Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Remove settings to relax device ID access restrictions" into qt-dev

Browse Source 
am: 692a68133b

Change-Id: I54d5aba18bc6925273668b3a9b940445d6a2a4ca
This commit is contained in:
Michael Groover
2019-06-12 14:16:23 -07:00
committed by android-build-merger
parent b637eb36b3 692a68133b
commit 949e343a1c
3 changed files with 32 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
core/java/android/provider/Settings.java
View File

@@ -13568,39 +13568,6 @@ public final class Settings {
public static final String LOCATION_GLOBAL_KILL_SWITCH =
"location_global_kill_switch";
/**
* If set to 1, the device identifier check will be relaxed to the previous READ_PHONE_STATE
* permission check for 3P apps.
*
* STOPSHIP: Remove this once we ship with the new device identifier check enabled.
*
* @hide
*/
public static final String PRIVILEGED_DEVICE_IDENTIFIER_3P_CHECK_RELAXED =
"privileged_device_identifier_3p_check_relaxed";
/**
* If set to 1, the device identifier check will be relaxed to the previous READ_PHONE_STATE
* permission check for preloaded non-privileged apps.
*
* STOPSHIP: Remove this once we ship with the new device identifier check enabled.
*
* @hide
*/
public static final String PRIVILEGED_DEVICE_IDENTIFIER_NON_PRIV_CHECK_RELAXED =
"privileged_device_identifier_non_priv_check_relaxed";
/**
* If set to 1, the device identifier check will be relaxed to the previous READ_PHONE_STATE
* permission check for preloaded privileged apps.
*
* STOPSHIP: Remove this once we ship with the new device identifier check enabled.
*
* @hide
*/
public static final String PRIVILEGED_DEVICE_IDENTIFIER_PRIV_CHECK_RELAXED =
"privileged_device_identifier_priv_check_relaxed";
/**
* If set to 1, SettingsProvider's restoreAnyVersion="true" attribute will be ignored
* and restoring to lower version of platform API will be skipped.

3
core/tests/coretests/src/android/provider/SettingsBackupTest.java
View File

@@ -397,9 +397,6 @@ public class SettingsBackupTest {
Settings.Global.POWER_MANAGER_CONSTANTS,
Settings.Global.PREFERRED_NETWORK_MODE,
Settings.Global.PRIVATE_DNS_DEFAULT_MODE,
Settings.Global.PRIVILEGED_DEVICE_IDENTIFIER_NON_PRIV_CHECK_RELAXED,
Settings.Global.PRIVILEGED_DEVICE_IDENTIFIER_PRIV_CHECK_RELAXED,
Settings.Global.PRIVILEGED_DEVICE_IDENTIFIER_3P_CHECK_RELAXED,
Settings.Global.PROVISIONING_APN_ALARM_DELAY_IN_MS,
Settings.Global.RADIO_BLUETOOTH,
Settings.Global.RADIO_CELL,

99
telephony/java/com/android/internal/telephony/TelephonyPermissions.java
View File

@@ -29,8 +29,6 @@ import android.os.Process;
import android.os.RemoteException;
import android.os.ServiceManager;
import android.os.UserHandle;
import android.provider.DeviceConfig;
import android.provider.Settings;
import android.telephony.Rlog;
import android.telephony.SubscriptionManager;
import android.telephony.TelephonyManager;
@@ -364,23 +362,8 @@ public final class TelephonyPermissions {
*/
private static boolean reportAccessDeniedToReadIdentifiers(Context context, int subId, int pid,
int uid, String callingPackage, String message) {
// Check if the application is not preinstalled; if not then a separate setting is required
// to relax the check to begin flagging problems with non-preinstalled apps early.
boolean relax3PDeviceIdentifierCheck = Settings.Global.getInt(context.getContentResolver(),
Settings.Global.PRIVILEGED_DEVICE_IDENTIFIER_3P_CHECK_RELAXED, 0) == 1;
boolean isPreinstalled = false;
// Also check if the application is a preloaded non-privileged app; if so there is a
// separate setting to relax the check for these apps to ensure users can relax the check
// for non-preinstalled or non-priv apps as needed while continuing to test the other.
boolean relaxNonPrivDeviceIdentifierCheck = Settings.Global.getInt(
context.getContentResolver(),
Settings.Global.PRIVILEGED_DEVICE_IDENTIFIER_NON_PRIV_CHECK_RELAXED, 0) == 1;
boolean isPrivApp = false;
// Similar to above support relaxing the check for privileged apps while still enforcing it
// for non-privileged and non-preinstalled apps.
boolean relaxPrivDeviceIdentifierCheck = Settings.Global.getInt(
context.getContentResolver(),
Settings.Global.PRIVILEGED_DEVICE_IDENTIFIER_PRIV_CHECK_RELAXED, 0) == 1;
ApplicationInfo callingPackageInfo = null;
try {
callingPackageInfo = context.getPackageManager().getApplicationInfoAsUser(
@@ -399,58 +382,40 @@ public final class TelephonyPermissions {
Log.e(LOG_TAG, "Exception caught obtaining package info for package " + callingPackage,
e);
}
// The new Q restrictions for device identifier access will be enforced for all apps with
// settings to individually disable the new restrictions for privileged, preloaded
// non-privileged, and non-preinstalled apps.
if (!isIdentifierCheckDisabled() && (
(isPrivApp && !relaxPrivDeviceIdentifierCheck)
|| (!isPreinstalled && !relax3PDeviceIdentifierCheck)
|| (isPreinstalled && !isPrivApp && !relaxNonPrivDeviceIdentifierCheck))) {
// The current package should only be reported in StatsLog if it has not previously been
// reported for the currently invoked device identifier method.
boolean packageReported = sReportedDeviceIDPackages.containsKey(callingPackage);
if (!packageReported || !sReportedDeviceIDPackages.get(callingPackage).contains(
message)) {
Set invokedMethods;
if (!packageReported) {
invokedMethods = new HashSet<String>();
sReportedDeviceIDPackages.put(callingPackage, invokedMethods);
} else {
invokedMethods = sReportedDeviceIDPackages.get(callingPackage);
}
invokedMethods.add(message);
StatsLog.write(StatsLog.DEVICE_IDENTIFIER_ACCESS_DENIED, callingPackage, message,
isPreinstalled, isPrivApp);
// The current package should only be reported in StatsLog if it has not previously been
// reported for the currently invoked device identifier method.
boolean packageReported = sReportedDeviceIDPackages.containsKey(callingPackage);
if (!packageReported || !sReportedDeviceIDPackages.get(callingPackage).contains(
message)) {
Set invokedMethods;
if (!packageReported) {
invokedMethods = new HashSet<String>();
sReportedDeviceIDPackages.put(callingPackage, invokedMethods);
} else {
invokedMethods = sReportedDeviceIDPackages.get(callingPackage);
}
Log.w(LOG_TAG, "reportAccessDeniedToReadIdentifiers:" + callingPackage + ":" + message
+ ":isPreinstalled=" + isPreinstalled + ":isPrivApp=" + isPrivApp);
// if the target SDK is pre-Q then check if the calling package would have previously
// had access to device identifiers.
if (callingPackageInfo != null && (
callingPackageInfo.targetSdkVersion < Build.VERSION_CODES.Q)) {
if (context.checkPermission(
android.Manifest.permission.READ_PHONE_STATE,
pid,
uid) == PackageManager.PERMISSION_GRANTED) {
return false;
}
if (checkCarrierPrivilegeForSubId(subId)) {
return false;
}
}
throw new SecurityException(message + ": The user " + uid
+ " does not meet the requirements to access device identifiers.");
} else {
return checkReadPhoneState(context, subId, pid, uid, callingPackage, message);
invokedMethods.add(message);
StatsLog.write(StatsLog.DEVICE_IDENTIFIER_ACCESS_DENIED, callingPackage, message,
isPreinstalled, isPrivApp);
}
}
/**
* Returns true if the new device identifier access restrictions are disabled.
*/
private static boolean isIdentifierCheckDisabled() {
return DeviceConfig.getInt(DeviceConfig.NAMESPACE_PRIVACY,
PROPERTY_DEVICE_IDENTIFIER_ACCESS_RESTRICTIONS_DISABLED, 0) == 1;
Log.w(LOG_TAG, "reportAccessDeniedToReadIdentifiers:" + callingPackage + ":" + message
+ ":isPreinstalled=" + isPreinstalled + ":isPrivApp=" + isPrivApp);
// if the target SDK is pre-Q then check if the calling package would have previously
// had access to device identifiers.
if (callingPackageInfo != null && (
callingPackageInfo.targetSdkVersion < Build.VERSION_CODES.Q)) {
if (context.checkPermission(
android.Manifest.permission.READ_PHONE_STATE,
pid,
uid) == PackageManager.PERMISSION_GRANTED) {
return false;
}
if (checkCarrierPrivilegeForSubId(subId)) {
return false;
}
}
throw new SecurityException(message + ": The user " + uid
+ " does not meet the requirements to access device identifiers.");
}
/**