Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

am 6ea4e11d: Merge "Don\'t enforce control permission when preparing consented VPN." into lmp-mr1-dev

Browse Source 
* commit '6ea4e11d9817d85eb5c0ff445154985e4eb0c534':
  Don't enforce control permission when preparing consented VPN.
This commit is contained in:
Jeff Davidson
2014-11-24 21:25:41 +00:00
committed by Android Git Automerger
parent c27f5baaeb 6ea4e11d98
commit 6fdf2a1709
2 changed files with 50 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
services/core/java/com/android/server/ConnectivityService.java
View File

@@ -2776,7 +2776,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
}
/**
* Prepare for a VPN application. This method is used by system-privileged apps.
* Prepare for a VPN application.
* Permissions are checked in Vpn class.
* @hide
*/

103
services/core/java/com/android/server/connectivity/Vpn.java
View File

@@ -216,20 +216,11 @@ public class Vpn {
* @return true if the operation is succeeded.
*/
public synchronized boolean prepare(String oldPackage, String newPackage) {
// Return false if the package does not match.
if (oldPackage != null && getAppUid(oldPackage, mUserHandle) != mOwnerUID) {
// The package doesn't match. If this VPN was not previously authorized, return false
// to force user authorization. Otherwise, revoke the VPN anyway.
// The package doesn't match. We return false (to obtain user consent) unless the user
// has already consented to that VPN package.
if (!oldPackage.equals(VpnConfig.LEGACY_VPN) && isVpnUserPreConsented(oldPackage)) {
long token = Binder.clearCallingIdentity();
try {
// This looks bizarre, but it is what ConfirmDialog in VpnDialogs is doing when
// the user clicks through to allow the VPN to consent. So we are emulating the
// action of the dialog without actually showing it.
prepare(null, oldPackage);
} finally {
Binder.restoreCallingIdentity(token);
}
prepareInternal(oldPackage);
return true;
}
return false;
@@ -244,54 +235,58 @@ public class Vpn {
// Check if the caller is authorized.
enforceControlPermission();
// Reset the interface.
if (mInterface != null) {
mStatusIntent = null;
agentDisconnect();
jniReset(mInterface);
mInterface = null;
mVpnUsers = null;
}
// Revoke the connection or stop LegacyVpnRunner.
if (mConnection != null) {
try {
mConnection.mService.transact(IBinder.LAST_CALL_TRANSACTION,
Parcel.obtain(), null, IBinder.FLAG_ONEWAY);
} catch (Exception e) {
// ignore
}
mContext.unbindService(mConnection);
mConnection = null;
} else if (mLegacyVpnRunner != null) {
mLegacyVpnRunner.exit();
mLegacyVpnRunner = null;
}
prepareInternal(newPackage);
return true;
}
/** Prepare the VPN for the given package. Does not perform permission checks. */
private void prepareInternal(String newPackage) {
long token = Binder.clearCallingIdentity();
try {
mNetd.denyProtect(mOwnerUID);
} catch (Exception e) {
Log.wtf(TAG, "Failed to disallow UID " + mOwnerUID + " to call protect() " + e);
// Reset the interface.
if (mInterface != null) {
mStatusIntent = null;
agentDisconnect();
jniReset(mInterface);
mInterface = null;
mVpnUsers = null;
}
// Revoke the connection or stop LegacyVpnRunner.
if (mConnection != null) {
try {
mConnection.mService.transact(IBinder.LAST_CALL_TRANSACTION,
Parcel.obtain(), null, IBinder.FLAG_ONEWAY);
} catch (Exception e) {
// ignore
}
mContext.unbindService(mConnection);
mConnection = null;
} else if (mLegacyVpnRunner != null) {
mLegacyVpnRunner.exit();
mLegacyVpnRunner = null;
}
try {
mNetd.denyProtect(mOwnerUID);
} catch (Exception e) {
Log.wtf(TAG, "Failed to disallow UID " + mOwnerUID + " to call protect() " + e);
}
Log.i(TAG, "Switched from " + mPackage + " to " + newPackage);
mPackage = newPackage;
mOwnerUID = getAppUid(newPackage, mUserHandle);
try {
mNetd.allowProtect(mOwnerUID);
} catch (Exception e) {
Log.wtf(TAG, "Failed to allow UID " + mOwnerUID + " to call protect() " + e);
}
mConfig = null;
updateState(DetailedState.IDLE, "prepare");
} finally {
Binder.restoreCallingIdentity(token);
}
Log.i(TAG, "Switched from " + mPackage + " to " + newPackage);
mPackage = newPackage;
mOwnerUID = getAppUid(newPackage, mUserHandle);
token = Binder.clearCallingIdentity();
try {
mNetd.allowProtect(mOwnerUID);
} catch (Exception e) {
Log.wtf(TAG, "Failed to allow UID " + mOwnerUID + " to call protect() " + e);
} finally {
Binder.restoreCallingIdentity(token);
}
mConfig = null;
updateState(DetailedState.IDLE, "prepare");
return true;
}
/**