Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use PermissionUtils

Browse Source 
The checking permission methods on NetworkStack has migrated to
PermissionUtils. Let these methods refer to PermissionUtils but
still keep them because lots of frameworks modules are using
NetworkStack methods to check permission.

Also replace the NetworkStack#checkNetworkStackPermission to
PermissionUtils in CS.

Bug: 178352309
Test: atest FrameworksNetTests
Change-Id: Icd38aa17fe471b810978e21ea361c41719e7802d
This commit is contained in:
paulhu
2021-01-25 18:53:17 +08:00
parent 5eeae4c716
commit d7a93468a6
3 changed files with 20 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
core/java/android/net/NetworkStack.java
View File

@@ -15,9 +15,6 @@
*/
package android.net;
import static android.Manifest.permission.NETWORK_STACK;
import static android.content.pm.PackageManager.PERMISSION_GRANTED;
import android.annotation.NonNull;
import android.annotation.Nullable;
import android.annotation.SystemApi;
@@ -26,8 +23,7 @@ import android.content.Context;
import android.os.IBinder;
import android.os.ServiceManager;
import java.util.ArrayList;
import java.util.Arrays;
import com.android.net.module.util.PermissionUtils;
/**
* Constants and utilities for client code communicating with the network stack service.
* @hide
@@ -79,9 +75,14 @@ public class NetworkStack {
* @param context {@link android.content.Context} for the process.
*
* @hide
*
* @deprecated Use {@link PermissionUtils#enforceNetworkStackPermission} instead.
*
* TODO: remove this method and let the users call to PermissionUtils directly.
*/
@Deprecated
public static void checkNetworkStackPermission(final @NonNull Context context) {
checkNetworkStackPermissionOr(context);
PermissionUtils.enforceNetworkStackPermission(context);
}
/**
@@ -92,31 +93,14 @@ public class NetworkStack {
* @param otherPermissions The set of permissions that could be the candidate permissions , or
* empty string if none of other permissions needed.
* @hide
*
* @deprecated Use {@link PermissionUtils#enforceNetworkStackPermissionOr} instead.
*
* TODO: remove this method and let the users call to PermissionUtils directly.
*/
@Deprecated
public static void checkNetworkStackPermissionOr(final @NonNull Context context,
final @NonNull String... otherPermissions) {
ArrayList<String> permissions = new ArrayList<String>(Arrays.asList(otherPermissions));
permissions.add(NETWORK_STACK);
permissions.add(PERMISSION_MAINLINE_NETWORK_STACK);
enforceAnyPermissionOf(context, permissions.toArray(new String[0]));
PermissionUtils.enforceNetworkStackPermissionOr(context, otherPermissions);
}
private static void enforceAnyPermissionOf(final @NonNull Context context,
final @NonNull String... permissions) {
if (!checkAnyPermissionOf(context, permissions)) {
throw new SecurityException("Requires one of the following permissions: "
+ String.join(", ", permissions) + ".");
}
}
private static boolean checkAnyPermissionOf(final @NonNull Context context,
final @NonNull String... permissions) {
for (String permission : permissions) {
if (context.checkCallingOrSelfPermission(permission) == PERMISSION_GRANTED) {
return true;
}
}
return false;
}
}

13
services/core/java/com/android/server/ConnectivityService.java
View File

@@ -193,6 +193,7 @@ import com.android.internal.util.MessageUtils;
import com.android.modules.utils.BasicShellCommandHandler;
import com.android.net.module.util.LinkPropertiesUtils.CompareOrUpdateResult;
import com.android.net.module.util.LinkPropertiesUtils.CompareResult;
import com.android.net.module.util.PermissionUtils;
import com.android.server.am.BatteryStatsService;
import com.android.server.connectivity.AutodestructReference;
import com.android.server.connectivity.DataConnectionStats;
@@ -1502,7 +1503,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
@Override
public Network getActiveNetworkForUid(int uid, boolean ignoreBlocked) {
NetworkStack.checkNetworkStackPermission(mContext);
PermissionUtils.enforceNetworkStackPermission(mContext);
return getActiveNetworkForUidInternal(uid, ignoreBlocked);
}
@@ -1525,7 +1526,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
@Override
public NetworkInfo getActiveNetworkInfoForUid(int uid, boolean ignoreBlocked) {
NetworkStack.checkNetworkStackPermission(mContext);
PermissionUtils.enforceNetworkStackPermission(mContext);
final NetworkState state = getUnfilteredActiveNetworkState(uid);
filterNetworkStateForUid(state, uid, ignoreBlocked);
return state.networkInfo;
@@ -1869,7 +1870,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
@Override
public NetworkState[] getAllNetworkState() {
// This contains IMSI details, so make sure the caller is privileged.
NetworkStack.checkNetworkStackPermission(mContext);
PermissionUtils.enforceNetworkStackPermission(mContext);
final ArrayList<NetworkState> result = new ArrayList<>();
for (Network network : getAllNetworks()) {
@@ -2293,7 +2294,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
// Public because it's used by mLockdownTracker.
public void sendConnectedBroadcast(NetworkInfo info) {
NetworkStack.checkNetworkStackPermission(mContext);
PermissionUtils.enforceNetworkStackPermission(mContext);
sendGeneralBroadcast(info, CONNECTIVITY_ACTION);
}
@@ -4663,7 +4664,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
@Override
public void setGlobalProxy(final ProxyInfo proxyProperties) {
NetworkStack.checkNetworkStackPermission(mContext);
PermissionUtils.enforceNetworkStackPermission(mContext);
mProxyTracker.setGlobalProxy(proxyProperties);
}
@@ -4865,7 +4866,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
@Override
public void setRequireVpnForUids(boolean requireVpn, UidRange[] ranges) {
NetworkStack.checkNetworkStackPermission(mContext);
PermissionUtils.enforceNetworkStackPermission(mContext);
mHandler.sendMessage(mHandler.obtainMessage(EVENT_SET_REQUIRE_VPN_FOR_UIDS,
encodeBool(requireVpn), 0 /* arg2 */, ranges));
}

41
tests/net/common/java/android/net/NetworkStackTest.java
View File

@@ -15,20 +15,8 @@
*/
package android.net;
import static android.Manifest.permission.NETWORK_STACK;
import static android.content.pm.PackageManager.PERMISSION_DENIED;
import static android.content.pm.PackageManager.PERMISSION_GRANTED;
import static android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK;
import static android.net.NetworkStack.checkNetworkStackPermission;
import static android.net.NetworkStack.checkNetworkStackPermissionOr;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.fail;
import static org.mockito.ArgumentMatchers.eq;
import static org.mockito.Mockito.any;
import static org.mockito.Mockito.when;
import android.content.Context;
import android.os.Build;
import android.os.IBinder;
@@ -46,44 +34,15 @@ import org.mockito.MockitoAnnotations;
@RunWith(AndroidJUnit4.class)
public class NetworkStackTest {
private static final String [] OTHER_PERMISSION = {"otherpermission1", "otherpermission2"};
@Rule
public DevSdkIgnoreRule mDevSdkIgnoreRule = new DevSdkIgnoreRule();
@Mock Context mCtx;
@Mock private IBinder mConnectorBinder;
@Before public void setUp() throws Exception {
MockitoAnnotations.initMocks(this);
}
@Test
public void testCheckNetworkStackPermission() throws Exception {
when(mCtx.checkCallingOrSelfPermission(eq(NETWORK_STACK))).thenReturn(PERMISSION_GRANTED);
when(mCtx.checkCallingOrSelfPermission(eq(PERMISSION_MAINLINE_NETWORK_STACK)))
.thenReturn(PERMISSION_DENIED);
checkNetworkStackPermission(mCtx);
checkNetworkStackPermissionOr(mCtx, OTHER_PERMISSION);
when(mCtx.checkCallingOrSelfPermission(eq(NETWORK_STACK))).thenReturn(PERMISSION_DENIED);
when(mCtx.checkCallingOrSelfPermission(eq(PERMISSION_MAINLINE_NETWORK_STACK)))
.thenReturn(PERMISSION_GRANTED);
checkNetworkStackPermission(mCtx);
checkNetworkStackPermissionOr(mCtx, OTHER_PERMISSION);
when(mCtx.checkCallingOrSelfPermission(any())).thenReturn(PERMISSION_DENIED);
try {
checkNetworkStackPermissionOr(mCtx, OTHER_PERMISSION);
} catch (SecurityException e) {
// Expect to get a SecurityException
return;
}
fail("Expect fail but permission granted.");
}
@Test @IgnoreUpTo(Build.VERSION_CODES.Q)
public void testGetService() {
NetworkStack.setServiceForTest(mConnectorBinder);