Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add visibility special casing for sdk sandbox

Browse Source 
This change adds special visibility enforcement to the apps filter for
SDK sandbox uids. If we encounter an SDK sandbox UID, we'll bypass
traditional visibility checks and instead just enforce that the target
is forceQueryable. All else besides the client app will be blocked.

Test: atest AppsFilterImplTest
Bug: 234129698
Change-Id: Ic42d46232841294a0fd148e5f29d1ff5ec4261c8
This commit is contained in:
Patrick Baumann
2022-05-27 18:35:17 +00:00
parent d7df1b2804
commit c06ace7acc
2 changed files with 43 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
services/core/java/com/android/server/pm/AppsFilterBase.java
View File

@@ -321,6 +321,9 @@ public abstract class AppsFilterBase implements AppsFilterSnapshot {
|| targetPkgSetting.getAppId() < Process.FIRST_APPLICATION_UID
|| callingAppId == targetPkgSetting.getAppId()) {
return false;
} else if (Process.isSdkSandboxUid(callingAppId)) {
// we only allow sdk sandbox processes access to forcequeryable packages
return !isForceQueryable(targetPkgSetting.getAppId());
}
if (mCacheReady) { // use cache
if (!shouldFilterApplicationUsingCache(callingUid,

40
services/tests/servicestests/src/com/android/server/pm/AppsFilterImplTest.java
View File

@@ -1336,6 +1336,46 @@ public class AppsFilterImplTest {
}
@Test
public void testSdkSandbox_canSeeForceQueryable() throws Exception {
final AppsFilterImpl appsFilter =
new AppsFilterImpl(mFeatureConfigMock, new String[]{}, false, null,
mMockHandler);
simulateAddBasicAndroid(appsFilter);
appsFilter.onSystemReady(mPmInternal);
PackageSetting target = simulateAddPackage(appsFilter,
pkg("com.some.package").setForceQueryable(true), DUMMY_TARGET_APPID,
setting -> setting.setPkgFlags(ApplicationInfo.FLAG_SYSTEM));
int callingUid = 20123;
assertTrue(Process.isSdkSandboxUid(callingUid));
assertFalse(
appsFilter.shouldFilterApplication(mSnapshot, callingUid,
null /* callingSetting */, target, SYSTEM_USER));
}
@Test
public void testSdkSandbox_cannotSeeNonForceQueryable() throws Exception {
final AppsFilterImpl appsFilter =
new AppsFilterImpl(mFeatureConfigMock, new String[]{}, false, null,
mMockHandler);
simulateAddBasicAndroid(appsFilter);
appsFilter.onSystemReady(mPmInternal);
PackageSetting target = simulateAddPackage(appsFilter,
pkg("com.some.package"), DUMMY_TARGET_APPID,
setting -> setting.setPkgFlags(ApplicationInfo.FLAG_SYSTEM));
int callingUid = 20123;
assertTrue(Process.isSdkSandboxUid(callingUid));
assertTrue(
appsFilter.shouldFilterApplication(mSnapshot, callingUid,
null /* callingSetting */, target, SYSTEM_USER));
}
private List<Integer> toList(int[] array) {
ArrayList<Integer> ret = new ArrayList<>(array.length);
for (int i = 0; i < array.length; i++) {