Protect usage data with OP_GET_USAGE_STATS.
APIs that return package usage data (such as the new StatsManager)
must ensure that callers hold both the PACKAGE_USAGE_STATS permission
and the OP_GET_USAGE_STATS app-op.
Add noteOp() method that can be called from native code.
Also add missing security checks on shell commands.
Bug: 77662908
Test: builds, boots
Change-Id: I15efd6f5dde61e807269b5132a052548ea4e800f
diff --git a/libs/binder/IPermissionController.cpp b/libs/binder/IPermissionController.cpp
index ef67ab8..89ebc6c 100644
--- a/libs/binder/IPermissionController.cpp
+++ b/libs/binder/IPermissionController.cpp
@@ -49,6 +49,19 @@
return reply.readInt32() != 0;
}
+ virtual int32_t noteOp(const String16& op, int32_t uid, const String16& packageName)
+ {
+ Parcel data, reply;
+ data.writeInterfaceToken(IPermissionController::getInterfaceDescriptor());
+ data.writeString16(op);
+ data.writeInt32(uid);
+ data.writeString16(packageName);
+ remote()->transact(NOTE_OP_TRANSACTION, data, &reply);
+ // fail on exception
+ if (reply.readExceptionCode() != 0) return 2; // MODE_ERRORED
+ return reply.readInt32();
+ }
+
virtual void getPackagesForUid(const uid_t uid, Vector<String16>& packages)
{
Parcel data, reply;
@@ -111,6 +124,17 @@
return NO_ERROR;
} break;
+ case NOTE_OP_TRANSACTION: {
+ CHECK_INTERFACE(IPermissionController, data, reply);
+ String16 op = data.readString16();
+ int32_t uid = data.readInt32();
+ String16 packageName = data.readString16();
+ int32_t res = noteOp(op, uid, packageName);
+ reply->writeNoException();
+ reply->writeInt32(res);
+ return NO_ERROR;
+ } break;
+
case GET_PACKAGES_FOR_UID_TRANSACTION: {
CHECK_INTERFACE(IPermissionController, data, reply);
int32_t uid = data.readInt32();
diff --git a/libs/binder/PermissionController.cpp b/libs/binder/PermissionController.cpp
index 25748ca..96df33c 100644
--- a/libs/binder/PermissionController.cpp
+++ b/libs/binder/PermissionController.cpp
@@ -59,6 +59,12 @@
return service != NULL ? service->checkPermission(permission, pid, uid) : false;
}
+int32_t PermissionController::noteOp(const String16& op, int32_t uid, const String16& packageName)
+{
+ sp<IPermissionController> service = getService();
+ return service != NULL ? service->noteOp(op, uid, packageName) : MODE_ERRORED;
+}
+
void PermissionController::getPackagesForUid(const uid_t uid, Vector<String16> &packages)
{
sp<IPermissionController> service = getService();
diff --git a/libs/binder/include/binder/IPermissionController.h b/libs/binder/include/binder/IPermissionController.h
index 2f63677..b83d226 100644
--- a/libs/binder/include/binder/IPermissionController.h
+++ b/libs/binder/include/binder/IPermissionController.h
@@ -32,6 +32,8 @@
virtual bool checkPermission(const String16& permission, int32_t pid, int32_t uid) = 0;
+ virtual int32_t noteOp(const String16& op, int32_t uid, const String16& packageName) = 0;
+
virtual void getPackagesForUid(const uid_t uid, Vector<String16> &packages) = 0;
virtual bool isRuntimePermission(const String16& permission) = 0;
@@ -40,9 +42,10 @@
enum {
CHECK_PERMISSION_TRANSACTION = IBinder::FIRST_CALL_TRANSACTION,
- GET_PACKAGES_FOR_UID_TRANSACTION = IBinder::FIRST_CALL_TRANSACTION + 1,
- IS_RUNTIME_PERMISSION_TRANSACTION = IBinder::FIRST_CALL_TRANSACTION + 2,
- GET_PACKAGE_UID_TRANSACTION = IBinder::FIRST_CALL_TRANSACTION + 3
+ NOTE_OP_TRANSACTION = IBinder::FIRST_CALL_TRANSACTION + 1,
+ GET_PACKAGES_FOR_UID_TRANSACTION = IBinder::FIRST_CALL_TRANSACTION + 2,
+ IS_RUNTIME_PERMISSION_TRANSACTION = IBinder::FIRST_CALL_TRANSACTION + 3,
+ GET_PACKAGE_UID_TRANSACTION = IBinder::FIRST_CALL_TRANSACTION + 4
};
};
diff --git a/libs/binder/include/binder/PermissionController.h b/libs/binder/include/binder/PermissionController.h
index c4c98d0..cc5b6fe 100644
--- a/libs/binder/include/binder/PermissionController.h
+++ b/libs/binder/include/binder/PermissionController.h
@@ -35,9 +35,17 @@
MATCH_INSTANT = 1<<23
};
+ enum {
+ MODE_ALLOWED = 0,
+ MODE_IGNORED = 1,
+ MODE_ERRORED = 2,
+ MODE_DEFAULT = 3,
+ };
+
PermissionController();
bool checkPermission(const String16& permission, int32_t pid, int32_t uid);
+ int32_t noteOp(const String16& op, int32_t uid, const String16& packageName);
void getPackagesForUid(const uid_t uid, Vector<String16>& packages);
bool isRuntimePermission(const String16& permission);
int getPackageUid(const String16& package, int flags);