From 623b2b604c4ffcd48f137379d6934537510665bf Mon Sep 17 00:00:00 2001 From: Makoto Onuki Date: Tue, 12 Jun 2018 13:01:42 -0700 Subject: Backport Prevent shortcut info package name spoofing Test: cts-tradefed run cts -m CtsShortcutManagerTestCases -t android.content.pm.cts.shortcutmanager.ShortcutManagerFakingPublisherTest Bug: 109824443 Change-Id: I90443973aaef157d357b98b739572866125b2bbc Merged-In: I78948446a63b428ae750464194558fd44a658493 (cherry picked from commit 9e21579a11219581a0c08ff5dd6ac4dc22e988a4) --- .../com/android/server/pm/ShortcutService.java | 24 ++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/services/core/java/com/android/server/pm/ShortcutService.java b/services/core/java/com/android/server/pm/ShortcutService.java index 599e5a573437..b9c304890420 100644 --- a/services/core/java/com/android/server/pm/ShortcutService.java +++ b/services/core/java/com/android/server/pm/ShortcutService.java @@ -132,6 +132,7 @@ import java.nio.charset.StandardCharsets; import java.util.ArrayList; import java.util.Collections; import java.util.List; +import java.util.Objects; import java.util.concurrent.atomic.AtomicBoolean; import java.util.function.Consumer; import java.util.function.Predicate; @@ -1573,6 +1574,24 @@ public class ShortcutService extends IShortcutService.Stub { "Ephemeral apps can't use ShortcutManager"); } + private void verifyShortcutInfoPackage(String callerPackage, ShortcutInfo si) { + if (si == null) { + return; + } + if (!Objects.equals(callerPackage, si.getPackage())) { + android.util.EventLog.writeEvent(0x534e4554, "109824443", -1, ""); + throw new SecurityException("Shortcut package name mismatch"); + } + } + + private void verifyShortcutInfoPackages( + String callerPackage, List list) { + final int size = list.size(); + for (int i = 0; i < size; i++) { + verifyShortcutInfoPackage(callerPackage, list.get(i)); + } + } + // Overridden in unit tests to execute r synchronously. void injectPostToHandler(Runnable r) { mHandler.post(r); @@ -1720,6 +1739,7 @@ public class ShortcutService extends IShortcutService.Stub { verifyCaller(packageName, userId); final List newShortcuts = (List) shortcutInfoList.getList(); + verifyShortcutInfoPackages(packageName, newShortcuts); final int size = newShortcuts.size(); final boolean unlimited = injectHasUnlimitedShortcutsApiCallsPermission( @@ -1774,6 +1794,7 @@ public class ShortcutService extends IShortcutService.Stub { verifyCaller(packageName, userId); final List newShortcuts = (List) shortcutInfoList.getList(); + verifyShortcutInfoPackages(packageName, newShortcuts); final int size = newShortcuts.size(); final boolean unlimited = injectHasUnlimitedShortcutsApiCallsPermission( @@ -1859,6 +1880,7 @@ public class ShortcutService extends IShortcutService.Stub { verifyCaller(packageName, userId); final List newShortcuts = (List) shortcutInfoList.getList(); + verifyShortcutInfoPackages(packageName, newShortcuts); final int size = newShortcuts.size(); final boolean unlimited = injectHasUnlimitedShortcutsApiCallsPermission( @@ -1921,6 +1943,7 @@ public class ShortcutService extends IShortcutService.Stub { Preconditions.checkNotNull(shortcut); Preconditions.checkArgument(shortcut.isEnabled(), "Shortcut must be enabled"); verifyCaller(packageName, userId); + verifyShortcutInfoPackage(packageName, shortcut); final Intent ret; synchronized (mLock) { @@ -1942,6 +1965,7 @@ public class ShortcutService extends IShortcutService.Stub { private boolean requestPinItem(String packageName, int userId, ShortcutInfo shortcut, AppWidgetProviderInfo appWidget, Bundle extras, IntentSender resultIntent) { verifyCaller(packageName, userId); + verifyShortcutInfoPackage(packageName, shortcut); final boolean ret; synchronized (mLock) { -- cgit v1.2.3 From 2de620f9133d0408c612f6c0f986fff936a8e61c Mon Sep 17 00:00:00 2001 From: Arthur Ishiguro Date: Mon, 25 Jun 2018 11:31:33 -0700 Subject: Resolve inconsistent parcel read in NanoAppFilter Bug: 77599679 Test: Compile only Change-Id: Ib417a5cb4d51744442d2fb14437cabbe5fd1c266 (cherry picked from commit abe5a73a4a81e312a1690fbc10a6b99ce98b699a) --- core/java/android/hardware/location/NanoAppFilter.java | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/core/java/android/hardware/location/NanoAppFilter.java b/core/java/android/hardware/location/NanoAppFilter.java index 4d8e7344cd75..562065e20815 100644 --- a/core/java/android/hardware/location/NanoAppFilter.java +++ b/core/java/android/hardware/location/NanoAppFilter.java @@ -85,7 +85,7 @@ public class NanoAppFilter implements Parcelable { mAppId = in.readLong(); mAppVersion = in.readInt(); mVersionRestrictionMask = in.readInt(); - mAppIdVendorMask = in.readInt(); + mAppIdVendorMask = in.readLong(); } public int describeContents() { @@ -93,7 +93,6 @@ public class NanoAppFilter implements Parcelable { } public void writeToParcel(Parcel out, int flags) { - out.writeLong(mAppId); out.writeInt(mAppVersion); out.writeInt(mVersionRestrictionMask); -- cgit v1.2.3 From cf6784bfbf713aaa54d8da77e9481b3f02784246 Mon Sep 17 00:00:00 2001 From: Bernie Innocenti Date: Mon, 28 May 2018 22:04:37 +0900 Subject: vpn: allow IPSec traffic through Always-on VPN This won't leak any traffic outside the VPN as long as there are no processes owned by uid 0 which generate network traffic (which is currently the case). Bug: 69873852 Test: compared the output of 'adb shell ip rule show' before and after Test: runtest -x frameworks/base/tests/net/java/com/android/server/connectivity/VpnTest.java Test: local CTS tests run: android.net.cts.VpnServiceTest Test: local CTS tests run: com.android.cts.devicepolicy.MixedDeviceOwnerTest Change-Id: I8758e576c9d961d73f62bfcf0559dd7ecee6e8e6 Merged-In: I8758e576c9d961d73f62bfcf0559dd7ecee6e8e6 Merged-In: I1f9b78c8f828ec2df7aba71b39d62be0c4db2550 Merged-In: I8edeb0942e661c8385ff0cd3fdb72e6f62a8f218 (cherry picked from commit 00000fe55a4729f8339afdc7eab5c970b2549813) (cherry picked from commit ae07a6bf53cc9650039c4f2918baf58d522b49f9) --- .../core/java/com/android/server/connectivity/Vpn.java | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/services/core/java/com/android/server/connectivity/Vpn.java b/services/core/java/com/android/server/connectivity/Vpn.java index b77c1443e850..2a80f0e7c291 100644 --- a/services/core/java/com/android/server/connectivity/Vpn.java +++ b/services/core/java/com/android/server/connectivity/Vpn.java @@ -100,8 +100,6 @@ import com.android.server.DeviceIdleController; import com.android.server.LocalServices; import com.android.server.net.BaseNetworkObserver; -import libcore.io.IoUtils; - import java.io.File; import java.io.IOException; import java.io.InputStream; @@ -123,6 +121,8 @@ import java.util.SortedSet; import java.util.TreeSet; import java.util.concurrent.atomic.AtomicInteger; +import libcore.io.IoUtils; + /** * @hide */ @@ -1327,6 +1327,18 @@ public class Vpn { /* allowedApplications */ null, /* disallowedApplications */ exemptedPackages); + // The UID range of the first user (0-99999) would block the IPSec traffic, which comes + // directly from the kernel and is marked as uid=0. So we adjust the range to allow + // it through (b/69873852). + for (UidRange range : addedRanges) { + if (range.start == 0) { + addedRanges.remove(range); + if (range.stop != 0) { + addedRanges.add(new UidRange(1, range.stop)); + } + } + } + removedRanges.removeAll(addedRanges); addedRanges.removeAll(mBlockedUsers); } -- cgit v1.2.3 From 586b9102f322731d604e6280143e16cb6f1c9f76 Mon Sep 17 00:00:00 2001 From: Robert Shih Date: Mon, 9 Jul 2018 13:38:31 -0700 Subject: Fix TrackInfo parcel write Bug: 77600398 Change-Id: Ia316f1c5dc4879f6851fdb78fe8b9039579be7bc (cherry picked from commit 0d2dc943dcaa3d7c8479e22ae62be9753ea2643c) --- media/java/android/media/MediaPlayer.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/media/java/android/media/MediaPlayer.java b/media/java/android/media/MediaPlayer.java index ada91be9ca4d..d532e526f2fb 100644 --- a/media/java/android/media/MediaPlayer.java +++ b/media/java/android/media/MediaPlayer.java @@ -2510,10 +2510,10 @@ public class MediaPlayer extends PlayerBase @Override public void writeToParcel(Parcel dest, int flags) { dest.writeInt(mTrackType); + dest.writeString(mFormat.getString(MediaFormat.KEY_MIME)); dest.writeString(getLanguage()); if (mTrackType == MEDIA_TRACK_TYPE_SUBTITLE) { - dest.writeString(mFormat.getString(MediaFormat.KEY_MIME)); dest.writeInt(mFormat.getInteger(MediaFormat.KEY_IS_AUTOSELECT)); dest.writeInt(mFormat.getInteger(MediaFormat.KEY_IS_DEFAULT)); dest.writeInt(mFormat.getInteger(MediaFormat.KEY_IS_FORCED_SUBTITLE)); -- cgit v1.2.3