drgreen/android_frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Unexport all PackageInstaller receivers

Browse Source 
All of PackageInstaller's declared receivers receive system broadcasts,
so they do not need to be exported. Leaving them exported opens up
vulnerabilities for apps to launch them and execute functionality that
PackageInstaller includes.

Bug: 191283525

Test: manual, verify receivers still work
Test: atest com.android.packageinstaller.test.ExportedComponentTest

Merged-In: I782fc21c848831a2a4aeab736cd47ad45781b290
Change-Id: I782fc21c848831a2a4aeab736cd47ad45781b290
(cherry picked from commit 0806568d4133e1dc736ebcc45f62655165366a9e)
This commit is contained in:
Winson 2021-07-08 12:07:08 -07:00 committed by Winson Chiu
parent 414288574a
commit fef9b3757c
6 changed files with 155 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
packages/PackageInstaller/AndroidManifest.xml
View File

@ -31,7 +31,7 @@
android:directBootAware="true">
<receiver android:name=".TemporaryFileManager"
android:exported="true">
android:exported="false">
<intent-filter>
<action android:name="android.intent.action.BOOT_COMPLETED" />
</intent-filter>
@ -76,7 +76,7 @@
<receiver android:name=".InstallEventReceiver"
android:permission="android.permission.INSTALL_PACKAGES"
android:exported="true">
android:exported="false">
<intent-filter android:priority="1">
<action android:name="com.android.packageinstaller.ACTION_INSTALL_COMMIT" />
</intent-filter>
@ -106,14 +106,14 @@
<receiver android:name=".UninstallEventReceiver"
android:permission="android.permission.INSTALL_PACKAGES"
android:exported="true">
android:exported="false">
<intent-filter android:priority="1">
<action android:name="com.android.packageinstaller.ACTION_UNINSTALL_COMMIT" />
</intent-filter>
</receiver>
<receiver android:name=".PackageInstalledReceiver"
android:exported="true">
android:exported="false">
<intent-filter android:priority="1">
<action android:name="android.intent.action.PACKAGE_ADDED" />
<data android:scheme="package" />

5
packages/PackageInstaller/TEST_MAPPING
View File

@ -19,6 +19,9 @@
},
{
"name": "CtsPackageUninstallTestCases"
},
{
"name": "PackageInstallerTests"
}
]
}
}

39
services/tests/PackageManager/packageinstaller/Android.bp Normal file
View File

@ -0,0 +1,39 @@
// Copyright (C) 2021 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package {
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "frameworks_base_license"
// to get the below license kinds:
// SPDX-license-identifier-Apache-2.0
default_applicable_licenses: ["frameworks_base_license"],
}
android_test {
name: "PackageInstallerTests",
srcs: [
"src/**/*.java",
"src/**/*.kt",
],
static_libs: [
"androidx.test.rules",
"androidx.test.runner",
"junit",
"kotlin-test",
"truth-prebuilt",
],
platform_apis: true,
test_suites: ["device-tests"],
}

29
services/tests/PackageManager/packageinstaller/AndroidManifest.xml Normal file
View File

@ -0,0 +1,29 @@
<?xml version="1.0" encoding="utf-8"?>
<!--
~ Copyright (C) 2021 The Android Open Source Project
~
~ Licensed under the Apache License, Version 2.0 (the "License");
~ you may not use this file except in compliance with the License.
~ You may obtain a copy of the License at
~
~ http://www.apache.org/licenses/LICENSE-2.0
~
~ Unless required by applicable law or agreed to in writing, software
~ distributed under the License is distributed on an "AS IS" BASIS,
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
~ See the License for the specific language governing permissions and
~ limitations under the License.
-->
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.android.packageinstaller.test">
<uses-permission android:name="android.permission.QUERY_ALL_PACKAGES"/>
<instrumentation
android:name="androidx.test.runner.AndroidJUnitRunner"
android:targetPackage="com.android.packageinstaller.test"
/>
</manifest>

29
services/tests/PackageManager/packageinstaller/AndroidTest.xml Normal file
View File

@ -0,0 +1,29 @@
<?xml version="1.0" encoding="utf-8"?>
<!--
~ Copyright (C) 2021 The Android Open Source Project
~
~ Licensed under the Apache License, Version 2.0 (the "License");
~ you may not use this file except in compliance with the License.
~ You may obtain a copy of the License at
~
~ http://www.apache.org/licenses/LICENSE-2.0
~
~ Unless required by applicable law or agreed to in writing, software
~ distributed under the License is distributed on an "AS IS" BASIS,
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
~ See the License for the specific language governing permissions and
~ limitations under the License.
-->
<configuration description="Test module config for PackageInstallerTests">
<option name="test-tag" value="PackageInstallerTests" />
<target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
<option name="cleanup-apks" value="true" />
<option name="test-file-name" value="PackageInstallerTests.apk" />
</target_preparer>
<test class="com.android.tradefed.testtype.AndroidJUnitTest">
<option name="package" value="com.android.packageinstaller.test" />
</test>
</configuration>

50
services/tests/PackageManager/packageinstaller/src/com/android/packageinstaller/test/ExportedComponentTest.kt Normal file
View File

@ -0,0 +1,50 @@
/*
* Copyright (C) 2021 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.android.packageinstaller.test
import android.content.Context
import android.content.Intent
import android.content.pm.PackageManager
import android.net.Uri
import androidx.test.InstrumentationRegistry
import com.google.common.truth.Truth.assertThat
import com.google.common.truth.Truth.assertWithMessage
import org.junit.Test
class ExportedComponentTest {
private val context: Context = InstrumentationRegistry.getContext()
@Test
fun verifyNoExportedReceivers() {
val intent = Intent(Intent.ACTION_INSTALL_PACKAGE).apply {
data = Uri.parse("content://mockForTest")
}
val packageInstallers = context.packageManager.queryIntentActivities(intent,
PackageManager.MATCH_DEFAULT_ONLY or PackageManager.MATCH_DISABLED_COMPONENTS)
.map { it.activityInfo.packageName }
.distinct()
.map { context.packageManager.getPackageInfo(it, PackageManager.GET_RECEIVERS) }
assertThat(packageInstallers).isNotEmpty()
packageInstallers.forEach {
val exported = it.receivers.filter { it.exported }
assertWithMessage("Receivers should not be exported").that(exported).isEmpty()
}
}
}