WifiManagerTest: Test for new privileged permission
Add a new test to ensure that the NETWORK_MANAGED_PROVISIONING is only
granted to the correct app.
Bug: 115980767
Test: atest WifiManagerTest
Change-Id: Ifca1fcd81e201134bbb4173c3f142cca91ed49f9
diff --git a/tests/cts/net/src/android/net/wifi/cts/WifiManagerTest.java b/tests/cts/net/src/android/net/wifi/cts/WifiManagerTest.java
index b09d458..40e25ad 100644
--- a/tests/cts/net/src/android/net/wifi/cts/WifiManagerTest.java
+++ b/tests/cts/net/src/android/net/wifi/cts/WifiManagerTest.java
@@ -99,6 +99,8 @@
private static final int WIFI_SCAN_TEST_ITERATIONS = 5;
private static final String TEST_PAC_URL = "http://www.example.com/proxy.pac";
+ private static final String MANAGED_PROVISIONING_PACKAGE_NAME
+ = "com.android.managedprovisioning";
private IntentFilter mIntentFilter;
private final BroadcastReceiver mReceiver = new BroadcastReceiver() {
@@ -1088,6 +1090,41 @@
}
}
+ /**
+ * Verify that the {@link android.Manifest.permission#NETWORK_MANAGED_PROVISIONING} permission
+ * is only held by the device managed provisioning application.
+ * <p>
+ * Only the ManagedProvisioning app should <em>ever</em> attempt to acquire this
+ * permission, since it would give those apps extremely broad access to connectivity
+ * functionality. The permission is intended to be granted to only the device managed
+ * provisioning.
+ */
+ public void testNetworkManagedProvisioningPermission() {
+ final PackageManager pm = getContext().getPackageManager();
+
+ // TODO(b/115980767): Using hardcoded package name. Need a better mechanism to find the
+ // managed provisioning app.
+ // Ensure that the package exists.
+ final Intent intent = new Intent(Intent.ACTION_MAIN);
+ intent.setPackage(MANAGED_PROVISIONING_PACKAGE_NAME);
+ final ResolveInfo ri = pm.resolveActivity(intent, PackageManager.MATCH_DISABLED_COMPONENTS);
+ String validPkg = "";
+ if (ri != null) {
+ validPkg = ri.activityInfo.packageName;
+ }
+
+ final List<PackageInfo> holding = pm.getPackagesHoldingPermissions(new String[] {
+ android.Manifest.permission.NETWORK_MANAGED_PROVISIONING
+ }, PackageManager.MATCH_UNINSTALLED_PACKAGES);
+ for (PackageInfo pi : holding) {
+ if (!Objects.equals(pi.packageName, validPkg)) {
+ fail("The NETWORK_MANAGED_PROVISIONING permission must not be held by "
+ + pi.packageName + " and must be revoked for security reasons ["
+ + validPkg +"]");
+ }
+ }
+ }
+
private void turnScreenOnNoDelay() throws Exception {
mUiDevice.executeShellCommand("input keyevent KEYCODE_WAKEUP");
mUiDevice.executeShellCommand("wm dismiss-keyguard");