Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Make sure that only the owner can call [stop|start]VpnProfile()" into sc-dev

Browse Source
This commit is contained in:
Lucas Lin
2021-08-10 02:28:24 +00:00
committed by Android (Google) Code Review
parent b8a3a61c6f 591e345fbc
commit 8d26ea92b4
1 changed files with 28 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
services/core/java/com/android/server/VpnManagerService.java
View File

@@ -26,6 +26,8 @@ import android.content.BroadcastReceiver;
import android.content.Context; import android.content.Context;
import android.content.Intent; import android.content.Intent;
import android.content.IntentFilter; import android.content.IntentFilter;
import android.content.pm.PackageManager;
import android.content.pm.PackageManager.NameNotFoundException;
import android.net.ConnectivityManager; import android.net.ConnectivityManager;
import android.net.INetd; import android.net.INetd;
import android.net.IVpnManager; import android.net.IVpnManager;
@@ -312,6 +314,26 @@ public class VpnManagerService extends IVpnManager.Stub {
} }
} }
// TODO : Move to a static lib to factorize with Vpn.java
private int getAppUid(final String app, final int userId) {
final PackageManager pm = mContext.getPackageManager();
final long token = Binder.clearCallingIdentity();
try {
return pm.getPackageUidAsUser(app, userId);
} catch (NameNotFoundException e) {
return -1;
} finally {
Binder.restoreCallingIdentity(token);
}
}
private void verifyCallingUidAndPackage(String packageName, int callingUid) {
final int userId = UserHandle.getUserId(callingUid);
if (getAppUid(packageName, userId) != callingUid) {
throw new SecurityException(packageName + " does not belong to uid " + callingUid);
}
}
/** /**
* Starts the VPN based on the stored profile for the given package * Starts the VPN based on the stored profile for the given package
* *
@@ -323,7 +345,9 @@ public class VpnManagerService extends IVpnManager.Stub {
*/ */
@Override @Override
public void startVpnProfile(@NonNull String packageName) { public void startVpnProfile(@NonNull String packageName) {
final int user = UserHandle.getUserId(mDeps.getCallingUid()); final int callingUid = Binder.getCallingUid();
verifyCallingUidAndPackage(packageName, callingUid);
final int user = UserHandle.getUserId(callingUid);
synchronized (mVpns) { synchronized (mVpns) {
throwIfLockdownEnabled(); throwIfLockdownEnabled();
mVpns.get(user).startVpnProfile(packageName); mVpns.get(user).startVpnProfile(packageName);
@@ -340,7 +364,9 @@ public class VpnManagerService extends IVpnManager.Stub {
*/ */
@Override @Override
public void stopVpnProfile(@NonNull String packageName) { public void stopVpnProfile(@NonNull String packageName) {
final int user = UserHandle.getUserId(mDeps.getCallingUid()); final int callingUid = Binder.getCallingUid();
verifyCallingUidAndPackage(packageName, callingUid);
final int user = UserHandle.getUserId(callingUid);
synchronized (mVpns) { synchronized (mVpns) {
mVpns.get(user).stopVpnProfile(packageName); mVpns.get(user).stopVpnProfile(packageName);
} }