diff options
author | Christopher Tate <ctate@google.com> | 2016-05-20 15:29:31 -0700 |
---|---|---|
committer | The Android Automerger <android-build@google.com> | 2016-05-26 15:19:44 -0700 |
commit | 6e9224c3ef7a2b0064b80e9a597ae9316f80d004 (patch) | |
tree | ed7dd83e3a99191114393006a9f41240d132e18d | |
parent | 632994a63fe79d8c5c0150cfa72ea8f6b12c904b (diff) | |
download | base-lollipop-mr1-cts-release.tar.gz |
DO NOT MERGE : backport of backup transport whitelistandroid-cts-5.1_r28android-cts-5.1_r27android-cts-5.1_r26android-cts-5.1_r25android-cts-5.1_r24android-cts-5.1_r23android-cts-5.1_r22android-cts-5.1_r21android-cts-5.1_r20android-cts-5.1_r19android-cts-5.1_r18android-cts-5.1_r17android-cts-5.1_r16android-cts-5.1_r15android-cts-5.1_r14android-cts-5.1_r13android-5.1.1_r38lollipop-mr1-releaselollipop-mr1-cts-release
Sysconfig define a whitelist of permitted backup transports
Previously any apk bundled in priv-app could insert a backup transport.
Reduce risk surface by giving the OEM explicit control over who is
allowed to handle backup data.
Bug 28406080
Backport of 494df791728f4d42d67e935c327910975993ad29 from N
Change-Id: I405b49daee8c576584575c3e46877cc97632d8c6
-rw-r--r-- | services/backup/java/com/android/server/backup/BackupManagerService.java | 31 | ||||
-rw-r--r-- | services/core/java/com/android/server/SystemConfig.java | 26 |
2 files changed, 51 insertions, 6 deletions
diff --git a/services/backup/java/com/android/server/backup/BackupManagerService.java b/services/backup/java/com/android/server/backup/BackupManagerService.java index c1e4994ba15d..fa2cb76511b3 100644 --- a/services/backup/java/com/android/server/backup/BackupManagerService.java +++ b/services/backup/java/com/android/server/backup/BackupManagerService.java @@ -79,7 +79,9 @@ import android.os.storage.StorageManager; import android.provider.Settings; import android.system.ErrnoException; import android.system.Os; +import android.text.TextUtils; import android.util.ArrayMap; +import android.util.ArraySet; import android.util.AtomicFile; import android.util.EventLog; import android.util.Log; @@ -91,6 +93,7 @@ import com.android.internal.backup.IBackupTransport; import com.android.internal.backup.IObbBackupService; import com.android.server.AppWidgetBackupBridge; import com.android.server.EventLogTags; +import com.android.server.SystemConfig; import com.android.server.SystemService; import com.android.server.backup.PackageManagerBackupAgent.Metadata; @@ -310,6 +313,7 @@ public class BackupManagerService { volatile boolean mClearingData; // Transport bookkeeping + final ArraySet<ComponentName> mTransportWhitelist; final Intent mTransportServiceIntent = new Intent(SERVICE_ACTION_TRANSPORT_HOST); final ArrayMap<String,String> mTransportNames = new ArrayMap<String,String>(); // component name -> registration name @@ -1070,11 +1074,15 @@ public class BackupManagerService { // Set up our transport options and initialize the default transport // TODO: Don't create transports that we don't need to? - mCurrentTransport = Settings.Secure.getString(context.getContentResolver(), + SystemConfig systemConfig = SystemConfig.getInstance(); + mTransportWhitelist = systemConfig.getBackupTransportWhitelist(); + + String transport = Settings.Secure.getString(context.getContentResolver(), Settings.Secure.BACKUP_TRANSPORT); - if ("".equals(mCurrentTransport)) { - mCurrentTransport = null; + if (TextUtils.isEmpty(transport)) { + transport = null; } + mCurrentTransport = transport; if (DEBUG) Slog.v(TAG, "Starting with transport " + mCurrentTransport); // Find all transport hosts and bind to their services @@ -1085,11 +1093,11 @@ public class BackupManagerService { } if (hosts != null) { for (int i = 0; i < hosts.size(); i++) { - final ServiceInfo transport = hosts.get(i).serviceInfo; + final ServiceInfo transportService = hosts.get(i).serviceInfo; if (MORE_DEBUG) { - Slog.v(TAG, " " + transport.packageName + "/" + transport.name); + Slog.v(TAG, " " + transportService.packageName + "/" + transportService.name); } - tryBindTransport(transport); + tryBindTransport(transportService); } } @@ -1879,6 +1887,11 @@ public class BackupManagerService { // Actually bind; presumes that we have already validated the transport service boolean bindTransport(ServiceInfo transport) { ComponentName svcName = new ComponentName(transport.packageName, transport.name); + if (!mTransportWhitelist.contains(svcName)) { + Slog.w(TAG, "Proposed transport " + svcName + " not whitelisted; ignoring"); + return false; + } + if (DEBUG) { Slog.i(TAG, "Binding to transport host " + svcName); } @@ -9294,6 +9307,12 @@ if (MORE_DEBUG) Slog.v(TAG, " + got " + nRead + "; now wanting " + (size - soF + " (now = " + System.currentTimeMillis() + ')'); pw.println(" next scheduled: " + mNextBackupPass); + pw.println("Transport whitelist:"); + for (ComponentName transport : mTransportWhitelist) { + pw.print(" "); + pw.println(transport.flattenToShortString()); + } + pw.println("Available transports:"); final String[] transports = listAllTransports(); if (transports != null) { diff --git a/services/core/java/com/android/server/SystemConfig.java b/services/core/java/com/android/server/SystemConfig.java index 6ad128c982c4..7356d48c9230 100644 --- a/services/core/java/com/android/server/SystemConfig.java +++ b/services/core/java/com/android/server/SystemConfig.java @@ -17,6 +17,7 @@ package com.android.server; import android.app.ActivityManager; +import android.content.ComponentName; import android.content.pm.FeatureInfo; import android.os.*; import android.os.Process; @@ -88,6 +89,9 @@ public class SystemConfig { // These are the app package names that should not allow IME switching. final ArraySet<String> mFixedImeApps = new ArraySet<>(); + // These are the permitted backup transport service components + final ArraySet<ComponentName> mBackupTransportWhitelist = new ArraySet<>(); + public static SystemConfig getInstance() { synchronized (SystemConfig.class) { if (sInstance == null) { @@ -125,6 +129,10 @@ public class SystemConfig { return mFixedImeApps; } + public ArraySet<ComponentName> getBackupTransportWhitelist() { + return mBackupTransportWhitelist; + } + SystemConfig() { // Read configuration from system readPermissions(Environment.buildPath( @@ -341,6 +349,24 @@ public class SystemConfig { XmlUtils.skipCurrentTag(parser); continue; + } else if ("backup-transport-whitelisted-service".equals(name)) { + String serviceName = parser.getAttributeValue(null, "service"); + if (serviceName == null) { + Slog.w(TAG, "<backup-transport-whitelisted-service> without service in " + + permFile + " at " + parser.getPositionDescription()); + } else { + ComponentName cn = ComponentName.unflattenFromString(serviceName); + if (cn == null) { + Slog.w(TAG, + "<backup-transport-whitelisted-service> with invalid service name " + + serviceName + " in "+ permFile + + " at " + parser.getPositionDescription()); + } else { + mBackupTransportWhitelist.add(cn); + } + } + XmlUtils.skipCurrentTag(parser); + } else { XmlUtils.skipCurrentTag(parser); continue; |