Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add namespace-level flag-write allowlist.

Browse Source 
Also migrate some tests to allowlisted functionality, that exercise the
namespace flag-write allowlist.

Test: Presubmits
Bug: 273546621
Change-Id: I686dfd3c11b0e49f94cc46b3d009107c0a3b8e1a
This commit is contained in:
Ted Bauer
2023-03-29 14:25:14 +00:00
parent 265b4ef66a
commit 5c5afc5603
4 changed files with 51 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
core/tests/coretests/AndroidManifest.xml
View File

@@ -76,7 +76,8 @@
<uses-permission android:name="android.permission.USE_CREDENTIALS" />
<uses-permission android:name="android.permission.WAKE_LOCK" />
<uses-permission android:name="android.permission.WRITE_CONTACTS" />
<uses-permission android:name="android.permission.WRITE_DEVICE_CONFIG" />
<uses-permission android:name="android.permission.READ_WRITE_SYNC_DISABLED_MODE_CONFIG" />
<uses-permission android:name="android.permission.WRITE_ALLOWLISTED_DEVICE_CONFIG" />
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.WRITE_SETTINGS" />
<uses-permission android:name="android.permission.WRITE_SECURE_SETTINGS" />

1
packages/SettingsProvider/src/com/android/providers/settings/OWNERS Normal file
View File

@@ -0,0 +1 @@
per-file WritableNamespacePrefixes.java = cbrubaker@google.com,tedbauer@google.com

10
packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
View File

@@ -2323,7 +2323,15 @@ public class SettingsProvider extends ContentProvider {
return;
} else if (hasAllowlistPermission) {
for (String flag : flags) {
if (!DeviceConfig.getAdbWritableFlags().contains(flag)) {
boolean namespaceAllowed = false;
for (String allowlistedPrefix : WritableNamespacePrefixes.ALLOWLIST) {
if (flag.startsWith(allowlistedPrefix)) {
namespaceAllowed = true;
break;
}
}
if (!namespaceAllowed && !DeviceConfig.getAdbWritableFlags().contains(flag)) {
throw new SecurityException("Permission denial for flag '"
+ flag
+ "'; allowlist permission granted, but must add flag to the allowlist.");

39
packages/SettingsProvider/src/com/android/providers/settings/WritableNamespacePrefixes.java Normal file
View File

@@ -0,0 +1,39 @@
/*
* Copyright (C) 2007 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.android.providers.settings;
import android.util.ArraySet;
import java.util.Arrays;
import java.util.Set;
/**
* Contains the list of prefixes for namespaces in which any flag can be written with adb.
* <p>
* A security review is required for any prefix that's added to this list. To add to
* the list, create a change and tag the OWNER. In the change description, include a
* description of the flag's functionality, and a justification for why it needs to be
* allowlisted.
*/
final class WritableNamespacePrefixes {
public static final Set<String> ALLOWLIST =
new ArraySet<String>(Arrays.asList(
"app_compat_overrides",
"game_overlay",
"namespace1"
));
}