From 6f4f7061509a32c48944d42fbaaffed26e7aca90 Mon Sep 17 00:00:00 2001 From: Jacky Kao Date: Mon, 28 Mar 2022 09:43:27 +0800 Subject: [PATCH] Don't allow an external service to be an A11y service When some applications create an external service and register this service to be an A11y service, then this service can kill the system and restart it continuously. This is a security vulnerability and we add not allow an external service to register as an A11y service to fix it. Bug: 216115176 Test: a11y CTS & unit tests Change-Id: If75b9c300df73e98be92d6c14d69301cc377b205 --- .../accessibility/AccessibilitySecurityPolicy.java | 8 ++++++++ .../AccessibilitySecurityPolicyTest.java | 12 ++++++++++++ 2 files changed, 20 insertions(+) diff --git a/services/accessibility/java/com/android/server/accessibility/AccessibilitySecurityPolicy.java b/services/accessibility/java/com/android/server/accessibility/AccessibilitySecurityPolicy.java index c637045589e7b..bc3ffab5ccb6f 100644 --- a/services/accessibility/java/com/android/server/accessibility/AccessibilitySecurityPolicy.java +++ b/services/accessibility/java/com/android/server/accessibility/AccessibilitySecurityPolicy.java @@ -647,6 +647,14 @@ public class AccessibilitySecurityPolicy { return false; } + if ((serviceInfo.flags & ServiceInfo.FLAG_EXTERNAL_SERVICE) != 0) { + Slog.w(LOG_TAG, "Skipping accessibility service " + new ComponentName( + serviceInfo.packageName, serviceInfo.name).flattenToShortString() + + ": the service is the external one and doesn't allow to register as " + + "an accessibility service "); + return false; + } + int servicePackageUid = serviceInfo.applicationInfo.uid; if (mAppOpsManager.noteOpNoThrow(AppOpsManager.OPSTR_BIND_ACCESSIBILITY_SERVICE, servicePackageUid, serviceInfo.packageName, null, null) diff --git a/services/tests/servicestests/src/com/android/server/accessibility/AccessibilitySecurityPolicyTest.java b/services/tests/servicestests/src/com/android/server/accessibility/AccessibilitySecurityPolicyTest.java index edacc165016f1..9b56303244c0c 100644 --- a/services/tests/servicestests/src/com/android/server/accessibility/AccessibilitySecurityPolicyTest.java +++ b/services/tests/servicestests/src/com/android/server/accessibility/AccessibilitySecurityPolicyTest.java @@ -572,6 +572,18 @@ public class AccessibilitySecurityPolicyTest { serviceInfo.applicationInfo.uid, serviceInfo.packageName, null, null); } + @Test + public void canRegisterService_isExternalService_returnFalse() { + final ServiceInfo serviceInfo = new ServiceInfo(); + serviceInfo.applicationInfo = new ApplicationInfo(); + serviceInfo.packageName = PACKAGE_NAME; + serviceInfo.name = AccessibilitySecurityPolicyTest.class.getSimpleName(); + serviceInfo.permission = android.Manifest.permission.BIND_ACCESSIBILITY_SERVICE; + serviceInfo.flags |= ServiceInfo.FLAG_EXTERNAL_SERVICE; + + assertFalse(mA11ySecurityPolicy.canRegisterService(serviceInfo)); + } + @Test public void checkAccessibilityAccess_shouldCheckAppOps() { final AccessibilityServiceInfo mockServiceInfo = Mockito.mock(