From 516b41eee1abfc1b4bed00479443a6ef1b29a94c Mon Sep 17 00:00:00 2001 From: Ivan Chiang Date: Mon, 18 Mar 2024 02:46:56 +0000 Subject: [PM] Send ACTION_PACKAGE_CHANGED when mimeGroups are changed Test: atest CtsPackageManagerTestCases:PackageManagerShellCommandMultiUserTest Test: atest CtsPackageManagerTestCases:PackageManagerTest Bug: 297517712 (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:81eb9f8294645684ce1fad39d5d4a00ef11736e4) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c160424ef22bffd25a9cc9bc7b901ae1b9721a72) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:4217415dbe8e83ba4c8bf56ac6ff21523187f59f) Merged-In: I271a3526ea4555249e3a2797605269257330e0e9 Change-Id: I271a3526ea4555249e3a2797605269257330e0e9 --- .../android/server/pm/PackageManagerService.java | 23 +++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index f2b62eaf25f8..cac96e544432 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -6160,9 +6160,26 @@ public class PackageManagerService implements PackageSender, TestUtilityService packageStateWrite.setMimeGroup(mimeGroup, mimeTypesSet); }); if (mComponentResolver.updateMimeGroup(snapshotComputer(), packageName, mimeGroup)) { - Binder.withCleanCallingIdentity(() -> - mPreferredActivityHelper.clearPackagePreferredActivities(packageName, - UserHandle.USER_ALL)); + Binder.withCleanCallingIdentity(() -> { + mPreferredActivityHelper.clearPackagePreferredActivities(packageName, + UserHandle.USER_ALL); + // Send the ACTION_PACKAGE_CHANGED when the mimeGroup has changes + final Computer snapShot = snapshotComputer(); + final ArrayList components = new ArrayList<>( + Collections.singletonList(packageName)); + final int appId = packageState.getAppId(); + final int[] userIds = resolveUserIds(UserHandle.USER_ALL); + final String reason = "The mimeGroup is changed"; + for (int i = 0; i < userIds.length; i++) { + final PackageUserStateInternal pkgUserState = + packageState.getUserStates().get(userIds[i]); + if (pkgUserState != null && pkgUserState.isInstalled()) { + final int packageUid = UserHandle.getUid(userIds[i], appId); + sendPackageChangedBroadcast(snapShot, packageName, + true /* dontKillApp */, components, packageUid, reason); + } + } + }); } scheduleWriteSettings(); -- cgit v1.2.3 From 23265610e3906b160736a49b10bd389485fdb80c Mon Sep 17 00:00:00 2001 From: Bishoy Gendy Date: Thu, 11 Apr 2024 16:37:10 +0000 Subject: Fix security vulnerability allowing apps to start from background Bug: 317048338 Test: Using the steps in b/317048338#comment12 (cherry picked from commit c5fc8ea92c0aabbb2fdccc23b743c18a8bf62e64) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:df3584bb93ab89d7e174f7d39e42d4b22cb92fe0) Merged-In: Ia91199fdb23beed27bde687fdca8fe5d3a5a4759 Change-Id: Ia91199fdb23beed27bde687fdca8fe5d3a5a4759 --- media/java/android/media/session/ParcelableListBinder.java | 13 +++++++++++-- .../java/com/android/server/media/MediaSessionRecord.java | 14 ++++++++------ 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/media/java/android/media/session/ParcelableListBinder.java b/media/java/android/media/session/ParcelableListBinder.java index bbf1e0889b68..d78828462b1e 100644 --- a/media/java/android/media/session/ParcelableListBinder.java +++ b/media/java/android/media/session/ParcelableListBinder.java @@ -45,6 +45,7 @@ public class ParcelableListBinder extends Binder { private static final int END_OF_PARCEL = 0; private static final int ITEM_CONTINUED = 1; + private final Class mListElementsClass; private final Consumer> mConsumer; private final Object mLock = new Object(); @@ -61,9 +62,11 @@ public class ParcelableListBinder extends Binder { /** * Creates an instance. * + * @param listElementsClass the class of the list elements. * @param consumer a consumer that consumes the list received */ - public ParcelableListBinder(@NonNull Consumer> consumer) { + public ParcelableListBinder(Class listElementsClass, @NonNull Consumer> consumer) { + mListElementsClass = listElementsClass; mConsumer = consumer; } @@ -83,7 +86,13 @@ public class ParcelableListBinder extends Binder { mCount = data.readInt(); } while (i < mCount && data.readInt() != END_OF_PARCEL) { - mList.add(data.readParcelable(null)); + Object object = data.readParcelable(null); + if (mListElementsClass.isAssignableFrom(object.getClass())) { + // Checking list items are of compaitible types to validate against malicious + // apps calling it directly via reflection with non compilable items. + // See b/317048338 for more details + mList.add((T) object); + } i++; } if (i >= mCount) { diff --git a/services/core/java/com/android/server/media/MediaSessionRecord.java b/services/core/java/com/android/server/media/MediaSessionRecord.java index 4084462d3f28..4ff83b296a2a 100644 --- a/services/core/java/com/android/server/media/MediaSessionRecord.java +++ b/services/core/java/com/android/server/media/MediaSessionRecord.java @@ -1197,12 +1197,14 @@ public class MediaSessionRecord implements IBinder.DeathRecipient, MediaSessionR @Override public IBinder getBinderForSetQueue() throws RemoteException { - return new ParcelableListBinder((list) -> { - synchronized (mLock) { - mQueue = list; - } - mHandler.post(MessageHandler.MSG_UPDATE_QUEUE); - }); + return new ParcelableListBinder( + QueueItem.class, + (list) -> { + synchronized (mLock) { + mQueue = list; + } + mHandler.post(MessageHandler.MSG_UPDATE_QUEUE); + }); } @Override -- cgit v1.2.3 From 6fa8602a120947e6b1713345b4fb6251dc9bcbfd Mon Sep 17 00:00:00 2001 From: Martijn Coenen Date: Thu, 29 Feb 2024 12:03:05 +0000 Subject: Verify UID of incoming Zygote connections. Only the system UID should be allowed to connect to the Zygote. While for generic Zygotes this is also covered by SELinux policy, this is not true for App Zygotes: the preload code running in an app zygote could connect to another app zygote socket, if it had access to its (random) socket address. On the Java layer, simply check the UID when the connection is made. In the native layer, this check was already present, but it actually didn't work in the case where we receive a new incoming connection on the socket, and receive a 'non-fork' command: in that case, we will simply exit the native loop, and let the Java layer handle the command, without any further UID checking. Modified the native logic to drop new connections with a mismatching UID, and to keep serving the existing connection (if it was still there). Bug: 319081336 Test: manual (cherry picked from commit 2ffc7cb220e4220b7e108c4043a3f0f2a85b6508) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:e4b3ba817073b66ee37da8f1aba93b345309b435) Merged-In: I3f85a17107849e2cd3e82d6ef15c90b9e2f26532 Change-Id: I3f85a17107849e2cd3e82d6ef15c90b9e2f26532 --- .../com/android/internal/os/ZygoteConnection.java | 3 + ...com_android_internal_os_ZygoteCommandBuffer.cpp | 82 ++++++++++++++-------- 2 files changed, 56 insertions(+), 29 deletions(-) diff --git a/core/java/com/android/internal/os/ZygoteConnection.java b/core/java/com/android/internal/os/ZygoteConnection.java index 993e4e7b4b3d..765901a043a0 100644 --- a/core/java/com/android/internal/os/ZygoteConnection.java +++ b/core/java/com/android/internal/os/ZygoteConnection.java @@ -93,6 +93,9 @@ class ZygoteConnection { throw ex; } + if (peer.getUid() != Process.SYSTEM_UID) { + throw new ZygoteSecurityException("Only system UID is allowed to connect to Zygote."); + } isEof = false; } diff --git a/core/jni/com_android_internal_os_ZygoteCommandBuffer.cpp b/core/jni/com_android_internal_os_ZygoteCommandBuffer.cpp index 2b5b8f7a108e..b586b9c27dd8 100644 --- a/core/jni/com_android_internal_os_ZygoteCommandBuffer.cpp +++ b/core/jni/com_android_internal_os_ZygoteCommandBuffer.cpp @@ -353,6 +353,18 @@ jstring com_android_internal_os_ZygoteCommandBuffer_nativeNextArg(JNIEnv* env, j return result; } +static uid_t getSocketPeerUid(int socket, const std::function& fail_fn) { + struct ucred credentials; + socklen_t cred_size = sizeof credentials; + if (getsockopt(socket, SOL_SOCKET, SO_PEERCRED, &credentials, &cred_size) == -1 + || cred_size != sizeof credentials) { + fail_fn(CREATE_ERROR("Failed to get socket credentials, %s", + strerror(errno))); + } + + return credentials.uid; +} + // Read all lines from the current command into the buffer, and then reset the buffer, so // we will start reading again at the beginning of the command, starting with the argument // count. And we don't need access to the fd to do so. @@ -412,19 +424,12 @@ jboolean com_android_internal_os_ZygoteCommandBuffer_nativeForkRepeatedly( fail_fn_z("Failed to retrieve session socket timeout"); } - struct ucred credentials; - socklen_t cred_size = sizeof credentials; - if (getsockopt(n_buffer->getFd(), SOL_SOCKET, SO_PEERCRED, &credentials, &cred_size) == -1 - || cred_size != sizeof credentials) { - fail_fn_1(CREATE_ERROR("ForkRepeatedly failed to get initial credentials, %s", - strerror(errno))); + uid_t peerUid = getSocketPeerUid(session_socket, fail_fn_1); + if (peerUid != static_cast(expected_uid)) { + return JNI_FALSE; } - bool first_time = true; do { - if (credentials.uid != expected_uid) { - return JNI_FALSE; - } n_buffer->readAllLines(first_time ? fail_fn_1 : fail_fn_n); n_buffer->reset(); int pid = zygote::forkApp(env, /* no pipe FDs */ -1, -1, session_socket_fds, @@ -454,30 +459,56 @@ jboolean com_android_internal_os_ZygoteCommandBuffer_nativeForkRepeatedly( // Clear buffer and get count from next command. n_buffer->clear(); for (;;) { + bool valid_session_socket = true; // Poll isn't strictly necessary for now. But without it, disconnect is hard to detect. int poll_res = TEMP_FAILURE_RETRY(poll(fd_structs, 2, -1 /* infinite timeout */)); if ((fd_structs[SESSION_IDX].revents & POLLIN) != 0) { if (n_buffer->getCount(fail_fn_z) != 0) { break; - } // else disconnected; + } else { + // Session socket was disconnected + valid_session_socket = false; + close(session_socket); + } } else if (poll_res == 0 || (fd_structs[ZYGOTE_IDX].revents & POLLIN) == 0) { fail_fn_z( CREATE_ERROR("Poll returned with no descriptors ready! Poll returned %d", poll_res)); } - // We've now seen either a disconnect or connect request. - close(session_socket); - int new_fd = TEMP_FAILURE_RETRY(accept(zygote_socket_fd, nullptr, nullptr)); + int new_fd = -1; + do { + // We've now seen either a disconnect or connect request. + new_fd = TEMP_FAILURE_RETRY(accept(zygote_socket_fd, nullptr, nullptr)); + if (new_fd == -1) { + fail_fn_z(CREATE_ERROR("Accept(%d) failed: %s", zygote_socket_fd, strerror(errno))); + } + uid_t newPeerUid = getSocketPeerUid(new_fd, fail_fn_1); + if (newPeerUid != static_cast(expected_uid)) { + ALOGW("Dropping new connection with a mismatched uid %d\n", newPeerUid); + close(new_fd); + new_fd = -1; + } else { + // If we still have a valid session socket, close it now + if (valid_session_socket) { + close(session_socket); + } + valid_session_socket = true; + } + } while (!valid_session_socket); + + // At this point we either have a valid new connection (new_fd > 0), or + // an existing session socket we can poll on if (new_fd == -1) { - fail_fn_z(CREATE_ERROR("Accept(%d) failed: %s", zygote_socket_fd, strerror(errno))); + // The new connection wasn't valid, and we still have an old one; retry polling + continue; } if (new_fd != session_socket) { - // Move new_fd back to the old value, so that we don't have to change Java-level data - // structures to reflect a change. This implicitly closes the old one. - if (TEMP_FAILURE_RETRY(dup2(new_fd, session_socket)) != session_socket) { - fail_fn_z(CREATE_ERROR("Failed to move fd %d to %d: %s", - new_fd, session_socket, strerror(errno))); - } - close(new_fd); // On Linux, fd is closed even if EINTR is returned. + // Move new_fd back to the old value, so that we don't have to change Java-level data + // structures to reflect a change. This implicitly closes the old one. + if (TEMP_FAILURE_RETRY(dup2(new_fd, session_socket)) != session_socket) { + fail_fn_z(CREATE_ERROR("Failed to move fd %d to %d: %s", + new_fd, session_socket, strerror(errno))); + } + close(new_fd); // On Linux, fd is closed even if EINTR is returned. } // If we ever return, we effectively reuse the old Java ZygoteConnection. // None of its state needs to change. @@ -489,13 +520,6 @@ jboolean com_android_internal_os_ZygoteCommandBuffer_nativeForkRepeatedly( fail_fn_z(CREATE_ERROR("Failed to set send timeout for socket %d: %s", session_socket, strerror(errno))); } - if (getsockopt(session_socket, SOL_SOCKET, SO_PEERCRED, &credentials, &cred_size) == -1) { - fail_fn_z(CREATE_ERROR("ForkMany failed to get credentials: %s", strerror(errno))); - } - if (cred_size != sizeof credentials) { - fail_fn_z(CREATE_ERROR("ForkMany credential size = %d, should be %d", - cred_size, static_cast(sizeof credentials))); - } } first_time = false; } while (n_buffer->isSimpleForkCommand(minUid, fail_fn_n)); -- cgit v1.2.3