Add `ALLOWLISTED_WRITE_DEVICE_CONFIG` permission.
Also grant this permission to the shell. Eventually, we'll revoke
`WRITE_DEVICE_CONFIG` from the shell.
Bug: 251818659
Test: m
Change-Id: I4dfb66b3b78eefa29ade9ea579180466b9be1b25
diff --git a/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java b/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
index 27c8cdf..7f60788c 100644
--- a/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
+++ b/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
@@ -1173,7 +1173,7 @@
Slog.v(LOG_TAG, "setAllConfigSettings for prefix: " + prefix);
}
- enforceWritePermission(Manifest.permission.WRITE_DEVICE_CONFIG);
+ enforceDeviceConfigWritePermission(getContext(), keyValues.keySet());
final String callingPackage = resolveCallingPackage();
synchronized (mLock) {
@@ -1192,7 +1192,8 @@
Slog.v(LOG_TAG, "setSyncDisabledModeConfig(" + syncDisabledMode + ")");
}
- enforceWritePermission(Manifest.permission.WRITE_DEVICE_CONFIG);
+ enforceHasAtLeastOnePermission(Manifest.permission.WRITE_DEVICE_CONFIG,
+ Manifest.permission.READ_WRITE_SYNC_DISABLED_MODE_CONFIG);
synchronized (mLock) {
setSyncDisabledModeConfigLocked(syncDisabledMode);
@@ -1204,7 +1205,8 @@
Slog.v(LOG_TAG, "getSyncDisabledModeConfig");
}
- enforceWritePermission(Manifest.permission.WRITE_DEVICE_CONFIG);
+ enforceHasAtLeastOnePermission(Manifest.permission.WRITE_DEVICE_CONFIG,
+ Manifest.permission.READ_WRITE_SYNC_DISABLED_MODE_CONFIG);
synchronized (mLock) {
return getSyncDisabledModeConfigLocked();
@@ -1289,13 +1291,13 @@
private boolean mutateConfigSetting(String name, String value, String prefix,
boolean makeDefault, int operation, int mode) {
- enforceWritePermission(Manifest.permission.WRITE_DEVICE_CONFIG);
final String callingPackage = resolveCallingPackage();
// Perform the mutation.
synchronized (mLock) {
switch (operation) {
case MUTATION_OPERATION_INSERT: {
+ enforceDeviceConfigWritePermission(getContext(), Collections.singleton(name));
return mSettingsRegistry.insertSettingLocked(SETTINGS_TYPE_CONFIG,
UserHandle.USER_SYSTEM, name, value, null, makeDefault, true,
callingPackage, false, null,
@@ -1303,11 +1305,14 @@
}
case MUTATION_OPERATION_DELETE: {
+ enforceDeviceConfigWritePermission(getContext(), Collections.singleton(name));
return mSettingsRegistry.deleteSettingLocked(SETTINGS_TYPE_CONFIG,
UserHandle.USER_SYSTEM, name, false, null);
}
case MUTATION_OPERATION_RESET: {
+ enforceDeviceConfigWritePermission(getContext(),
+ getAllConfigFlags(prefix).keySet());
mSettingsRegistry.resetSettingsLocked(SETTINGS_TYPE_CONFIG,
UserHandle.USER_SYSTEM, callingPackage, mode, null, prefix);
} return true;
@@ -1464,7 +1469,7 @@
boolean makeDefault, int requestingUserId, int operation, boolean forceNotify,
int mode, boolean overrideableByRestore) {
// Make sure the caller can change the settings - treated as secure.
- enforceWritePermission(Manifest.permission.WRITE_SECURE_SETTINGS);
+ enforceHasAtLeastOnePermission(Manifest.permission.WRITE_SECURE_SETTINGS);
// Resolve the userId on whose behalf the call is made.
final int callingUserId = resolveCallingUserIdEnforcingPermissionsLocked(requestingUserId);
@@ -1752,7 +1757,7 @@
boolean makeDefault, int requestingUserId, int operation, boolean forceNotify,
int mode, boolean overrideableByRestore) {
// Make sure the caller can change the settings.
- enforceWritePermission(Manifest.permission.WRITE_SECURE_SETTINGS);
+ enforceHasAtLeastOnePermission(Manifest.permission.WRITE_SECURE_SETTINGS);
// Resolve the userId on whose behalf the call is made.
final int callingUserId = resolveCallingUserIdEnforcingPermissionsLocked(requestingUserId);
@@ -2277,11 +2282,57 @@
}
}
- private void enforceWritePermission(String permission) {
- if (getContext().checkCallingOrSelfPermission(permission)
- != PackageManager.PERMISSION_GRANTED) {
- throw new SecurityException("Permission denial: writing to settings requires:"
- + permission);
+ private void enforceHasAtLeastOnePermission(String ...permissions) {
+ for (String permission : permissions) {
+ if (getContext().checkCallingOrSelfPermission(permission)
+ == PackageManager.PERMISSION_GRANTED) {
+ return;
+ }
+ }
+ throw new SecurityException("Permission denial, must have one of: "
+ + Arrays.toString(permissions));
+ }
+
+ /**
+ * Throws an exception if write permissions are not granted for {@code flags}.
+ * <p>
+ * Write permissions are granted if the calling UID is root, or the
+ * WRITE_DEVICE_CONFIG permission is granted, or the WRITE_DEVICE_CONFIG_ALLOWLIST
+ * permission is granted and each flag in {@code flags} is allowlisted in {@code
+ * WRITABLE_FLAG_ALLOWLIST_FLAG}.
+ *
+ * @param context the {@link Context} this is called in
+ * @param flags a list of flags to check, each one of the form 'namespace/flagName'
+ *
+ * @throws SecurityException if the above criteria are not met.
+ * @hide
+ */
+ private void enforceDeviceConfigWritePermission(
+ @NonNull Context context,
+ @NonNull Set<String> flags) {
+ boolean hasAllowlistPermission =
+ context.checkCallingOrSelfPermission(
+ Manifest.permission.ALLOWLISTED_WRITE_DEVICE_CONFIG)
+ == PackageManager.PERMISSION_GRANTED;
+ boolean hasWritePermission =
+ context.checkCallingOrSelfPermission(
+ Manifest.permission.WRITE_DEVICE_CONFIG)
+ == PackageManager.PERMISSION_GRANTED;
+ boolean isRoot = Binder.getCallingUid() == Process.ROOT_UID;
+
+ if (isRoot || hasWritePermission) {
+ return;
+ } else if (hasAllowlistPermission) {
+ for (String flag : flags) {
+ if (!DeviceConfig.getAdbWritableFlags().contains(flag)) {
+ throw new SecurityException("Permission denial for flag '"
+ + flag
+ + "'; allowlist permission granted, but must add flag to the allowlist.");
+ }
+ }
+ } else {
+ throw new SecurityException("Permission denial to mutate flag, must have root, "
+ + "WRITE_DEVICE_CONFIG, or ALLOWLISTED_WRITE_DEVICE_CONFIG");
}
}
diff --git a/packages/Shell/AndroidManifest.xml b/packages/Shell/AndroidManifest.xml
index d02e569..8cbf5f8 100644
--- a/packages/Shell/AndroidManifest.xml
+++ b/packages/Shell/AndroidManifest.xml
@@ -148,6 +148,8 @@
<uses-permission android:name="android.permission.LOCATION_BYPASS" />
<uses-permission android:name="android.permission.READ_DEVICE_CONFIG" />
<uses-permission android:name="android.permission.WRITE_DEVICE_CONFIG" />
+ <uses-permission android:name="android.permission.ALLOWLISTED_WRITE_DEVICE_CONFIG" />
+ <uses-permission android:name="android.permission.READ_WRITE_SYNC_DISABLED_MODE_CONFIG" />
<uses-permission android:name="android.permission.MONITOR_DEVICE_CONFIG_ACCESS" />
<uses-permission android:name="android.permission.BROADCAST_STICKY" />
<uses-permission android:name="android.permission.MANAGE_ACCESSIBILITY" />