Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Fix the visibility check for sdk_sandbox processes" into tm-dev

Browse Source
This commit is contained in:
Nikita Ioffe
2022-07-29 13:31:57 +00:00
committed by Android (Google) Code Review
parent bb2e856381 a9d522f43c
commit f1ac54d3a0
2 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
services/core/java/com/android/server/pm/AppsFilterBase.java
View File

@@ -323,7 +323,8 @@ public abstract class AppsFilterBase implements AppsFilterSnapshot {
return false;
} else if (Process.isSdkSandboxUid(callingAppId)) {
// we only allow sdk sandbox processes access to forcequeryable packages
return !isForceQueryable(targetPkgSetting.getAppId());
return !isForceQueryable(targetPkgSetting.getAppId())
&& !isImplicitlyQueryable(callingAppId, targetPkgSetting.getAppId());
}
if (mCacheReady) { // use cache
if (!shouldFilterApplicationUsingCache(callingUid,

33
services/tests/servicestests/src/com/android/server/pm/AppsFilterImplTest.java
View File

@@ -1376,6 +1376,39 @@ public class AppsFilterImplTest {
null /* callingSetting */, target, SYSTEM_USER));
}
@Test
public void testSdkSandbox_implicitAccessGranted_canSeePackage() throws Exception {
final AppsFilterImpl appsFilter =
new AppsFilterImpl(mFeatureConfigMock, new String[]{}, false, null,
mMockHandler);
final WatchableTester watcher = new WatchableTester(appsFilter, "onChange");
watcher.register();
simulateAddBasicAndroid(appsFilter);
watcher.verifyChangeReported("addBasic");
appsFilter.onSystemReady(mPmInternal);
watcher.verifyChangeReported("systemReady");
PackageSetting target = simulateAddPackage(appsFilter,
pkg("com.some.package"), DUMMY_TARGET_APPID,
setting -> setting.setPkgFlags(ApplicationInfo.FLAG_SYSTEM));
int callingUid = 20123;
assertTrue(Process.isSdkSandboxUid(callingUid));
// Without granting the implicit access the app shouldn't be visible to the sdk sandbox uid.
assertTrue(
appsFilter.shouldFilterApplication(mSnapshot, callingUid,
null /* callingSetting */, target, SYSTEM_USER));
appsFilter.grantImplicitAccess(callingUid, target.getAppId(), false /* retainOnUpdate */);
watcher.verifyChangeReported("grantImplicitAccess");
// After implicit access was granted the app should be visible to the sdk sandbox uid.
assertFalse(
appsFilter.shouldFilterApplication(mSnapshot, callingUid,
null /* callingSetting */, target, SYSTEM_USER));
}
private List<Integer> toList(int[] array) {
ArrayList<Integer> ret = new ArrayList<>(array.length);
for (int i = 0; i < array.length; i++) {