Skip to content

Security Patches :D #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: eleven
Choose a base branch
from
Open

Security Patches :D #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c31de26
DO NOT MERGE Grant carrier privileges if package has carrier config a…
Oct 28, 2022
40563c0
RESTRICT AUTOMERGE
May 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions src/com/android/phone/GsmUmtsCallForwardOptions.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,13 @@
package com.android.phone;

import android.app.ActionBar;
import android.content.ContentProvider;
import android.content.Intent;
import android.database.Cursor;
import android.os.Bundle;
import android.os.PersistableBundle;
import android.os.Process;
import android.os.UserHandle;
import android.preference.Preference;
import android.preference.PreferenceScreen;
import android.telephony.CarrierConfigManager;
Expand Down Expand Up @@ -203,6 +206,15 @@ protected void onActivityResult(int requestCode, int resultCode, Intent data) {
}
Cursor cursor = null;
try {
// check if the URI returned by the user belongs to the user
final int currentUser = UserHandle.getUserId(Process.myUid());
if (currentUser
!= ContentProvider.getUserIdFromUri(data.getData(), currentUser)) {

Log.w(LOG_TAG, "onActivityResult: Contact data of different user, "
+ "cannot access");
return;
}
cursor = getContentResolver().query(data.getData(),
NUM_PROJECTION, null, null, null);
if ((cursor == null) || (!cursor.moveToFirst())) {
Expand Down
56 changes: 48 additions & 8 deletions src/com/android/phone/PhoneInterfaceManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,7 @@
import android.telephony.TelephonyHistogram;
import android.telephony.TelephonyManager;
import android.telephony.TelephonyScanManager;
import android.telephony.UiccAccessRule;
import android.telephony.UiccCardInfo;
import android.telephony.UiccSlotInfo;
import android.telephony.UssdResponse;
Expand Down Expand Up @@ -5836,14 +5837,18 @@ private int getCarrierPrivilegeStatusFromCarrierConfigRules(int privilegeFromSim

PackageManager pkgMgr = phone.getContext().getPackageManager();
String[] packages = pkgMgr.getPackagesForUid(uid);
if (packages == null) {
return privilegeFromSim;
}

final long identity = Binder.clearCallingIdentity();
try {
SubscriptionInfo subInfo = subController.getSubscriptionInfo(phone.getSubId());
SubscriptionManager subManager = (SubscriptionManager)
phone.getContext().getSystemService(Context.TELEPHONY_SUBSCRIPTION_SERVICE);
int subId = phone.getSubId();
SubscriptionInfo subInfo = subController.getSubscriptionInfo(subId);
List<UiccAccessRule> carrierConfigAccessRules = subInfo.getCarrierConfigAccessRules();

for (String pkg : packages) {
if (subManager.canManageSubscription(subInfo, pkg)) {
if (hasCarrierConfigAccess(pkg, pkgMgr, carrierConfigAccessRules)) {
return TelephonyManager.CARRIER_PRIVILEGE_STATUS_HAS_ACCESS;
}
}
Expand All @@ -5862,16 +5867,51 @@ private int getCarrierPrivilegeStatusFromCarrierConfigRules(int privilegeFromSim

final long identity = Binder.clearCallingIdentity();
try {
SubscriptionInfo subInfo = subController.getSubscriptionInfo(phone.getSubId());
SubscriptionManager subManager = (SubscriptionManager)
phone.getContext().getSystemService(Context.TELEPHONY_SUBSCRIPTION_SERVICE);
return subManager.canManageSubscription(subInfo, pkgName)
int subId = phone.getSubId();
SubscriptionInfo subInfo = subController.getSubscriptionInfo(subId);
List<UiccAccessRule> carrierConfigAccessRules = subInfo.getCarrierConfigAccessRules();

return hasCarrierConfigAccess(pkgName, phone.getContext().getPackageManager(),
carrierConfigAccessRules)
? TelephonyManager.CARRIER_PRIVILEGE_STATUS_HAS_ACCESS : privilegeFromSim;
} finally {
Binder.restoreCallingIdentity(identity);
}
}

/**
* Check whether carrier privilege status can be granted to the provided app for this
* subscription based on the carrier config access rules of the subscription.
*
* @param packageName package name of the app to check
* @param packageManager package manager
* @param carrierConfigAccessRules carrier config access rules of the subscription
* @return true if the app is included in the mCarrierConfigAccessRules of this subscription.
*/
private boolean hasCarrierConfigAccess(String packageName, PackageManager packageManager,
@NonNull List<UiccAccessRule> carrierConfigAccessRules) {
if ((packageName == null) || (carrierConfigAccessRules.isEmpty())) {
return false;
}

PackageInfo packageInfo;
try {
packageInfo = packageManager.getPackageInfo(packageName,
PackageManager.GET_SIGNING_CERTIFICATES);
} catch (PackageManager.NameNotFoundException e) {
logv("Unknown package: " + packageName);
return false;
}

for (UiccAccessRule rule : carrierConfigAccessRules) {
if (rule.getCarrierPrivilegeStatus(packageInfo)
== TelephonyManager.CARRIER_PRIVILEGE_STATUS_HAS_ACCESS) {
return true;
}
}
return false;
}

@Override
public int getCarrierPrivilegeStatus(int subId) {
final Phone phone = getPhone(subId);
Expand Down
14 changes: 14 additions & 0 deletions src/com/android/phone/settings/VoicemailSettingsActivity.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
package com.android.phone.settings;

import android.app.Dialog;
import android.content.ContentProvider;
import android.content.DialogInterface;
import android.content.Intent;
import android.database.Cursor;
Expand All @@ -25,6 +26,8 @@
import android.os.Handler;
import android.os.Message;
import android.os.PersistableBundle;
import android.os.Process;
import android.os.UserHandle;
import android.os.UserManager;
import android.preference.Preference;
import android.preference.PreferenceActivity;
Expand Down Expand Up @@ -518,6 +521,17 @@ protected void onActivityResult(int requestCode, int resultCode, Intent data) {

Cursor cursor = null;
try {
// check if the URI returned by the user belongs to the user
final int currentUser = UserHandle.getUserId(Process.myUid());
if (currentUser
!= ContentProvider.getUserIdFromUri(data.getData(), currentUser)) {

if (DBG) {
log("onActivityResult: Contact data of different user, "
+ "cannot access");
}
return;
}
cursor = getContentResolver().query(data.getData(),
new String[] { CommonDataKinds.Phone.NUMBER }, null, null, null);
if ((cursor == null) || (!cursor.moveToFirst())) {
Expand Down
13 changes: 13 additions & 0 deletions src/com/android/phone/settings/fdn/EditFdnContactScreen.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,12 @@

import static android.view.Window.PROGRESS_VISIBILITY_OFF;
import static android.view.Window.PROGRESS_VISIBILITY_ON;
import static android.app.Activity.RESULT_OK;


import android.app.Activity;
import android.content.AsyncQueryHandler;
import android.content.ContentProvider;
import android.content.ContentResolver;
import android.content.ContentValues;
import android.content.Intent;
Expand All @@ -30,6 +33,8 @@
import android.os.Bundle;
import android.os.Handler;
import android.os.PersistableBundle;
import android.os.Process;
import android.os.UserHandle;
import android.provider.ContactsContract.CommonDataKinds;
import android.telephony.PhoneNumberUtils;
import android.text.Editable;
Expand Down Expand Up @@ -166,6 +171,14 @@ protected void onActivityResult(int requestCode, int resultCode, Intent intent)
}
Cursor cursor = null;
try {
// check if the URI returned by the user belongs to the user
final int currentUser = UserHandle.getUserId(Process.myUid());
if (currentUser
!= ContentProvider.getUserIdFromUri(intent.getData(), currentUser)) {
Log.w(LOG_TAG, "onActivityResult: Contact data of different user, "
+ "cannot access");
return;
}
cursor = getContentResolver().query(intent.getData(),
NUM_PROJECTION, null, null, null);
if ((cursor == null) || (!cursor.moveToFirst())) {
Expand Down