diff options
| author | Chenbo Feng <fengc@google.com> | 2019-06-17 16:22:28 -0700 |
|---|---|---|
| committer | junyulai <junyulai@google.com> | 2020-04-27 18:38:56 +0800 |
| commit | 78cd384e864f47bbb4dac8342beab937bb863735 (patch) | |
| tree | daaf1ef1ed9b9b05f7c9a14a72f6e448e6910475 /tools/aapt2/java/JavaClassGenerator.cpp | |
| parent | cde07e5dc539f56ee14c08d213c4c0cd8ea93005 (diff) | |
Enforce permission check in getUidStats function
The NetworkStatsService.getUidStats() currently doesn't have any
permission check to make sure unpriviledged apps cannot read the stats
of a different uid. It will protentially have security problem since
apps with ACCESS_NETWORK_STATS permission can directly calling into
NetworkStatsService and bypass the check in TrafficStats. Move the uid
check from TrafficStats to NetworkStatsService to fix the problem.
Bug: 129151407
Test: atest AppSecurityTests#testAppFailAccessPrivateData_full
Test: atest AppSecurityTests#testAppFailAccessPrivateData_instant
Test: atest android.app.usage.cts.NetworkUsageStatsTest
Test: atest NetworkStatsBinderTest
Change-Id: Iae85676cfe5f114da69ec278afc2c904bc907234
Diffstat (limited to 'tools/aapt2/java/JavaClassGenerator.cpp')
0 files changed, 0 insertions, 0 deletions