|
| 1 | +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Valentin Iftime < [email protected]> |
| 3 | +Date: Thu, 1 Feb 2024 13:58:49 +0100 |
| 4 | +Subject: [PATCH] Verify URI permission for channel sound update from |
| 5 | + NotificationListenerService |
| 6 | + |
| 7 | + Check that a privileged NotificationListenerService (CDM) has the permission to access the sound URI |
| 8 | + when updating a notification channel. |
| 9 | + |
| 10 | +Test: atest com.android.server.notification.NotificationManagerServiceTest#testUpdateNotificationChannelFromPrivilegedListener_noSoundUriPermission |
| 11 | +Bug: 317357401 |
| 12 | +(cherry picked from commit 9b7bbbf5ad542ecf9ecbf8cd819b468791b443c0) |
| 13 | +(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:f090c0538a27d8658d8a860046d5c5e931302341) |
| 14 | +Merged-In: Ic7d2e96e43565e98d2aa29b8f2ba35c142387ba9 |
| 15 | +Change-Id: Ic7d2e96e43565e98d2aa29b8f2ba35c142387ba9 |
| 16 | +--- |
| 17 | + .../NotificationManagerService.java | 21 ++++++ |
| 18 | + .../NotificationManagerServiceTest.java | 67 +++++++++++++++++++ |
| 19 | + 2 files changed, 88 insertions(+) |
| 20 | + |
| 21 | +diff --git a/services/core/java/com/android/server/notification/NotificationManagerService.java b/services/core/java/com/android/server/notification/NotificationManagerService.java |
| 22 | +index 7b1c0ac27ab3..ca957e4d16e3 100755 |
| 23 | +--- a/services/core/java/com/android/server/notification/NotificationManagerService.java |
| 24 | ++++ b/services/core/java/com/android/server/notification/NotificationManagerService.java |
| 25 | +@@ -4333,6 +4333,9 @@ public class NotificationManagerService extends SystemService { |
| 26 | + Preconditions.checkNotNull(user); |
| 27 | + |
| 28 | + verifyPrivilegedListener(token, user, false); |
| 29 | ++ final NotificationChannel originalChannel = mPreferencesHelper.getNotificationChannel( |
| 30 | ++ pkg, getUidForPackageAndUser(pkg, user), channel.getId(), true); |
| 31 | ++ verifyPrivilegedListenerUriPermission(Binder.getCallingUid(), channel, originalChannel); |
| 32 | + updateNotificationChannelInt(pkg, getUidForPackageAndUser(pkg, user), channel, true); |
| 33 | + } |
| 34 | + |
| 35 | +@@ -4412,6 +4415,24 @@ public class NotificationManagerService extends SystemService { |
| 36 | + } |
| 37 | + } |
| 38 | + |
| 39 | ++ private void verifyPrivilegedListenerUriPermission(int sourceUid, |
| 40 | ++ @NonNull NotificationChannel updateChannel, |
| 41 | ++ @Nullable NotificationChannel originalChannel) { |
| 42 | ++ // Check that the NLS has the required permissions to access the channel |
| 43 | ++ final Uri soundUri = updateChannel.getSound(); |
| 44 | ++ final Uri originalSoundUri = |
| 45 | ++ (originalChannel != null) ? originalChannel.getSound() : null; |
| 46 | ++ if (soundUri != null && !Objects.equals(originalSoundUri, soundUri)) { |
| 47 | ++ Binder.withCleanCallingIdentity(() -> { |
| 48 | ++ mUgmInternal.checkGrantUriPermission(sourceUid, null, |
| 49 | ++ ContentProvider.getUriWithoutUserId(soundUri), |
| 50 | ++ Intent.FLAG_GRANT_READ_URI_PERMISSION, |
| 51 | ++ ContentProvider.getUserIdFromUri(soundUri, |
| 52 | ++ UserHandle.getUserId(sourceUid))); |
| 53 | ++ }); |
| 54 | ++ } |
| 55 | ++ } |
| 56 | ++ |
| 57 | + private int getUidForPackageAndUser(String pkg, UserHandle user) throws RemoteException { |
| 58 | + int uid = 0; |
| 59 | + long identity = Binder.clearCallingIdentity(); |
| 60 | +diff --git a/services/tests/uiservicestests/src/com/android/server/notification/NotificationManagerServiceTest.java b/services/tests/uiservicestests/src/com/android/server/notification/NotificationManagerServiceTest.java |
| 61 | +index 0e8cea43063b..403772d0f875 100755 |
| 62 | +--- a/services/tests/uiservicestests/src/com/android/server/notification/NotificationManagerServiceTest.java |
| 63 | ++++ b/services/tests/uiservicestests/src/com/android/server/notification/NotificationManagerServiceTest.java |
| 64 | +@@ -2037,6 +2037,73 @@ public class NotificationManagerServiceTest extends UiServiceTestCase { |
| 65 | + eq(NotificationListenerService.NOTIFICATION_CHANNEL_OR_GROUP_UPDATED)); |
| 66 | + } |
| 67 | + |
| 68 | ++ @Test |
| 69 | ++ public void testUpdateNotificationChannelFromPrivilegedListener_noSoundUriPermission() |
| 70 | ++ throws Exception { |
| 71 | ++ mService.setPreferencesHelper(mPreferencesHelper); |
| 72 | ++ List<String> associations = new ArrayList<>(); |
| 73 | ++ associations.add("a"); |
| 74 | ++ when(mCompanionMgr.getAssociations(PKG, UserHandle.getUserId(mUid))) |
| 75 | ++ .thenReturn(associations); |
| 76 | ++ when(mPreferencesHelper.getNotificationChannel(eq(PKG), anyInt(), |
| 77 | ++ eq(mTestNotificationChannel.getId()), anyBoolean())) |
| 78 | ++ .thenReturn(mTestNotificationChannel); |
| 79 | ++ |
| 80 | ++ final Uri soundUri = Uri.parse("content://media/test/sound/uri"); |
| 81 | ++ final NotificationChannel updatedNotificationChannel = new NotificationChannel( |
| 82 | ++ TEST_CHANNEL_ID, TEST_CHANNEL_ID, IMPORTANCE_DEFAULT); |
| 83 | ++ updatedNotificationChannel.setSound(soundUri, |
| 84 | ++ updatedNotificationChannel.getAudioAttributes()); |
| 85 | ++ |
| 86 | ++ doThrow(new SecurityException("no access")).when(mUgmInternal) |
| 87 | ++ .checkGrantUriPermission(eq(Process.myUid()), any(), eq(soundUri), |
| 88 | ++ anyInt(), eq(Process.myUserHandle().getIdentifier())); |
| 89 | ++ |
| 90 | ++ assertThrows(SecurityException.class, |
| 91 | ++ () -> mBinderService.updateNotificationChannelFromPrivilegedListener(null, PKG, |
| 92 | ++ Process.myUserHandle(), updatedNotificationChannel)); |
| 93 | ++ |
| 94 | ++ verify(mPreferencesHelper, never()).updateNotificationChannel( |
| 95 | ++ anyString(), anyInt(), any(), anyBoolean()); |
| 96 | ++ |
| 97 | ++ verify(mListeners, never()).notifyNotificationChannelChanged(eq(PKG), |
| 98 | ++ eq(Process.myUserHandle()), eq(mTestNotificationChannel), |
| 99 | ++ eq(NotificationListenerService.NOTIFICATION_CHANNEL_OR_GROUP_UPDATED)); |
| 100 | ++ } |
| 101 | ++ |
| 102 | ++ @Test |
| 103 | ++ public void testUpdateNotificationChannelFromPrivilegedListener_noSoundUriPermission_sameSound() |
| 104 | ++ throws Exception { |
| 105 | ++ mService.setPreferencesHelper(mPreferencesHelper); |
| 106 | ++ List<String> associations = new ArrayList<>(); |
| 107 | ++ associations.add("a"); |
| 108 | ++ when(mCompanionMgr.getAssociations(PKG, UserHandle.getUserId(mUid))) |
| 109 | ++ .thenReturn(associations); |
| 110 | ++ when(mPreferencesHelper.getNotificationChannel(eq(PKG), anyInt(), |
| 111 | ++ eq(mTestNotificationChannel.getId()), anyBoolean())) |
| 112 | ++ .thenReturn(mTestNotificationChannel); |
| 113 | ++ |
| 114 | ++ final Uri soundUri = Settings.System.DEFAULT_NOTIFICATION_URI; |
| 115 | ++ final NotificationChannel updatedNotificationChannel = new NotificationChannel( |
| 116 | ++ TEST_CHANNEL_ID, TEST_CHANNEL_ID, IMPORTANCE_DEFAULT); |
| 117 | ++ updatedNotificationChannel.setSound(soundUri, |
| 118 | ++ updatedNotificationChannel.getAudioAttributes()); |
| 119 | ++ |
| 120 | ++ doThrow(new SecurityException("no access")).when(mUgmInternal) |
| 121 | ++ .checkGrantUriPermission(eq(Process.myUid()), any(), eq(soundUri), |
| 122 | ++ anyInt(), eq(Process.myUserHandle().getIdentifier())); |
| 123 | ++ |
| 124 | ++ mBinderService.updateNotificationChannelFromPrivilegedListener( |
| 125 | ++ null, PKG, Process.myUserHandle(), updatedNotificationChannel); |
| 126 | ++ |
| 127 | ++ verify(mPreferencesHelper, times(1)).updateNotificationChannel( |
| 128 | ++ anyString(), anyInt(), any(), anyBoolean()); |
| 129 | ++ |
| 130 | ++ verify(mListeners, never()).notifyNotificationChannelChanged(eq(PKG), |
| 131 | ++ eq(Process.myUserHandle()), eq(mTestNotificationChannel), |
| 132 | ++ eq(NotificationListenerService.NOTIFICATION_CHANNEL_OR_GROUP_UPDATED)); |
| 133 | ++ } |
| 134 | ++ |
| 135 | + @Test |
| 136 | + public void testGetNotificationChannelFromPrivilegedListener_cdm_success() throws Exception { |
| 137 | + mService.setPreferencesHelper(mPreferencesHelper); |
0 commit comments