("Insufficient permission");
} }
}; };