Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[SettingsProvider] enforce @Readable for getAll*Settings methods

Browse Source 
BUG: 208268457
Test: atest android.appsecurity.cts.ReadableSettingsFieldsTest
Change-Id: If2512b0b7586d755104c69736c500dffde860cda
This commit is contained in:
Songchun Fan
2021-12-03 16:54:44 -08:00
parent edcc5a9682
commit 631dae9f4a
1 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
View File

@@ -1346,6 +1346,13 @@ public class SettingsProvider extends ContentProvider {
// Anyone can get the global settings, so no security checks. // Anyone can get the global settings, so no security checks.
for (int i = 0; i < nameCount; i++) { for (int i = 0; i < nameCount; i++) {
String name = names.get(i); String name = names.get(i);
try {
enforceSettingReadable(name, SETTINGS_TYPE_GLOBAL,
UserHandle.getCallingUserId());
} catch (SecurityException e) {
// Caller doesn't have permission to read this setting
continue;
}
Setting setting = settingsState.getSettingLocked(name); Setting setting = settingsState.getSettingLocked(name);
appendSettingToCursor(result, setting); appendSettingToCursor(result, setting);
} }
@@ -1523,6 +1530,13 @@ public class SettingsProvider extends ContentProvider {
continue; continue;
} }
try {
enforceSettingReadable(name, SETTINGS_TYPE_SECURE, callingUserId);
} catch (SecurityException e) {
// Caller doesn't have permission to read this setting
continue;
}
// As of Android O, the SSAID is read from an app-specific entry in table // As of Android O, the SSAID is read from an app-specific entry in table
// SETTINGS_FILE_SSAID, unless accessed by a system process. // SETTINGS_FILE_SSAID, unless accessed by a system process.
final Setting setting; final Setting setting;
@@ -1785,7 +1799,12 @@ public class SettingsProvider extends ContentProvider {
for (int i = 0; i < nameCount; i++) { for (int i = 0; i < nameCount; i++) {
String name = names.get(i); String name = names.get(i);
try {
enforceSettingReadable(name, SETTINGS_TYPE_SYSTEM, callingUserId);
} catch (SecurityException e) {
// Caller doesn't have permission to read this setting
continue;
}
// Determine the owning user as some profile settings are cloned from the parent. // Determine the owning user as some profile settings are cloned from the parent.
final int owningUserId = resolveOwningUserIdForSystemSettingLocked(callingUserId, final int owningUserId = resolveOwningUserIdForSystemSettingLocked(callingUserId,
name); name);