Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't allow an external service to be an A11y service

Browse Source 
When some applications create an external service and register this service
to be an A11y service, then this service can kill the system and restart
it continuously.
This is a security vulnerability and we add not allow an external service
to register as an A11y service to fix it.

Bug: 216115176
Test: a11y CTS & unit tests
Change-Id: If75b9c300df73e98be92d6c14d69301cc377b205
This commit is contained in:
Jacky Kao
2022-03-28 09:43:27 +08:00
parent 5f5ab5a727
commit 6f4f706150
2 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
services/accessibility/java/com/android/server/accessibility/AccessibilitySecurityPolicy.java
View File

@@ -647,6 +647,14 @@ public class AccessibilitySecurityPolicy {
return false;
}
if ((serviceInfo.flags & ServiceInfo.FLAG_EXTERNAL_SERVICE) != 0) {
Slog.w(LOG_TAG, "Skipping accessibility service " + new ComponentName(
serviceInfo.packageName, serviceInfo.name).flattenToShortString()
+ ": the service is the external one and doesn't allow to register as "
+ "an accessibility service ");
return false;
}
int servicePackageUid = serviceInfo.applicationInfo.uid;
if (mAppOpsManager.noteOpNoThrow(AppOpsManager.OPSTR_BIND_ACCESSIBILITY_SERVICE,
servicePackageUid, serviceInfo.packageName, null, null)

12
services/tests/servicestests/src/com/android/server/accessibility/AccessibilitySecurityPolicyTest.java
View File

@@ -572,6 +572,18 @@ public class AccessibilitySecurityPolicyTest {
serviceInfo.applicationInfo.uid, serviceInfo.packageName, null, null);
}
@Test
public void canRegisterService_isExternalService_returnFalse() {
final ServiceInfo serviceInfo = new ServiceInfo();
serviceInfo.applicationInfo = new ApplicationInfo();
serviceInfo.packageName = PACKAGE_NAME;
serviceInfo.name = AccessibilitySecurityPolicyTest.class.getSimpleName();
serviceInfo.permission = android.Manifest.permission.BIND_ACCESSIBILITY_SERVICE;
serviceInfo.flags |= ServiceInfo.FLAG_EXTERNAL_SERVICE;
assertFalse(mA11ySecurityPolicy.canRegisterService(serviceInfo));
}
@Test
public void checkAccessibilityAccess_shouldCheckAppOps() {
final AccessibilityServiceInfo mockServiceInfo = Mockito.mock(