Protect usage data with OP_GET_USAGE_STATS.
APIs that return package usage data (such as the new StatsManager)
must ensure that callers hold both the PACKAGE_USAGE_STATS permission
and the OP_GET_USAGE_STATS app-op.
Add noteOp() method that can be called from native code.
Also add missing security checks on command interface.
Bug: 77662908, 78121728
Test: builds, boots
Change-Id: Ie0d51e4baaacd9d7d36ba0c587ec91a870b9df17
diff --git a/cmds/statsd/src/StatsService.cpp b/cmds/statsd/src/StatsService.cpp
index f7cc00c..31b8df3 100644
--- a/cmds/statsd/src/StatsService.cpp
+++ b/cmds/statsd/src/StatsService.cpp
@@ -27,8 +27,10 @@
#include "subscriber/SubscriberReporter.h"
#include <android-base/file.h>
+#include <android-base/stringprintf.h>
#include <binder/IPCThreadState.h>
#include <binder/IServiceManager.h>
+#include <binder/PermissionController.h>
#include <dirent.h>
#include <frameworks/base/cmds/statsd/src/statsd_config.pb.h>
#include <private/android_filesystem_config.h>
@@ -42,13 +44,83 @@
using namespace android;
+using android::base::StringPrintf;
+
namespace android {
namespace os {
namespace statsd {
constexpr const char* kPermissionDump = "android.permission.DUMP";
+constexpr const char* kPermissionUsage = "android.permission.PACKAGE_USAGE_STATS";
+
+constexpr const char* kOpUsage = "android:get_usage_stats";
+
#define STATS_SERVICE_DIR "/data/misc/stats-service"
+static binder::Status ok() {
+ return binder::Status::ok();
+}
+
+static binder::Status exception(uint32_t code, const std::string& msg) {
+ ALOGE("%s (%d)", msg.c_str(), code);
+ return binder::Status::fromExceptionCode(code, String8(msg.c_str()));
+}
+
+binder::Status checkUid(uid_t expectedUid) {
+ uid_t uid = IPCThreadState::self()->getCallingUid();
+ if (uid == expectedUid || uid == AID_ROOT) {
+ return ok();
+ } else {
+ return exception(binder::Status::EX_SECURITY,
+ StringPrintf("UID %d is not expected UID %d", uid, expectedUid));
+ }
+}
+
+binder::Status checkDumpAndUsageStats(const String16& packageName) {
+ pid_t pid = IPCThreadState::self()->getCallingPid();
+ uid_t uid = IPCThreadState::self()->getCallingUid();
+
+ // Root, system, and shell always have access
+ if (uid == AID_ROOT || uid == AID_SYSTEM || uid == AID_SHELL) {
+ return ok();
+ }
+
+ // Caller must be granted these permissions
+ if (!checkCallingPermission(String16(kPermissionDump))) {
+ return exception(binder::Status::EX_SECURITY,
+ StringPrintf("UID %d / PID %d lacks permission %s", uid, pid, kPermissionDump));
+ }
+ if (!checkCallingPermission(String16(kPermissionUsage))) {
+ return exception(binder::Status::EX_SECURITY,
+ StringPrintf("UID %d / PID %d lacks permission %s", uid, pid, kPermissionUsage));
+ }
+
+ // Caller must also have usage stats op granted
+ PermissionController pc;
+ switch (pc.noteOp(String16(kOpUsage), uid, packageName)) {
+ case PermissionController::MODE_ALLOWED:
+ case PermissionController::MODE_DEFAULT:
+ return ok();
+ default:
+ return exception(binder::Status::EX_SECURITY,
+ StringPrintf("UID %d / PID %d lacks app-op %s", uid, pid, kOpUsage));
+ }
+}
+
+#define ENFORCE_UID(uid) { \
+ binder::Status status = checkUid((uid)); \
+ if (!status.isOk()) { \
+ return status; \
+ } \
+}
+
+#define ENFORCE_DUMP_AND_USAGE_STATS(packageName) { \
+ binder::Status status = checkDumpAndUsageStats(packageName); \
+ if (!status.isOk()) { \
+ return status; \
+ } \
+}
+
StatsService::StatsService(const sp<Looper>& handlerLooper)
: mAnomalyAlarmMonitor(new AlarmMonitor(MIN_DIFF_TO_UPDATE_REGISTERED_ALARM_SECS,
[](const sp<IStatsCompanionService>& sc, int64_t timeMillis) {
@@ -212,7 +284,10 @@
* Implementation of the adb shell cmd stats command.
*/
status_t StatsService::command(FILE* in, FILE* out, FILE* err, Vector<String8>& args) {
- // TODO: Permission check
+ uid_t uid = IPCThreadState::self()->getCallingUid();
+ if (uid != AID_ROOT && uid != AID_SHELL) {
+ return PERMISSION_DENIED;
+ }
const int argCount = args.size();
if (argCount >= 1) {
@@ -660,13 +735,9 @@
Status StatsService::informAllUidData(const vector<int32_t>& uid, const vector<int64_t>& version,
const vector<String16>& app) {
+ ENFORCE_UID(AID_SYSTEM);
+
VLOG("StatsService::informAllUidData was called");
-
- if (IPCThreadState::self()->getCallingUid() != AID_SYSTEM) {
- return Status::fromExceptionCode(Status::EX_SECURITY,
- "Only system uid can call informAllUidData");
- }
-
mUidMap->updateMap(getElapsedRealtimeNs(), uid, version, app);
VLOG("StatsService::informAllUidData succeeded");
@@ -674,36 +745,26 @@
}
Status StatsService::informOnePackage(const String16& app, int32_t uid, int64_t version) {
- VLOG("StatsService::informOnePackage was called");
+ ENFORCE_UID(AID_SYSTEM);
- if (IPCThreadState::self()->getCallingUid() != AID_SYSTEM) {
- return Status::fromExceptionCode(Status::EX_SECURITY,
- "Only system uid can call informOnePackage");
- }
+ VLOG("StatsService::informOnePackage was called");
mUidMap->updateApp(getElapsedRealtimeNs(), app, uid, version);
return Status::ok();
}
Status StatsService::informOnePackageRemoved(const String16& app, int32_t uid) {
- VLOG("StatsService::informOnePackageRemoved was called");
+ ENFORCE_UID(AID_SYSTEM);
- if (IPCThreadState::self()->getCallingUid() != AID_SYSTEM) {
- return Status::fromExceptionCode(Status::EX_SECURITY,
- "Only system uid can call informOnePackageRemoved");
- }
+ VLOG("StatsService::informOnePackageRemoved was called");
mUidMap->removeApp(getElapsedRealtimeNs(), app, uid);
mConfigManager->RemoveConfigs(uid);
return Status::ok();
}
Status StatsService::informAnomalyAlarmFired() {
+ ENFORCE_UID(AID_SYSTEM);
+
VLOG("StatsService::informAnomalyAlarmFired was called");
-
- if (IPCThreadState::self()->getCallingUid() != AID_SYSTEM) {
- return Status::fromExceptionCode(Status::EX_SECURITY,
- "Only system uid can call informAnomalyAlarmFired");
- }
-
int64_t currentTimeSec = getElapsedRealtimeSec();
std::unordered_set<sp<const InternalAlarm>, SpHash<InternalAlarm>> alarmSet =
mAnomalyAlarmMonitor->popSoonerThan(static_cast<uint32_t>(currentTimeSec));
@@ -717,14 +778,9 @@
}
Status StatsService::informAlarmForSubscriberTriggeringFired() {
+ ENFORCE_UID(AID_SYSTEM);
+
VLOG("StatsService::informAlarmForSubscriberTriggeringFired was called");
-
- if (IPCThreadState::self()->getCallingUid() != AID_SYSTEM) {
- return Status::fromExceptionCode(
- Status::EX_SECURITY,
- "Only system uid can call informAlarmForSubscriberTriggeringFired");
- }
-
int64_t currentTimeSec = getElapsedRealtimeSec();
std::unordered_set<sp<const InternalAlarm>, SpHash<InternalAlarm>> alarmSet =
mPeriodicAlarmMonitor->popSoonerThan(static_cast<uint32_t>(currentTimeSec));
@@ -738,44 +794,28 @@
}
Status StatsService::informPollAlarmFired() {
+ ENFORCE_UID(AID_SYSTEM);
+
VLOG("StatsService::informPollAlarmFired was called");
-
- if (IPCThreadState::self()->getCallingUid() != AID_SYSTEM) {
- return Status::fromExceptionCode(Status::EX_SECURITY,
- "Only system uid can call informPollAlarmFired");
- }
-
mProcessor->informPullAlarmFired(getElapsedRealtimeNs());
-
VLOG("StatsService::informPollAlarmFired succeeded");
-
return Status::ok();
}
Status StatsService::systemRunning() {
- if (IPCThreadState::self()->getCallingUid() != AID_SYSTEM) {
- return Status::fromExceptionCode(Status::EX_SECURITY,
- "Only system uid can call systemRunning");
- }
+ ENFORCE_UID(AID_SYSTEM);
// When system_server is up and running, schedule the dropbox task to run.
VLOG("StatsService::systemRunning");
-
sayHiToStatsCompanion();
-
return Status::ok();
}
Status StatsService::writeDataToDisk() {
- if (IPCThreadState::self()->getCallingUid() != AID_SYSTEM) {
- return Status::fromExceptionCode(Status::EX_SECURITY,
- "Only system uid can call systemRunning");
- }
+ ENFORCE_UID(AID_SYSTEM);
VLOG("StatsService::writeDataToDisk");
-
mProcessor->WriteDataToDisk();
-
return Status::ok();
}
@@ -790,13 +830,9 @@
}
Status StatsService::statsCompanionReady() {
+ ENFORCE_UID(AID_SYSTEM);
+
VLOG("StatsService::statsCompanionReady was called");
-
- if (IPCThreadState::self()->getCallingUid() != AID_SYSTEM) {
- return Status::fromExceptionCode(Status::EX_SECURITY,
- "Only system uid can call statsCompanionReady");
- }
-
sp<IStatsCompanionService> statsCompanion = getStatsCompanionService();
if (statsCompanion == nullptr) {
return Status::fromExceptionCode(
@@ -820,33 +856,31 @@
mProcessor->OnLogEvent(event, reconnectionStarts);
}
-Status StatsService::getData(int64_t key, vector<uint8_t>* output) {
+Status StatsService::getData(int64_t key, const String16& packageName, vector<uint8_t>* output) {
+ ENFORCE_DUMP_AND_USAGE_STATS(packageName);
+
IPCThreadState* ipc = IPCThreadState::self();
VLOG("StatsService::getData with Pid %i, Uid %i", ipc->getCallingPid(), ipc->getCallingUid());
- if (!checkCallingPermission(String16(kPermissionDump))) {
- return Status::fromExceptionCode(binder::Status::EX_SECURITY);
- }
ConfigKey configKey(ipc->getCallingUid(), key);
mProcessor->onDumpReport(configKey, getElapsedRealtimeNs(),
false /* include_current_bucket*/, output);
return Status::ok();
}
-Status StatsService::getMetadata(vector<uint8_t>* output) {
+Status StatsService::getMetadata(const String16& packageName, vector<uint8_t>* output) {
+ ENFORCE_DUMP_AND_USAGE_STATS(packageName);
+
IPCThreadState* ipc = IPCThreadState::self();
VLOG("StatsService::getMetadata with Pid %i, Uid %i", ipc->getCallingPid(),
ipc->getCallingUid());
- if (!checkCallingPermission(String16(kPermissionDump))) {
- return Status::fromExceptionCode(binder::Status::EX_SECURITY);
- }
StatsdStats::getInstance().dumpStats(output, false); // Don't reset the counters.
return Status::ok();
}
-Status StatsService::addConfiguration(int64_t key, const vector <uint8_t>& config) {
- if (!checkCallingPermission(String16(kPermissionDump))) {
- return Status::fromExceptionCode(binder::Status::EX_SECURITY);
- }
+Status StatsService::addConfiguration(int64_t key, const vector <uint8_t>& config,
+ const String16& packageName) {
+ ENFORCE_DUMP_AND_USAGE_STATS(packageName);
+
IPCThreadState* ipc = IPCThreadState::self();
if (addConfigurationChecked(ipc->getCallingUid(), key, config)) {
return Status::ok();
@@ -869,30 +903,29 @@
return true;
}
-Status StatsService::removeDataFetchOperation(int64_t key) {
- if (!checkCallingPermission(String16(kPermissionDump))) {
- return Status::fromExceptionCode(binder::Status::EX_SECURITY);
- }
+Status StatsService::removeDataFetchOperation(int64_t key, const String16& packageName) {
+ ENFORCE_DUMP_AND_USAGE_STATS(packageName);
+
IPCThreadState* ipc = IPCThreadState::self();
ConfigKey configKey(ipc->getCallingUid(), key);
mConfigManager->RemoveConfigReceiver(configKey);
return Status::ok();
}
-Status StatsService::setDataFetchOperation(int64_t key, const sp<android::IBinder>& intentSender) {
- if (!checkCallingPermission(String16(kPermissionDump))) {
- return Status::fromExceptionCode(binder::Status::EX_SECURITY);
- }
+Status StatsService::setDataFetchOperation(int64_t key,
+ const sp<android::IBinder>& intentSender,
+ const String16& packageName) {
+ ENFORCE_DUMP_AND_USAGE_STATS(packageName);
+
IPCThreadState* ipc = IPCThreadState::self();
ConfigKey configKey(ipc->getCallingUid(), key);
mConfigManager->SetConfigReceiver(configKey, intentSender);
return Status::ok();
}
-Status StatsService::removeConfiguration(int64_t key) {
- if (!checkCallingPermission(String16(kPermissionDump))) {
- return Status::fromExceptionCode(binder::Status::EX_SECURITY);
- }
+Status StatsService::removeConfiguration(int64_t key, const String16& packageName) {
+ ENFORCE_DUMP_AND_USAGE_STATS(packageName);
+
IPCThreadState* ipc = IPCThreadState::self();
ConfigKey configKey(ipc->getCallingUid(), key);
mConfigManager->RemoveConfig(configKey);
@@ -902,11 +935,11 @@
Status StatsService::setBroadcastSubscriber(int64_t configId,
int64_t subscriberId,
- const sp<android::IBinder>& intentSender) {
+ const sp<android::IBinder>& intentSender,
+ const String16& packageName) {
+ ENFORCE_DUMP_AND_USAGE_STATS(packageName);
+
VLOG("StatsService::setBroadcastSubscriber called.");
- if (!checkCallingPermission(String16(kPermissionDump))) {
- return Status::fromExceptionCode(binder::Status::EX_SECURITY);
- }
IPCThreadState* ipc = IPCThreadState::self();
ConfigKey configKey(ipc->getCallingUid(), configId);
SubscriberReporter::getInstance()
@@ -915,11 +948,11 @@
}
Status StatsService::unsetBroadcastSubscriber(int64_t configId,
- int64_t subscriberId) {
+ int64_t subscriberId,
+ const String16& packageName) {
+ ENFORCE_DUMP_AND_USAGE_STATS(packageName);
+
VLOG("StatsService::unsetBroadcastSubscriber called.");
- if (!checkCallingPermission(String16(kPermissionDump))) {
- return Status::fromExceptionCode(binder::Status::EX_SECURITY);
- }
IPCThreadState* ipc = IPCThreadState::self();
ConfigKey configKey(ipc->getCallingUid(), configId);
SubscriberReporter::getInstance()
@@ -927,7 +960,6 @@
return Status::ok();
}
-
void StatsService::binderDied(const wp <IBinder>& who) {
ALOGW("statscompanion service died");
mProcessor->WriteDataToDisk();
diff --git a/cmds/statsd/src/StatsService.h b/cmds/statsd/src/StatsService.h
index d502796..774a3e9 100644
--- a/cmds/statsd/src/StatsService.h
+++ b/cmds/statsd/src/StatsService.h
@@ -81,36 +81,44 @@
/**
* Binder call for clients to request data for this configuration key.
*/
- virtual Status getData(int64_t key, vector<uint8_t>* output) override;
+ virtual Status getData(int64_t key,
+ const String16& packageName,
+ vector<uint8_t>* output) override;
/**
* Binder call for clients to get metadata across all configs in statsd.
*/
- virtual Status getMetadata(vector<uint8_t>* output) override;
+ virtual Status getMetadata(const String16& packageName,
+ vector<uint8_t>* output) override;
/**
* Binder call to let clients send a configuration and indicate they're interested when they
* should requestData for this configuration.
*/
- virtual Status addConfiguration(int64_t key, const vector<uint8_t>& config) override;
+ virtual Status addConfiguration(int64_t key,
+ const vector<uint8_t>& config,
+ const String16& packageName) override;
/**
* Binder call to let clients register the data fetch operation for a configuration.
*/
virtual Status setDataFetchOperation(int64_t key,
- const sp<android::IBinder>& intentSender) override;
+ const sp<android::IBinder>& intentSender,
+ const String16& packageName) override;
/**
* Binder call to remove the data fetch operation for the specified config key.
*/
- virtual Status removeDataFetchOperation(int64_t key) override;
+ virtual Status removeDataFetchOperation(int64_t key,
+ const String16& packageName) override;
/**
* Binder call to allow clients to remove the specified configuration.
*/
- virtual Status removeConfiguration(int64_t key) override;
+ virtual Status removeConfiguration(int64_t key,
+ const String16& packageName) override;
/**
* Binder call to associate the given config's subscriberId with the given intentSender.
@@ -118,12 +126,15 @@
*/
virtual Status setBroadcastSubscriber(int64_t configId,
int64_t subscriberId,
- const sp<android::IBinder>& intentSender) override;
+ const sp<android::IBinder>& intentSender,
+ const String16& packageName) override;
/**
* Binder call to unassociate the given config's subscriberId with any intentSender.
*/
- virtual Status unsetBroadcastSubscriber(int64_t configId, int64_t subscriberId) override;
+ virtual Status unsetBroadcastSubscriber(int64_t configId,
+ int64_t subscriberId,
+ const String16& packageName) override;
/** Inform statsCompanion that statsd is ready. */
virtual void sayHiToStatsCompanion();
diff --git a/cmds/statsd/tests/e2e/PartialBucket_e2e_test.cpp b/cmds/statsd/tests/e2e/PartialBucket_e2e_test.cpp
index 5499ee3..af07f6b 100644
--- a/cmds/statsd/tests/e2e/PartialBucket_e2e_test.cpp
+++ b/cmds/statsd/tests/e2e/PartialBucket_e2e_test.cpp
@@ -27,6 +27,7 @@
#ifdef __ANDROID__
+const string kAndroid = "android";
const string kApp1 = "app1.sharing.1";
const int kConfigKey = 789130123; // Randomly chosen to avoid collisions with existing configs.
@@ -35,12 +36,12 @@
config.SerializeToString(&str);
std::vector<uint8_t> configAsVec(str.begin(), str.end());
bool success;
- service.addConfiguration(kConfigKey, configAsVec);
+ service.addConfiguration(kConfigKey, configAsVec, String16(kAndroid.c_str()));
}
ConfigMetricsReport GetReports(StatsService& service) {
vector<uint8_t> output;
- service.getData(kConfigKey, &output);
+ service.getData(kConfigKey, String16(kAndroid.c_str()), &output);
ConfigMetricsReportList reports;
reports.ParseFromArray(output.data(), output.size());
EXPECT_EQ(1, reports.reports_size());
@@ -134,4 +135,4 @@
} // namespace statsd
} // namespace os
-} // namespace android
\ No newline at end of file
+} // namespace android