tequilaOS/platform_system_vold
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Additional operation check when enabling read logs.

Browse source 
Vold now does not check caller's permission, but only accepts
transactions from system_server. And it's up to system server to do the
right thing and check permissions/appops.

Bug: b/152633648
Test: atest PackageManagerShellCommandTest PackageManagerShellCommandIncrementalTest
Test: adb shell appops set 1000 GET_USAGE_STATS deny
Change-Id: Id56c1673b135b72b3ec86e572aa4bcca3afc19ab
This commit is contained in:
Alex Buynytskyy 2020-04-02 15:21:47 -07:00
parent 75973cb0dd
commit 605a44fe93
2 changed files with 5 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
VoldNativeService.cpp
View file

@ -53,7 +53,6 @@ namespace vold {
namespace {
constexpr const char* kDump = "android.permission.DUMP";
constexpr const char* kDataUsageStats = "android.permission.LOADER_USAGE_STATS";
static binder::Status error(const std::string& msg) {
PLOG(ERROR) << msg;
@ -920,11 +919,9 @@ binder::Status VoldNativeService::unmountIncFs(const std::string& dir) {
binder::Status VoldNativeService::setIncFsMountOptions(
const ::android::os::incremental::IncrementalFileSystemControlParcel& control,
bool enableReadLogs) {
auto status = CheckPermission(kDataUsageStats);
if (!status.isOk()) {
return status;
}
ENFORCE_SYSTEM_OR_ROOT;
auto status = Ok();
auto incfsControl = IncFs_CreateControl(dup(control.cmd.get()), dup(control.pendingReads.get()),
dup(control.log.get()));
if (auto error = IncFs_SetOptions(

7
VoldNativeServiceValidation.cpp
View file

@ -39,11 +39,10 @@ binder::Status Exception(uint32_t code, const std::string& msg) {
}
binder::Status CheckPermission(const char* permission) {
pid_t pid;
uid_t uid;
int32_t pid;
int32_t uid;
if (checkCallingPermission(String16(permission), reinterpret_cast<int32_t*>(&pid),
reinterpret_cast<int32_t*>(&uid))) {
if (checkCallingPermission(String16(permission), &pid, &uid)) {
return Ok();
} else {
return Exception(binder::Status::EX_SECURITY,