Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Fix the internet permission for native services"

Browse Source 
am: 1f721ee602

Change-Id: If68f7cf840f5648f3f94a844eb075d442b90439a
This commit is contained in:
Chenbo Feng
2019-05-23 13:13:25 -07:00
committed by android-build-merger
parent cc65a628eb 1f721ee602
commit 5d4822bcd2
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
data/etc/platform.xml
View File

@@ -147,6 +147,9 @@
<assign-permission name="android.permission.UPDATE_DEVICE_STATS" uid="media" /> <assign-permission name="android.permission.UPDATE_DEVICE_STATS" uid="media" />
<assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="media" /> <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="media" />
<assign-permission name="android.permission.GET_PROCESS_STATE_AND_OOM_SCORE" uid="media" /> <assign-permission name="android.permission.GET_PROCESS_STATE_AND_OOM_SCORE" uid="media" />
<assign-permission name="android.permission.INTERNET" uid="media" />
<assign-permission name="android.permission.INTERNET" uid="shell" />
<assign-permission name="android.permission.MODIFY_AUDIO_SETTINGS" uid="audioserver" /> <assign-permission name="android.permission.MODIFY_AUDIO_SETTINGS" uid="audioserver" />
<assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="audioserver" /> <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="audioserver" />

8
services/core/java/com/android/server/connectivity/PermissionMonitor.java
View File

@@ -199,15 +199,13 @@ public class PermissionMonitor {
ArraySet<String> perms = systemPermission.valueAt(i); ArraySet<String> perms = systemPermission.valueAt(i);
int uid = systemPermission.keyAt(i); int uid = systemPermission.keyAt(i);
int netdPermission = 0; int netdPermission = 0;
// Get the uids of native services that have UPDATE_DEVICE_STATS permission. // Get the uids of native services that have UPDATE_DEVICE_STATS or INTERNET permission.
if (perms != null) { if (perms != null) {
netdPermission |= perms.contains(UPDATE_DEVICE_STATS) netdPermission |= perms.contains(UPDATE_DEVICE_STATS)
? INetd.PERMISSION_UPDATE_DEVICE_STATS : 0; ? INetd.PERMISSION_UPDATE_DEVICE_STATS : 0;
netdPermission |= perms.contains(INTERNET)
? INetd.PERMISSION_INTERNET : 0;
} }
// For internet permission, the native services have their own selinux domains and
// sepolicy will control the socket creation during run time. netd cannot block the
// socket creation based on the permission information here.
netdPermission |= INetd.PERMISSION_INTERNET;
netdPermsUids.put(uid, netdPermsUids.get(uid) | netdPermission); netdPermsUids.put(uid, netdPermsUids.get(uid) | netdPermission);
} }
log("Users: " + mUsers.size() + ", Apps: " + mApps.size()); log("Users: " + mUsers.size() + ", Apps: " + mApps.size());