OSDN Git Service
Adam Vartanian [Thu, 1 Feb 2018 10:02:42 +0000 (10:02 +0000)]
Merge "Adjust URI host parsing to stop on \ character." into lmp-mr1-dev
Adam Vartanian [Wed, 31 Jan 2018 11:05:10 +0000 (11:05 +0000)]
Adjust URI host parsing to stop on \ character.
The WHATWG URL parsing algorithm [1] used by browsers says that for
"special" URL schemes (which is basically all commonly-used
hierarchical schemes, including http, https, ftp, and file), the host
portion ends if a \ character is seen, whereas this class previously
continued to consider characters part of the hostname. This meant
that a malicious URL could be seen as having a "safe" host when viewed
by an app but navigate to a different host when passed to a browser.
[1] https://url.spec.whatwg.org/#host-state
Bug:
71360761
Test: vogar frameworks/base/core/tests/coretests/src/android/net/UriTest.java (on NYC branch)
Test: cts -m CtsNetTestCases (on NYC branch)
Change-Id: Id53f7054d1be8d59bbcc7e219159e59a2425106e
Adam Lesinski [Fri, 10 Nov 2017 01:12:17 +0000 (17:12 -0800)]
Check for null-terminator in ResStringPool::string8At
All other stringAt methods check for null termination. Be consistent
so that upper levels don't end up with huge corrupt strings.
Bug:
62537081
Test: none
Change-Id: I17bdfb0c1e34507b66c6cad651bbdb12c5d4c417
(cherry picked from commit
3d35a0ea307693a97583a61973e729a5e7db2687)
(cherry picked from commit
97f8cb01149b35b1832c7f9efe85ff19edf1083e)
Adam Vartanian [Tue, 7 Nov 2017 20:41:28 +0000 (20:41 +0000)]
Adjust Uri host parsing to use last instead of first @.
am:
cd6228dd37
Change-Id: I5db66a5a2073acaffe0560999c914a78df362c51
Adam Vartanian [Tue, 7 Nov 2017 12:22:23 +0000 (12:22 +0000)]
Adjust Uri host parsing to use last instead of first @.
Malformed authority segments can currently cause the parser to produce
a hostname that doesn't match the hostname produced by the WHATWG URL
parsing algorithm* used by browsers, which means that a URL could be seen
as having a "safe" host when checked by an Android app but actually visit
a different host when passed to a browser. The WHATWG URL parsing
algorithm always produces a hostname based on the last @ in the authority
segment, so we do the same.
* https://url.spec.whatwg.org/#authority-state resets the "buffer", which
is being used to build up the host name, each time an @ is found, so it
has the effect of using the content between the final @ and the end
of the authority section as the hostname.
Bug:
68341964
Test: vogar android.net.UriTest (on NYC branch)
Test: cts -m CtsNetTestCases (on NYC branch)
Change-Id: Idca79f35a886de042c94d6ab66787c2e98ac8376
Jeff Sharkey [Wed, 11 Oct 2017 22:55:00 +0000 (22:55 +0000)]
DO NOT MERGE. KEY_INTENT shouldn't grant permissions.
am:
ca7ffa06bc -s ours
Change-Id: I306c63c1922f29f1df3cb225bd2d3153cadecaa3
Jeff Sharkey [Mon, 12 Jun 2017 23:33:07 +0000 (17:33 -0600)]
DO NOT MERGE. KEY_INTENT shouldn't grant permissions.
KEY_INTENT has no business granting any Uri permissions, so remove
any grant flags that malicious apps may have tried sneaking in.
Test: builds, boots
Bug:
32990341,
32879915
Change-Id: I657455a770c81f045ccce6abbd2291407a1cfb42
Jeff Sharkey [Mon, 12 Jun 2017 23:33:07 +0000 (17:33 -0600)]
DO NOT MERGE. KEY_INTENT shouldn't grant permissions.
KEY_INTENT has no business granting any Uri permissions, so remove
any grant flags that malicious apps may have tried sneaking in.
Test: builds, boots
Bug:
32990341,
32879915
Change-Id: I657455a770c81f045ccce6abbd2291407a1cfb42
Siyamed Sinir [Sat, 30 Sep 2017 00:03:48 +0000 (00:03 +0000)]
Fix ClipboardService device lock check for cross profile
am:
0595b5a94b
Change-Id: I6aeaaef43a8e8c5ede049ae9e97fbf6d0129bac4
Beverly Tai [Thu, 14 Sep 2017 13:11:10 +0000 (13:11 +0000)]
Merge "DO NOT MERGE Backporting potential usb tapjacking precaution." into lmp-mr1-dev
Siyamed Sinir [Wed, 13 Sep 2017 22:09:24 +0000 (15:09 -0700)]
Fix ClipboardService device lock check for cross profile
ClipboardService.isDeviceLocked should clear callingIdentity before
accessing KeyguardManager.
Test: bit CtsDevicePolicyManagerTestCases:com.android.cts.devicepolicy.ManagedProfileTest
Bug:
64934810
Change-Id: Iffc8e73dd3ee14a94958bb50dd11a696eab7f052
Suprabh Shukla [Wed, 13 Sep 2017 20:21:09 +0000 (20:21 +0000)]
Clearing up invalid entries when SyncStorageEngine starts
am:
271702fc28
Change-Id: I4943cf417be41679c2fa332223825dd01a477814
Suprabh Shukla [Mon, 11 Sep 2017 22:20:35 +0000 (22:20 +0000)]
Clearing up invalid entries when SyncStorageEngine starts
Fixing the original change which was reverted. Using the
available api Context.getSystemService(String) instead of
the unavailable Context.getSystemService(Class)
Test: cts-tradefed run cts -p android.content.syncmanager
Bug:
35028827
This reverts commit
4a9d358448ef150cae259e9c5b5ed1227a1d6d9c.
Change-Id: I725430401eaec861f45bb91ee1352bb1307a6915
Beverly [Wed, 6 Sep 2017 17:24:46 +0000 (13:24 -0400)]
DO NOT MERGE Backporting potential usb tapjacking precaution.
Bug:
62187985
Test: manual, backport
Change-Id: I1a2150b795425a68ad45ee0134e31a317076d806
Beverly Tai [Tue, 12 Sep 2017 14:11:10 +0000 (14:11 +0000)]
Merge "DO NOT MERGE Backporting potential usb tapjacking precaution." into lmp-dev
am:
e1adf2240f -s ours
Change-Id: I02b0df60257429b5f2ed4ce2f0f4ee817abf585c
Beverly Tai [Tue, 12 Sep 2017 14:03:19 +0000 (14:03 +0000)]
Merge "DO NOT MERGE Backporting potential usb tapjacking precaution." into lmp-dev
Beverly [Thu, 31 Aug 2017 19:32:36 +0000 (15:32 -0400)]
DO NOT MERGE Backporting potential usb tapjacking precaution.
Bug:
62187985
Test: manual, backport
Change-Id: I52e27f84338fdcf63cad0ee7436233736499d87b
Siyamed Sinir [Mon, 11 Sep 2017 23:42:10 +0000 (23:42 +0000)]
Merge "Prevent getting data from Clipboard if device is locked" into lmp-dev
am:
9f496fbbe0
Change-Id: Ibc57c285fec0bf1fcf560854971770e1353a88ac
Siyamed Sinir [Mon, 11 Sep 2017 23:30:34 +0000 (23:30 +0000)]
Merge "Prevent getting data from Clipboard if device is locked" into lmp-dev
Suprabh Shukla [Mon, 11 Sep 2017 22:25:29 +0000 (22:25 +0000)]
Revert "Clearing up invalid entries when SyncStorageEngine starts"
am:
4a9d358448
Change-Id: I3844594302279f859f7834a6bb29093162914ae6
Suprabh Shukla [Mon, 11 Sep 2017 19:50:51 +0000 (19:50 +0000)]
Revert "Clearing up invalid entries when SyncStorageEngine starts"
API getSystemService(Class) was not present in lmp-dev.
This reverts commit
89c0dbca0f52987571b62e929f114f3126c29455.
Bug:
35028827
Change-Id: I19846d2a3ee27aecbae2367a74ee49082eea154d
Suprabh Shukla [Mon, 11 Sep 2017 04:13:16 +0000 (04:13 +0000)]
Clearing up invalid entries when SyncStorageEngine starts
am:
89c0dbca0f
Change-Id: Ib6a256a22d703feae8067366d8dc2622593c1142
Siyamed Sinir [Thu, 7 Sep 2017 01:02:23 +0000 (18:02 -0700)]
Prevent getting data from Clipboard if device is locked
Clipboard should not return data if the device is locked. This CL checks
for device locked state before returning values from get/has functions.
Bug:
64934810
Change-Id: I856a9079fe64db0af44383fae1a9a418de959420
Suprabh Shukla [Fri, 12 May 2017 22:26:54 +0000 (15:26 -0700)]
Clearing up invalid entries when SyncStorageEngine starts
Any app with permission WRITE_SYNC_SETTINGS could write sync settings
for authorities or accounts that are not valid. This results in invalid
data being persisted to disk which can effectively lead to a DOS style
attack. Clearing such entries on boot will make sure that a reboot fixes
any such issues.
Test: cts-tradefed run cts-dev -m CtsSyncContentHostTestCases
Bug:
35028827
Change-Id: I9e206a42508e3cba65d7523bf47fff743f47dcb2
Merged-In: I9e206a42508e3cba65d7523bf47fff743f47dcb2
(cherry picked from commit
042a478b73c3b7f7cd73f5bb1af657cfe07d0571)
Siarhei Vishniakou [Wed, 16 Aug 2017 20:35:40 +0000 (20:35 +0000)]
DO NOT MERGE Remove window obscurement information. am:
c3c2ed94ff am:
96fe6421f6 am:
9d99b0001e -s ours
am:
3280efe50e -s ours
Change-Id: Ia7bf4d6991be15c732ba8b55c37f2c9e447b1dbd
Siarhei Vishniakou [Wed, 16 Aug 2017 20:19:29 +0000 (20:19 +0000)]
DO NOT MERGE Remove window obscurement information. am:
c3c2ed94ff am:
96fe6421f6
am:
9d99b0001e -s ours
Change-Id: Ib0fb40f990138b3729b66bdb6d6a095bd3ad231d
Siarhei Vishniakou [Wed, 16 Aug 2017 20:03:29 +0000 (20:03 +0000)]
DO NOT MERGE Remove window obscurement information. am:
c3c2ed94ff
am:
96fe6421f6
Change-Id: Ia2ce3f8b95b578253c5336407ae85880d3d317f4
Siarhei Vishniakou [Wed, 16 Aug 2017 19:48:22 +0000 (19:48 +0000)]
DO NOT MERGE Remove window obscurement information.
am:
c3c2ed94ff
Change-Id: Ib9552165e9b1c2dfcd235d1f7930d85c258b2ece
Siarhei Vishniakou [Fri, 28 Jul 2017 01:24:01 +0000 (18:24 -0700)]
DO NOT MERGE Remove window obscurement information.
If ACTION_OUTSIDE_EVENTS contain information about whether the touch is
obscured, then a pattern of invisible, untouchable, unfocusable
SYSTEM_ALERT_WINDOWS can be placed across the screen to determine
approximate locations of touch events without the user knowing.
Bug:
31097064
Test: cts-tradefed run cts --class android.security.cts.MotionEventTest
Change-Id: I081a483c491dd384e252f0b615affee96038fdda
Phil Weaver [Tue, 18 Jul 2017 18:36:23 +0000 (18:36 +0000)]
Merge "DO NOT MERGE Back-port fixes for b/
62196835" into lmp-dev
am:
a620b21828 -s ours
Change-Id: Iaa4e8eb83ebf2036999a31e3487c6157bcefecbf
Phil Weaver [Tue, 18 Jul 2017 18:26:57 +0000 (18:26 +0000)]
DO NOT MERGE Back-port fixes for b/
62196835
am:
24fdc53cfe -s ours
Change-Id: I01a6f574df5cc1b133b7f761062a6259aac07476
Phil Weaver [Tue, 18 Jul 2017 18:19:45 +0000 (18:19 +0000)]
Merge "DO NOT MERGE Back-port fixes for b/
62196835" into lmp-dev
Phil Weaver [Wed, 12 Jul 2017 21:04:16 +0000 (14:04 -0700)]
Back-port fixes for b/
62196835
Bug:
62196835
Test: Created an accessibility service that displays a system
and a toast overlay, confirmed that it disappeared when we
reached the accessibility permission screen that uses this
flag.
Change-Id: Ic51ead670fc480e549512ba1d02f49d9c13bc3f0
Phil Weaver [Wed, 12 Jul 2017 21:04:16 +0000 (14:04 -0700)]
DO NOT MERGE Back-port fixes for b/
62196835
Bug:
62196835
Test: Created an accessibility service that displays a system
and a toast overlay, confirmed that it disappeared when we
reached the accessibility permission screen that uses this
flag.
Change-Id: Ic51ead670fc480e549512ba1d02f49d9c13bc3f0
Phil Weaver [Wed, 12 Jul 2017 22:06:27 +0000 (22:06 +0000)]
Back-port fixes for b/
62196835 am:
5bdffc5d57 am:
5a7eb970e2 -s ours am:
f433884a84
am:
ba928bd522
Change-Id: I74a7b0488371606dd9bdccab854d23c0e09b1ac9
Phil Weaver [Wed, 12 Jul 2017 22:00:31 +0000 (22:00 +0000)]
Back-port fixes for b/
62196835 am:
5bdffc5d57 am:
5a7eb970e2 -s ours
am:
f433884a84
Change-Id: I737838098a36efafe1509c4814ac1120a3bb8297
Phil Weaver [Wed, 12 Jul 2017 21:55:31 +0000 (21:55 +0000)]
Back-port fixes for b/
62196835 am:
5bdffc5d57
am:
5a7eb970e2 -s ours
Change-Id: Ifd4b5ff2487c8b8035ffaf6ed7e55539f26a463e
Phil Weaver [Wed, 12 Jul 2017 21:43:46 +0000 (21:43 +0000)]
Back-port fixes for b/
62196835
am:
5bdffc5d57
Change-Id: Ia5dafc7a8724d296e710f32d936bb493b51951de
Phil Weaver [Tue, 11 Jul 2017 00:27:20 +0000 (17:27 -0700)]
Back-port fixes for b/
62196835
Bug:
62196835
Test: Created an accessibility service that displays a system
and a toast overlay, confirmed that it disappeared when we
reached the accessibility permission screen that uses this
flag.
Change-Id: Ibb4c2c6a30de6b4ce8d27c34caa02e2d8148f621
Marco Nelissen [Fri, 16 Jun 2017 15:43:46 +0000 (15:43 +0000)]
libmedia_jni.so doesn't need libjhead.so
am:
9a4a34afd8 -s ours
Change-Id: I557d7e96401b742d916e2eef5aa03949018382c7
Marco Nelissen [Fri, 9 Jun 2017 22:07:38 +0000 (15:07 -0700)]
libmedia_jni.so doesn't need libjhead.so
Bug:
37776688
Merged-In: I0e0e6209be7a9d3e493abdcee8619cae6d4b9501
Change-Id: I18f0b6b88a9c0b117839497f081549404d5edc40
Marco Nelissen [Tue, 6 Jun 2017 23:02:35 +0000 (23:02 +0000)]
Merge "Close connection before retrying" into lmp-dev
am:
a8648ecebb
Change-Id: I744fdb979aa2803b53d3ff6f4e3e72f6f1160d74
TreeHugger Robot [Tue, 6 Jun 2017 22:53:55 +0000 (22:53 +0000)]
Merge "Close connection before retrying" into lmp-dev
Marco Nelissen [Fri, 2 Jun 2017 19:16:44 +0000 (12:16 -0700)]
Close connection before retrying
Otherwise the (CTS) server might run out of connections.
Bug:
38391487
Bug:
22771132
Test: build, run CTS, stream music
Change-Id: I92c782a6799ab36eec8df3f7c3217bea667b838a
Nick Kralevich [Mon, 22 May 2017 22:05:18 +0000 (22:05 +0000)]
ZygoteInit: Remove CAP_SYS_RESOURCE
am:
4911af2b8c
Change-Id: I4aa46981edb8fd711e1aec8c889528e596e5c233
Nick Kralevich [Mon, 22 May 2017 22:04:57 +0000 (22:04 +0000)]
system_server: add CAP_SYS_PTRACE
am:
966619d0ab
Change-Id: Ie5f95f2c078cd0bec7a2b2321c3303301ec9ec74
Nick Kralevich [Tue, 14 Mar 2017 17:25:35 +0000 (10:25 -0700)]
ZygoteInit: Remove CAP_SYS_RESOURCE
Please see commit
3082eb7c7253c62a06aa151a80487a4eabd49914 for an
explanation of this change.
This capability is not used by system_server.
Bug:
34951864
Bug:
38496951
Test: code compiles, device boots, no selinux errors ever reported.
Change-Id: I4242b1abaa8679b9bfa0d31a1df565b46b7b3cc3
(cherry picked from commit
35775783fc6609035136184e3843bc743b59945d)
Nick Kralevich [Wed, 15 Feb 2017 23:12:31 +0000 (15:12 -0800)]
system_server: add CAP_SYS_PTRACE
Commit https://android.googlesource.com/kernel/common/+/
f0ce0eee added
CAP_SYS_RESOURCE as a capability check which would allow access to
sensitive /proc/PID files. system_server uses this capability to collect
smaps from managed processes. Presumably this was done to avoid the
implications of granting CAP_SYS_PTRACE to system_server.
However, with SELinux enforcement, we can grant CAP_SYS_PTRACE but not
allow ptrace attach() to other processes. The net result of this is that
CAP_SYS_PTRACE and CAP_SYS_RESOURCE have identical security controls, as
long as system_server:process ptrace is never granted.
Add CAP_SYS_PTRACE to the set of capabilities granted to system_server.
Don't delete CAP_SYS_RESOURCE for now. SELinux has blocked the use of
CAP_SYS_RESOURCE, but we still want to generate audit logs if it's
triggered. CAP_SYS_RESOURCE can be deleted in a future commit.
Bug:
34951864
Bug:
38496951
Test: Device boots, functionality remains identical, no sys_resource
denials from system_server.
Change-Id: I2570266165396dba2b600eac7c42c94800d9c65b
(cherry picked from commit
3082eb7c7253c62a06aa151a80487a4eabd49914)
Phil Weaver [Fri, 7 Apr 2017 23:27:47 +0000 (23:27 +0000)]
Merge "Make a11y node info parceling more robust" into lmp-mr1-dev
Phil Weaver [Fri, 7 Apr 2017 23:09:28 +0000 (23:09 +0000)]
Make a11y node info parceling more robust
am:
1d8eb49073
Change-Id: I5280a23cbfff5abfcc83e9e6d9afb4f8960ece44
Phil Weaver [Fri, 7 Apr 2017 21:39:27 +0000 (14:39 -0700)]
Make a11y node info parceling more robust
Fix a bug where a malformed Parceled representation
of an AccessibilityNodeInfo could be used to mess with
Bundles as they get reparceled.
Bug:
36491278
Test: Verified that POC no longer works, a11y cts still passes.
(Manual merge from commit
687bb44b437f7bb24dd3dddf072c2f646308e2ca)
Change-Id: I7746c9175a2da28f75d4f4b169d7997abadf1852
Phil Weaver [Fri, 7 Apr 2017 21:39:27 +0000 (14:39 -0700)]
Make a11y node info parceling more robust
Fix a bug where a malformed Parceled representation
of an AccessibilityNodeInfo could be used to mess with
Bundles as they get reparceled.
Bug:
36491278
Test: Verified that POC no longer works, a11y cts still passes.
(Manual merge from commit
687bb44b437f7bb24dd3dddf072c2f646308e2ca)
Change-Id: I7746c9175a2da28f75d4f4b169d7997abadf1852
Fyodor Kupolov [Fri, 10 Mar 2017 03:06:31 +0000 (03:06 +0000)]
Merge "[DO NOT MERGE] Throw exception if slot has invalid offset" into klp-dev am:
ac87aee354 am:
a821245d70 am:
156fa32e2a -s ours
am:
de9cb7ed68 -s ours
Change-Id: I2f94e2ea49c05a29308ca2351a083377350bb2ab
Fyodor Kupolov [Fri, 10 Mar 2017 03:00:46 +0000 (03:00 +0000)]
Merge "[DO NOT MERGE] Throw exception if slot has invalid offset" into klp-dev am:
ac87aee354 am:
a821245d70
am:
156fa32e2a -s ours
Change-Id: Ic4e51daa36c395f2e3b538658649ff9104bb962c
Fyodor Kupolov [Fri, 10 Mar 2017 02:55:07 +0000 (02:55 +0000)]
Merge "[DO NOT MERGE] Throw exception if slot has invalid offset" into klp-dev am:
ac87aee354
am:
a821245d70
Change-Id: I1e47c963728906cb2283a353c882017368d07747
Fyodor Kupolov [Fri, 10 Mar 2017 02:49:34 +0000 (02:49 +0000)]
Merge "[DO NOT MERGE] Throw exception if slot has invalid offset" into klp-dev
am:
ac87aee354
Change-Id: I5bbdc48120f2d03b4ad6605bfeccd5ccdc8c7958
Fyodor Kupolov [Fri, 10 Mar 2017 02:39:09 +0000 (02:39 +0000)]
Merge "[DO NOT MERGE] Throw exception if slot has invalid offset" into klp-dev
Fyodor Kupolov [Fri, 10 Mar 2017 02:02:30 +0000 (02:02 +0000)]
Merge "[DO NOT MERGE] Throw exception if slot has invalid offset" into lmp-dev
am:
d2e8e1488a -s ours
Change-Id: I85273c31137127b733b51579c55618326d67a88c
Fyodor Kupolov [Fri, 10 Mar 2017 01:55:54 +0000 (01:55 +0000)]
[DO NOT MERGE] Throw exception if slot has invalid offset
am:
69e347f7ef -s ours
Change-Id: I5b06e8493703961f828894358a05c9cc70856fa9
Fyodor Kupolov [Fri, 10 Mar 2017 01:51:13 +0000 (01:51 +0000)]
Merge "[DO NOT MERGE] Throw exception if slot has invalid offset" into lmp-mr1-dev
Fyodor Kupolov [Fri, 10 Mar 2017 01:50:38 +0000 (01:50 +0000)]
Merge "[DO NOT MERGE] Throw exception if slot has invalid offset" into lmp-dev
Fyodor Kupolov [Thu, 9 Mar 2017 20:05:21 +0000 (20:05 +0000)]
[DO NOT MERGE] Check bounds in offsetToPtr am:
7b83d625aa am:
2d54d2c0d5 am:
305a41b7a6 -s ours
am:
e0f30ecdb9 -s ours
Change-Id: Iffa0c61e06cbfe2e66912c26b0a3d81660bc5a91
Fyodor Kupolov [Thu, 9 Mar 2017 19:58:26 +0000 (19:58 +0000)]
[DO NOT MERGE] Check bounds in offsetToPtr am:
7b83d625aa am:
2d54d2c0d5
am:
305a41b7a6 -s ours
Change-Id: I902e6af1c2ef49d454a7d1bae92d8e20ea263b0e
Fyodor Kupolov [Thu, 9 Mar 2017 19:52:01 +0000 (19:52 +0000)]
[DO NOT MERGE] Check bounds in offsetToPtr am:
7b83d625aa
am:
2d54d2c0d5
Change-Id: I29dccd1ed95079470fc1dd7b04e3db6c5c7d76d2
Fyodor Kupolov [Thu, 9 Mar 2017 19:43:54 +0000 (19:43 +0000)]
[DO NOT MERGE] Check bounds in offsetToPtr
am:
7b83d625aa
Change-Id: Icfcec14e7d4bfcd6c893f0fa319541223b9d7901
Fyodor Kupolov [Thu, 9 Mar 2017 19:43:52 +0000 (19:43 +0000)]
[DO NOT MERGE] Check bounds in offsetToPtr
am:
bb6096d37b -s ours
Change-Id: Ief3269100fb5c0d425e58b4faf87bd73677251b1
Fyodor Kupolov [Wed, 22 Feb 2017 22:12:50 +0000 (14:12 -0800)]
[DO NOT MERGE] Throw exception if slot has invalid offset
Previously the process would crash, which is OK, but complicates testing.
Test: cts-tradefed run cts --module CtsContentTestCases
--test android.content.cts.ContentProviderCursorWindowTest
Bug:
34128677
Change-Id: I5b50982d77ec65c442fbb973d14c85a5c29c43c7
(cherry picked from commit
eb6de6f5f10148b9f81f9c0074d1e1f7af21bfb0)
Fyodor Kupolov [Wed, 22 Feb 2017 22:12:50 +0000 (14:12 -0800)]
[DO NOT MERGE] Throw exception if slot has invalid offset
Previously the process would crash, which is OK, but complicates testing.
Test: cts-tradefed run cts --module CtsContentTestCases
--test android.content.cts.ContentProviderCursorWindowTest
Bug:
34128677
Change-Id: I5b50982d77ec65c442fbb973d14c85a5c29c43c7
(cherry picked from commit
eb6de6f5f10148b9f81f9c0074d1e1f7af21bfb0)
Fyodor Kupolov [Wed, 22 Feb 2017 22:12:50 +0000 (14:12 -0800)]
[DO NOT MERGE] Throw exception if slot has invalid offset
Previously the process would crash, which is OK, but complicates testing.
Test: cts-tradefed run cts --module CtsContentTestCases
--test android.content.cts.ContentProviderCursorWindowTest
Bug:
34128677
Change-Id: I5b50982d77ec65c442fbb973d14c85a5c29c43c7
(cherry picked from commit
eb6de6f5f10148b9f81f9c0074d1e1f7af21bfb0)
Fyodor Kupolov [Tue, 28 Feb 2017 01:33:18 +0000 (17:33 -0800)]
[DO NOT MERGE] Check bounds in offsetToPtr
Check whether specified offset belongs to mData.
Also added a default argument bufferSize to check the end offset.
Size of the ashmem descriptor can be modified between
ashmem_get_size_region call and mmap. createFromParcel method was updated
to check ashmem size again immediately after memory is mapped.
Test: manual - using the test app from the bug
Bug:
34128677
Change-Id: I3ecd1616a870ce20941ce9b20a1843d2b4295750
(cherry picked from commit
45e2e95c2ffeb2d978e2cce80b729ef6ada3b8d2)
Fyodor Kupolov [Tue, 28 Feb 2017 01:33:18 +0000 (17:33 -0800)]
[DO NOT MERGE] Check bounds in offsetToPtr
Check whether specified offset belongs to mData.
Also added a default argument bufferSize to check the end offset.
Size of the ashmem descriptor can be modified between
ashmem_get_size_region call and mmap. createFromParcel method was updated
to check ashmem size again immediately after memory is mapped.
Test: manual - using the test app from the bug
Bug:
34128677
Change-Id: I3ecd1616a870ce20941ce9b20a1843d2b4295750
(cherry picked from commit
45e2e95c2ffeb2d978e2cce80b729ef6ada3b8d2)
Fyodor Kupolov [Tue, 28 Feb 2017 01:33:18 +0000 (17:33 -0800)]
[DO NOT MERGE] Check bounds in offsetToPtr
Check whether specified offset belongs to mData.
Also added a default argument bufferSize to check the end offset.
Size of the ashmem descriptor can be modified between
ashmem_get_size_region call and mmap. createFromParcel method was updated
to check ashmem size again immediately after memory is mapped.
Test: manual - using the test app from the bug
Bug:
34128677
Change-Id: I3ecd1616a870ce20941ce9b20a1843d2b4295750
(cherry picked from commit
45e2e95c2ffeb2d978e2cce80b729ef6ada3b8d2)
Jeff Sharkey [Wed, 30 Nov 2016 21:29:59 +0000 (14:29 -0700)]
DO NOT MERGE. Grant MMS Uri permissions as the calling UID.
A recent security fix prevents the system UID from handing out Uri
permission grants directly from itself. Instead, services need to
issue grants as the original calling UID to ensure that the caller
actually has access to the Uris.
Test: builds, boots, send/recv MMS works in primary/secondary users
Bug:
33231106
Change-Id: Ia9fe19843b52977c8a94ee5349b907beda1882fc
(cherry picked from commit
7ff418d9a9afb9ecf42f87fffd3e65477decb55e)
Jeff Sharkey [Fri, 3 Feb 2017 00:10:17 +0000 (00:10 +0000)]
Merge "DO NOT MERGE. No direct Uri grants from system." into lmp-dev
am:
3e4faac39f -s ours
Change-Id: If1ea6da6679874ca13379222a28c529421c80b23
Jeff Sharkey [Fri, 3 Feb 2017 00:10:16 +0000 (00:10 +0000)]
DO NOT MERGE. No direct Uri grants from system.
am:
2dfdf662d0 -s ours
Change-Id: Id06fac9dd096c1d821a1af7451db388446e9b156
Jeff Sharkey [Thu, 2 Feb 2017 23:59:43 +0000 (23:59 +0000)]
Merge "DO NOT MERGE. No direct Uri grants from system." into lmp-dev
Jeff Sharkey [Thu, 2 Feb 2017 23:59:42 +0000 (23:59 +0000)]
Merge "DO NOT MERGE. No direct Uri grants from system." into lmp-mr1-dev
Suprabh Shukla [Thu, 2 Feb 2017 23:07:36 +0000 (23:07 +0000)]
Merge "DO NOT MERGE Do not call RecoverySystem with DPMS lock held" into lmp-dev
am:
af85feef36 -s ours
Change-Id: Idf57ddf932e98dda06ac9c51f7e230d6a673882b
Suprabh Shukla [Thu, 2 Feb 2017 23:07:34 +0000 (23:07 +0000)]
DO NOT MERGE Do not call RecoverySystem with DPMS lock held
am:
14ed611912 -s ours
Change-Id: I1645d15febdfffd76cd2c592241549c507db1185
Suprabh Shukla [Thu, 2 Feb 2017 22:58:45 +0000 (22:58 +0000)]
Merge "DO NOT MERGE Do not call RecoverySystem with DPMS lock held" into lmp-dev
Suprabh Shukla [Thu, 2 Feb 2017 22:45:36 +0000 (22:45 +0000)]
DO NOT MERGE Do not call RecoverySystem with DPMS lock held am:
8cdc04957a am:
21992d997b am:
b278ed787e -s ours
am:
ec3e2b9dcb -s ours
Change-Id: I76bf4d69d98374a90da3cd4c74f0c2d892504a40
Suprabh Shukla [Thu, 2 Feb 2017 22:41:38 +0000 (22:41 +0000)]
DO NOT MERGE Do not call RecoverySystem with DPMS lock held am:
8cdc04957a am:
21992d997b
am:
b278ed787e -s ours
Change-Id: Ib70440bdd1c60ed5eaa9b8c8152a4745f44cacd6
Suprabh Shukla [Thu, 2 Feb 2017 22:36:03 +0000 (22:36 +0000)]
DO NOT MERGE Do not call RecoverySystem with DPMS lock held am:
8cdc04957a
am:
21992d997b
Change-Id: Ib5ba5eb63227be2fbf25a79e7f8f8e42b1cc9a2b
Suprabh Shukla [Thu, 2 Feb 2017 22:31:29 +0000 (22:31 +0000)]
DO NOT MERGE Do not call RecoverySystem with DPMS lock held
am:
8cdc04957a
Change-Id: I7c1b9e9f785ef99575136d9af0b062dad759c17a
Suprabh Shukla [Thu, 2 Feb 2017 22:23:08 +0000 (22:23 +0000)]
Merge "DO NOT MERGE Do not call RecoverySystem with DPMS lock held" into lmp-mr1-dev
Jeff Sharkey [Mon, 21 Nov 2016 17:33:54 +0000 (10:33 -0700)]
DO NOT MERGE. No direct Uri grants from system.
The system should never be extending Uri permission grants from
itself, since it automatically holds all the permissions. Instead,
the system should always be a mediator between two specific app, and
it should be using startActivityAsCaller() if it needs to extend
permissions.
Blocking at this level fixes an entire class of confused deputy
security issues.
Test: builds, normal intent resolution UI works
Bug:
33019296,
32990341,
32879915,
32879772
Change-Id: Iaa57c393a386d8068e807d0dd0caccc89d8a11db
Jeff Sharkey [Mon, 21 Nov 2016 17:33:54 +0000 (10:33 -0700)]
DO NOT MERGE. No direct Uri grants from system.
The system should never be extending Uri permission grants from
itself, since it automatically holds all the permissions. Instead,
the system should always be a mediator between two specific app, and
it should be using startActivityAsCaller() if it needs to extend
permissions.
Blocking at this level fixes an entire class of confused deputy
security issues.
Test: builds, normal intent resolution UI works
Bug:
33019296,
32990341,
32879915,
32879772
Change-Id: Iaa57c393a386d8068e807d0dd0caccc89d8a11db
Suprabh Shukla [Tue, 31 Jan 2017 02:24:02 +0000 (18:24 -0800)]
DO NOT MERGE Do not call RecoverySystem with DPMS lock held
Note DPM.wipeData() on a secondary user is now blocking, just like
it's been always blocking on the primary user.
Bug
30681079
Change-Id: Ia832bed0f22396998d6307ab46e262dae9463838
Merged-In: Ia832bed0f22396998d6307ab46e262dae9463838
Suprabh Shukla [Tue, 31 Jan 2017 04:52:04 +0000 (20:52 -0800)]
DO NOT MERGE Do not call RecoverySystem with DPMS lock held
Note DPM.wipeData() on a secondary user is now blocking, just like
it's been always blocking on the primary user.
Bug
30681079
Change-Id: Ia832bed0f22396998d6307ab46e262dae9463838
Suprabh Shukla [Tue, 31 Jan 2017 02:02:18 +0000 (18:02 -0800)]
DO NOT MERGE Do not call RecoverySystem with DPMS lock held
Bug
30681079
Change-Id: Ia832bed0f22396998d6307ab46e262dae9463838
Jack Yu [Mon, 16 Jan 2017 18:49:55 +0000 (10:49 -0800)]
Fixed the logic for tethering provisioning re-evaluation
Previously we only re-evaluate provisioning for SIM swap case
The new logic covers both SIM swap case
(ABSENT->NOT_READY->UNKNOWN->READY->LOADED) and modem reset
case (NOT_READY->READY->LOADED)
Test: Manual
bug:
33815946
Change-Id: I9960123605b10d3fa5f3584c6c8b70b616acd6f8
Charles He [Thu, 29 Dec 2016 09:43:10 +0000 (09:43 +0000)]
Merge "Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable." into lmp-mr1-dev
Charles He [Thu, 29 Dec 2016 09:42:25 +0000 (09:42 +0000)]
Merge "Prevent writing to FRP partition during factory reset." into lmp-mr1-dev
Tom O'Neill [Thu, 22 Dec 2016 17:14:05 +0000 (17:14 +0000)]
Fix exploit where can hide the fact that a location was mocked am:
a206a0f17e am:
d417e54872 am:
3380a77516
am:
0a8978f04b
Change-Id: I693665a57465ec57f946fad57cda9ce48389408f
Tom O'Neill [Thu, 22 Dec 2016 17:09:09 +0000 (17:09 +0000)]
Fix exploit where can hide the fact that a location was mocked am:
a206a0f17e am:
d417e54872
am:
3380a77516
Change-Id: Ice61f337e1fcfd0569431538e475d94f9d205423
Tom O'Neill [Thu, 22 Dec 2016 17:04:07 +0000 (17:04 +0000)]
Fix exploit where can hide the fact that a location was mocked am:
a206a0f17e
am:
d417e54872
Change-Id: I2f47020055f962b36f095137d75c9cbfe6b1a6db
Tom O'Neill [Thu, 22 Dec 2016 16:58:33 +0000 (16:58 +0000)]
Fix exploit where can hide the fact that a location was mocked
am:
a206a0f17e
Change-Id: Ib3af056919a4b909d3d11dd3fe2b46eaa7cdf0f4
Tom O'Neill [Thu, 15 Dec 2016 18:26:28 +0000 (10:26 -0800)]
Fix exploit where can hide the fact that a location was mocked
- Even if call setTestProviderLocation() with inconsistent providers,
should still end up with a location that is flagged as mocked
- Bug:
33091107
Change-Id: I39e038f25b975989c2e8651bfd9ec9e74073e6cd
Charles He [Thu, 1 Dec 2016 19:22:33 +0000 (19:22 +0000)]
Add @GuardedBy annotation to PersistentDataBlockService#mIsWritable.
Change-Id: I1024f2a56badde5c123d025d6fe02f42559cbcb1
Test: manual
Bug:
30352311
(cherry picked from commit
f6f1d627483b4dad9d65176769a1ee92c59a4810)
Charles He [Thu, 24 Nov 2016 14:05:00 +0000 (14:05 +0000)]
Prevent writing to FRP partition during factory reset.
Avoid potential race condition between FRP wipe and write operations
during factory reset by making the FRP partition unwritable after
wipe.
Bug:
30352311
Test: manual
Change-Id: If3f024a1611366c0677a996705724458094fcfad
(cherry picked from commit
a629c772f4a7a5ddf7ff9f78fb19f7ab86c2a9c2)