/*
|
* Copyright (C) 2018 The Android Open Source Project
|
*
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
* you may not use this file except in compliance with the License.
|
* You may obtain a copy of the License at
|
*
|
* http://www.apache.org/licenses/LICENSE-2.0
|
*
|
* Unless required by applicable law or agreed to in writing, software
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
* See the License for the specific language governing permissions and
|
* limitations under the License.
|
*/
|
package com.android.internal.telephony;
|
|
import static android.content.pm.PackageManager.PERMISSION_GRANTED;
|
|
import android.Manifest;
|
import android.app.AppOpsManager;
|
import android.app.admin.DevicePolicyManager;
|
import android.content.Context;
|
import android.content.pm.ApplicationInfo;
|
import android.content.pm.PackageManager;
|
import android.os.Binder;
|
import android.os.Build;
|
import android.os.Process;
|
import android.os.RemoteException;
|
import android.os.ServiceManager;
|
import android.os.UserHandle;
|
import android.telephony.Rlog;
|
import android.telephony.SubscriptionManager;
|
import android.telephony.TelephonyManager;
|
import android.util.Log;
|
import android.util.StatsLog;
|
|
import com.android.internal.annotations.VisibleForTesting;
|
|
import java.util.HashMap;
|
import java.util.HashSet;
|
import java.util.Map;
|
import java.util.Set;
|
import java.util.function.Supplier;
|
|
/** Utility class for Telephony permission enforcement. */
|
public final class TelephonyPermissions {
|
private static final String LOG_TAG = "TelephonyPermissions";
|
|
private static final boolean DBG = false;
|
|
private static final Supplier<ITelephony> TELEPHONY_SUPPLIER = () ->
|
ITelephony.Stub.asInterface(ServiceManager.getService(Context.TELEPHONY_SERVICE));
|
|
/**
|
* Whether to disable the new device identifier access restrictions.
|
*/
|
private static final String PROPERTY_DEVICE_IDENTIFIER_ACCESS_RESTRICTIONS_DISABLED =
|
"device_identifier_access_restrictions_disabled";
|
|
// Contains a mapping of packages that did not meet the new requirements to access device
|
// identifiers and the methods they were attempting to invoke; used to prevent duplicate
|
// reporting of packages / methods.
|
private static final Map<String, Set<String>> sReportedDeviceIDPackages;
|
static {
|
sReportedDeviceIDPackages = new HashMap<>();
|
}
|
|
private TelephonyPermissions() {}
|
|
/**
|
* Check whether the caller (or self, if not processing an IPC) can read phone state.
|
*
|
* <p>This method behaves in one of the following ways:
|
* <ul>
|
* <li>return true: if the caller has the READ_PRIVILEGED_PHONE_STATE permission, the
|
* READ_PHONE_STATE runtime permission, or carrier privileges on the given subId.
|
* <li>throw SecurityException: if the caller didn't declare any of these permissions, or, for
|
* apps which support runtime permissions, if the caller does not currently have any of
|
* these permissions.
|
* <li>return false: if the caller lacks all of these permissions and doesn't support runtime
|
* permissions. This implies that the user revoked the ability to read phone state
|
* manually (via AppOps). In this case we can't throw as it would break app compatibility,
|
* so we return false to indicate that the calling function should return dummy data.
|
* </ul>
|
*
|
* <p>Note: for simplicity, this method always returns false for callers using legacy
|
* permissions and who have had READ_PHONE_STATE revoked, even if they are carrier-privileged.
|
* Such apps should migrate to runtime permissions or stop requiring READ_PHONE_STATE on P+
|
* devices.
|
*
|
* @param subId the subId of the relevant subscription; used to check carrier privileges. May be
|
* {@link SubscriptionManager#INVALID_SUBSCRIPTION_ID} to skip this check for cases
|
* where it isn't relevant (hidden APIs, or APIs which are otherwise okay to leave
|
* inaccesible to carrier-privileged apps).
|
*/
|
public static boolean checkCallingOrSelfReadPhoneState(
|
Context context, int subId, String callingPackage, String message) {
|
return checkReadPhoneState(context, subId, Binder.getCallingPid(), Binder.getCallingUid(),
|
callingPackage, message);
|
}
|
|
/** Identical to checkCallingOrSelfReadPhoneState but never throws SecurityException */
|
public static boolean checkCallingOrSelfReadPhoneStateNoThrow(
|
Context context, int subId, String callingPackage, String message) {
|
try {
|
return checkCallingOrSelfReadPhoneState(context, subId, callingPackage, message);
|
} catch (SecurityException se) {
|
return false;
|
}
|
}
|
|
/**
|
* Check whether the app with the given pid/uid can read phone state.
|
*
|
* <p>This method behaves in one of the following ways:
|
* <ul>
|
* <li>return true: if the caller has the READ_PRIVILEGED_PHONE_STATE permission, the
|
* READ_PHONE_STATE runtime permission, or carrier privileges on the given subId.
|
* <li>throw SecurityException: if the caller didn't declare any of these permissions, or, for
|
* apps which support runtime permissions, if the caller does not currently have any of
|
* these permissions.
|
* <li>return false: if the caller lacks all of these permissions and doesn't support runtime
|
* permissions. This implies that the user revoked the ability to read phone state
|
* manually (via AppOps). In this case we can't throw as it would break app compatibility,
|
* so we return false to indicate that the calling function should return dummy data.
|
* </ul>
|
*
|
* <p>Note: for simplicity, this method always returns false for callers using legacy
|
* permissions and who have had READ_PHONE_STATE revoked, even if they are carrier-privileged.
|
* Such apps should migrate to runtime permissions or stop requiring READ_PHONE_STATE on P+
|
* devices.
|
*/
|
public static boolean checkReadPhoneState(
|
Context context, int subId, int pid, int uid, String callingPackage, String message) {
|
return checkReadPhoneState(
|
context, TELEPHONY_SUPPLIER, subId, pid, uid, callingPackage, message);
|
}
|
|
/**
|
* Check whether the calling packages has carrier privileges for the passing subscription.
|
* @return {@code true} if the caller has carrier privileges, {@false} otherwise.
|
*/
|
public static boolean checkCarrierPrivilegeForSubId(int subId) {
|
if (SubscriptionManager.isValidSubscriptionId(subId)
|
&& getCarrierPrivilegeStatus(TELEPHONY_SUPPLIER, subId, Binder.getCallingUid())
|
== TelephonyManager.CARRIER_PRIVILEGE_STATUS_HAS_ACCESS) {
|
return true;
|
}
|
return false;
|
}
|
|
@VisibleForTesting
|
public static boolean checkReadPhoneState(
|
Context context, Supplier<ITelephony> telephonySupplier, int subId, int pid, int uid,
|
String callingPackage, String message) {
|
try {
|
context.enforcePermission(
|
android.Manifest.permission.READ_PRIVILEGED_PHONE_STATE, pid, uid, message);
|
|
// SKIP checking for run-time permission since caller has PRIVILEGED permission
|
return true;
|
} catch (SecurityException privilegedPhoneStateException) {
|
try {
|
context.enforcePermission(
|
android.Manifest.permission.READ_PHONE_STATE, pid, uid, message);
|
} catch (SecurityException phoneStateException) {
|
// If we don't have the runtime permission, but do have carrier privileges, that
|
// suffices for reading phone state.
|
if (SubscriptionManager.isValidSubscriptionId(subId)) {
|
enforceCarrierPrivilege(telephonySupplier, subId, uid, message);
|
return true;
|
}
|
throw phoneStateException;
|
}
|
}
|
|
// We have READ_PHONE_STATE permission, so return true as long as the AppOps bit hasn't been
|
// revoked.
|
AppOpsManager appOps = (AppOpsManager) context.getSystemService(Context.APP_OPS_SERVICE);
|
return appOps.noteOp(AppOpsManager.OP_READ_PHONE_STATE, uid, callingPackage)
|
== AppOpsManager.MODE_ALLOWED;
|
}
|
|
/**
|
* Check whether the app with the given pid/uid can read phone state, or has carrier
|
* privileges on any active subscription.
|
*
|
* <p>If the app does not have carrier privilege, this method will return {@code false} instead
|
* of throwing a SecurityException. Therefore, the callers cannot tell the difference
|
* between M+ apps which declare the runtime permission but do not have it, and pre-M apps
|
* which declare the static permission but had access revoked via AppOps. Apps in the former
|
* category expect SecurityExceptions; apps in the latter don't. So this method is suitable for
|
* use only if the behavior in both scenarios is meant to be identical.
|
*
|
* @return {@code true} if the app can read phone state or has carrier privilege;
|
* {@code false} otherwise.
|
*/
|
public static boolean checkReadPhoneStateOnAnyActiveSub(
|
Context context, int pid, int uid, String callingPackage, String message) {
|
return checkReadPhoneStateOnAnyActiveSub(context, TELEPHONY_SUPPLIER, pid, uid,
|
callingPackage, message);
|
}
|
|
@VisibleForTesting
|
public static boolean checkReadPhoneStateOnAnyActiveSub(
|
Context context, Supplier<ITelephony> telephonySupplier, int pid, int uid,
|
String callingPackage, String message) {
|
try {
|
context.enforcePermission(
|
android.Manifest.permission.READ_PRIVILEGED_PHONE_STATE, pid, uid, message);
|
|
// SKIP checking for run-time permission since caller has PRIVILEGED permission
|
return true;
|
} catch (SecurityException privilegedPhoneStateException) {
|
try {
|
context.enforcePermission(
|
android.Manifest.permission.READ_PHONE_STATE, pid, uid, message);
|
} catch (SecurityException phoneStateException) {
|
// If we don't have the runtime permission, but do have carrier privileges, that
|
// suffices for reading phone state.
|
return checkCarrierPrivilegeForAnySubId(context, telephonySupplier, uid);
|
}
|
}
|
|
// We have READ_PHONE_STATE permission, so return true as long as the AppOps bit hasn't been
|
// revoked.
|
AppOpsManager appOps = (AppOpsManager) context.getSystemService(Context.APP_OPS_SERVICE);
|
return appOps.noteOp(AppOpsManager.OP_READ_PHONE_STATE, uid, callingPackage) ==
|
AppOpsManager.MODE_ALLOWED;
|
}
|
|
/**
|
* Check whether the caller (or self, if not processing an IPC) can read device identifiers.
|
*
|
* <p>This method behaves in one of the following ways:
|
* <ul>
|
* <li>return true: if the caller has the READ_PRIVILEGED_PHONE_STATE permission, the calling
|
* package passes a DevicePolicyManager Device Owner / Profile Owner device identifier
|
* access check, or the calling package has carrier privileges.
|
* <li>throw SecurityException: if the caller does not meet any of the requirements and is
|
* targeting Q or is targeting pre-Q and does not have the READ_PHONE_STATE permission.
|
* <li>return false: if the caller is targeting pre-Q and does have the READ_PHONE_STATE
|
* permission. In this case the caller would expect to have access to the device
|
* identifiers so false is returned instead of throwing a SecurityException to indicate
|
* the calling function should return dummy data.
|
* </ul>
|
*/
|
public static boolean checkCallingOrSelfReadDeviceIdentifiers(Context context,
|
String callingPackage, String message) {
|
return checkCallingOrSelfReadDeviceIdentifiers(context,
|
SubscriptionManager.INVALID_SUBSCRIPTION_ID, callingPackage, message);
|
}
|
|
/**
|
* Check whether the caller (or self, if not processing an IPC) can read device identifiers.
|
*
|
* <p>This method behaves in one of the following ways:
|
* <ul>
|
* <li>return true: if the caller has the READ_PRIVILEGED_PHONE_STATE permission, the calling
|
* package passes a DevicePolicyManager Device Owner / Profile Owner device identifier
|
* access check, or the calling package has carrier privileges.
|
* <li>throw SecurityException: if the caller does not meet any of the requirements and is
|
* targeting Q or is targeting pre-Q and does not have the READ_PHONE_STATE permission
|
* or carrier privileges.
|
* <li>return false: if the caller is targeting pre-Q and does have the READ_PHONE_STATE
|
* permission or carrier privileges. In this case the caller would expect to have access
|
* to the device identifiers so false is returned instead of throwing a SecurityException
|
* to indicate the calling function should return dummy data.
|
* </ul>
|
*/
|
public static boolean checkCallingOrSelfReadDeviceIdentifiers(Context context, int subId,
|
String callingPackage, String message) {
|
return checkReadDeviceIdentifiers(context, TELEPHONY_SUPPLIER, subId,
|
Binder.getCallingPid(), Binder.getCallingUid(), callingPackage, message);
|
}
|
|
/**
|
* Check whether the caller (or self, if not processing an IPC) can read subscriber identifiers.
|
*
|
* <p>This method behaves in one of the following ways:
|
* <ul>
|
* <li>return true: if the caller has the READ_PRIVILEGED_PHONE_STATE permission, the calling
|
* package passes a DevicePolicyManager Device Owner / Profile Owner device identifier
|
* access check, or the calling package has carrier privileges.
|
* <li>throw SecurityException: if the caller does not meet any of the requirements and is
|
* targeting Q or is targeting pre-Q and does not have the READ_PHONE_STATE permission.
|
* <li>return false: if the caller is targeting pre-Q and does have the READ_PHONE_STATE
|
* permission. In this case the caller would expect to have access to the device
|
* identifiers so false is returned instead of throwing a SecurityException to indicate
|
* the calling function should return dummy data.
|
* </ul>
|
*/
|
public static boolean checkCallingOrSelfReadSubscriberIdentifiers(Context context, int subId,
|
String callingPackage, String message) {
|
return checkReadDeviceIdentifiers(context, TELEPHONY_SUPPLIER, subId,
|
Binder.getCallingPid(), Binder.getCallingUid(), callingPackage, message);
|
}
|
|
/**
|
* Checks whether the app with the given pid/uid can read device identifiers.
|
*
|
* @returns true if the caller has the READ_PRIVILEGED_PHONE_STATE permission or the calling
|
* package passes a DevicePolicyManager Device Owner / Profile Owner device identifier access
|
* check.
|
*/
|
@VisibleForTesting
|
public static boolean checkReadDeviceIdentifiers(Context context,
|
Supplier<ITelephony> telephonySupplier, int subId, int pid, int uid,
|
String callingPackage, String message) {
|
// Allow system and root access to the device identifiers.
|
final int appId = UserHandle.getAppId(uid);
|
if (appId == Process.SYSTEM_UID || appId == Process.ROOT_UID) {
|
return true;
|
}
|
// Allow access to packages that have the READ_PRIVILEGED_PHONE_STATE permission.
|
if (context.checkPermission(android.Manifest.permission.READ_PRIVILEGED_PHONE_STATE, pid,
|
uid) == PackageManager.PERMISSION_GRANTED) {
|
return true;
|
}
|
// If the calling package has carrier privileges for any subscription then allow access.
|
if (checkCarrierPrivilegeForAnySubId(context, telephonySupplier, uid)) {
|
return true;
|
}
|
// if the calling package is not null then perform the DevicePolicyManager device /
|
// profile owner and Appop checks.
|
if (callingPackage != null) {
|
// Allow access to an app that has been granted the READ_DEVICE_IDENTIFIERS app op.
|
long token = Binder.clearCallingIdentity();
|
AppOpsManager appOpsManager = (AppOpsManager) context.getSystemService(
|
Context.APP_OPS_SERVICE);
|
try {
|
if (appOpsManager.noteOpNoThrow(AppOpsManager.OPSTR_READ_DEVICE_IDENTIFIERS, uid,
|
callingPackage) == AppOpsManager.MODE_ALLOWED) {
|
return true;
|
}
|
} finally {
|
Binder.restoreCallingIdentity(token);
|
}
|
// Allow access to a device / profile owner app.
|
DevicePolicyManager devicePolicyManager =
|
(DevicePolicyManager) context.getSystemService(
|
Context.DEVICE_POLICY_SERVICE);
|
if (devicePolicyManager != null && devicePolicyManager.checkDeviceIdentifierAccess(
|
callingPackage, pid, uid)) {
|
return true;
|
}
|
}
|
return reportAccessDeniedToReadIdentifiers(context, subId, pid, uid, callingPackage,
|
message);
|
}
|
|
/**
|
* Reports a failure when the app with the given pid/uid cannot access the requested identifier.
|
*
|
* @returns false if the caller is targeting pre-Q and does have the READ_PHONE_STATE
|
* permission or carrier privileges.
|
* @throws SecurityException if the caller does not meet any of the requirements for the
|
* requested identifier and is targeting Q or is targeting pre-Q
|
* and does not have the READ_PHONE_STATE permission or carrier
|
* privileges.
|
*/
|
private static boolean reportAccessDeniedToReadIdentifiers(Context context, int subId, int pid,
|
int uid, String callingPackage, String message) {
|
boolean isPreinstalled = false;
|
boolean isPrivApp = false;
|
ApplicationInfo callingPackageInfo = null;
|
try {
|
callingPackageInfo = context.getPackageManager().getApplicationInfoAsUser(
|
callingPackage, 0, UserHandle.getUserId(uid));
|
if (callingPackageInfo != null) {
|
if (callingPackageInfo.isSystemApp()) {
|
isPreinstalled = true;
|
if (callingPackageInfo.isPrivilegedApp()) {
|
isPrivApp = true;
|
}
|
}
|
}
|
} catch (PackageManager.NameNotFoundException e) {
|
// If the application info for the calling package could not be found then assume the
|
// calling app is a non-preinstalled app to detect any issues with the check
|
Log.e(LOG_TAG, "Exception caught obtaining package info for package " + callingPackage,
|
e);
|
}
|
// The current package should only be reported in StatsLog if it has not previously been
|
// reported for the currently invoked device identifier method.
|
boolean packageReported = sReportedDeviceIDPackages.containsKey(callingPackage);
|
if (!packageReported || !sReportedDeviceIDPackages.get(callingPackage).contains(
|
message)) {
|
Set invokedMethods;
|
if (!packageReported) {
|
invokedMethods = new HashSet<String>();
|
sReportedDeviceIDPackages.put(callingPackage, invokedMethods);
|
} else {
|
invokedMethods = sReportedDeviceIDPackages.get(callingPackage);
|
}
|
invokedMethods.add(message);
|
StatsLog.write(StatsLog.DEVICE_IDENTIFIER_ACCESS_DENIED, callingPackage, message,
|
isPreinstalled, isPrivApp);
|
}
|
Log.w(LOG_TAG, "reportAccessDeniedToReadIdentifiers:" + callingPackage + ":" + message
|
+ ":isPreinstalled=" + isPreinstalled + ":isPrivApp=" + isPrivApp);
|
// if the target SDK is pre-Q then check if the calling package would have previously
|
// had access to device identifiers.
|
if (callingPackageInfo != null && (
|
callingPackageInfo.targetSdkVersion < Build.VERSION_CODES.Q)) {
|
if (context.checkPermission(
|
android.Manifest.permission.READ_PHONE_STATE,
|
pid,
|
uid) == PackageManager.PERMISSION_GRANTED) {
|
return false;
|
}
|
if (checkCarrierPrivilegeForSubId(subId)) {
|
return false;
|
}
|
}
|
throw new SecurityException(message + ": The user " + uid
|
+ " does not meet the requirements to access device identifiers.");
|
}
|
|
/**
|
* Check whether the app with the given pid/uid can read the call log.
|
* @return {@code true} if the specified app has the read call log permission and AppOpp granted
|
* to it, {@code false} otherwise.
|
*/
|
public static boolean checkReadCallLog(
|
Context context, int subId, int pid, int uid, String callingPackage) {
|
return checkReadCallLog(
|
context, TELEPHONY_SUPPLIER, subId, pid, uid, callingPackage);
|
}
|
|
@VisibleForTesting
|
public static boolean checkReadCallLog(
|
Context context, Supplier<ITelephony> telephonySupplier, int subId, int pid, int uid,
|
String callingPackage) {
|
|
if (context.checkPermission(Manifest.permission.READ_CALL_LOG, pid, uid)
|
!= PERMISSION_GRANTED) {
|
// If we don't have the runtime permission, but do have carrier privileges, that
|
// suffices for being able to see the call phone numbers.
|
if (SubscriptionManager.isValidSubscriptionId(subId)) {
|
enforceCarrierPrivilege(telephonySupplier, subId, uid, "readCallLog");
|
return true;
|
}
|
return false;
|
}
|
|
// We have READ_CALL_LOG permission, so return true as long as the AppOps bit hasn't been
|
// revoked.
|
AppOpsManager appOps = (AppOpsManager) context.getSystemService(Context.APP_OPS_SERVICE);
|
return appOps.noteOp(AppOpsManager.OP_READ_CALL_LOG, uid, callingPackage) ==
|
AppOpsManager.MODE_ALLOWED;
|
}
|
|
/**
|
* Returns whether the caller can read phone numbers.
|
*
|
* <p>Besides apps with the ability to read phone state per {@link #checkReadPhoneState}, the
|
* default SMS app and apps with READ_SMS or READ_PHONE_NUMBERS can also read phone numbers.
|
*/
|
public static boolean checkCallingOrSelfReadPhoneNumber(
|
Context context, int subId, String callingPackage, String message) {
|
return checkReadPhoneNumber(
|
context, TELEPHONY_SUPPLIER, subId, Binder.getCallingPid(), Binder.getCallingUid(),
|
callingPackage, message);
|
}
|
|
@VisibleForTesting
|
public static boolean checkReadPhoneNumber(
|
Context context, Supplier<ITelephony> telephonySupplier, int subId, int pid, int uid,
|
String callingPackage, String message) {
|
// Default SMS app can always read it.
|
AppOpsManager appOps = (AppOpsManager) context.getSystemService(Context.APP_OPS_SERVICE);
|
if (appOps.noteOp(AppOpsManager.OP_WRITE_SMS, uid, callingPackage) ==
|
AppOpsManager.MODE_ALLOWED) {
|
return true;
|
}
|
|
// NOTE(b/73308711): If an app has one of the following AppOps bits explicitly revoked, they
|
// will be denied access, even if they have another permission and AppOps bit if needed.
|
|
// First, check if we can read the phone state.
|
try {
|
return checkReadPhoneState(
|
context, telephonySupplier, subId, pid, uid, callingPackage, message);
|
} catch (SecurityException readPhoneStateSecurityException) {
|
}
|
// Can be read with READ_SMS too.
|
try {
|
context.enforcePermission(android.Manifest.permission.READ_SMS, pid, uid, message);
|
int opCode = AppOpsManager.permissionToOpCode(android.Manifest.permission.READ_SMS);
|
if (opCode != AppOpsManager.OP_NONE) {
|
return appOps.noteOp(opCode, uid, callingPackage) == AppOpsManager.MODE_ALLOWED;
|
} else {
|
return true;
|
}
|
} catch (SecurityException readSmsSecurityException) {
|
}
|
// Can be read with READ_PHONE_NUMBERS too.
|
try {
|
context.enforcePermission(android.Manifest.permission.READ_PHONE_NUMBERS, pid, uid,
|
message);
|
int opCode = AppOpsManager.permissionToOpCode(
|
android.Manifest.permission.READ_PHONE_NUMBERS);
|
if (opCode != AppOpsManager.OP_NONE) {
|
return appOps.noteOp(opCode, uid, callingPackage) == AppOpsManager.MODE_ALLOWED;
|
} else {
|
return true;
|
}
|
} catch (SecurityException readPhoneNumberSecurityException) {
|
}
|
|
throw new SecurityException(message + ": Neither user " + uid +
|
" nor current process has " + android.Manifest.permission.READ_PHONE_STATE +
|
", " + android.Manifest.permission.READ_SMS + ", or " +
|
android.Manifest.permission.READ_PHONE_NUMBERS);
|
}
|
|
/**
|
* Ensure the caller (or self, if not processing an IPC) has MODIFY_PHONE_STATE (and is thus a
|
* privileged app) or carrier privileges.
|
*
|
* @throws SecurityException if the caller does not have the required permission/privileges
|
*/
|
public static void enforceCallingOrSelfModifyPermissionOrCarrierPrivilege(
|
Context context, int subId, String message) {
|
if (context.checkCallingOrSelfPermission(android.Manifest.permission.MODIFY_PHONE_STATE) ==
|
PERMISSION_GRANTED) {
|
return;
|
}
|
|
if (DBG) Rlog.d(LOG_TAG, "No modify permission, check carrier privilege next.");
|
enforceCallingOrSelfCarrierPrivilege(subId, message);
|
}
|
|
/**
|
* Ensure the caller (or self, if not processing an IPC) has
|
* {@link android.Manifest.permission#READ_PHONE_STATE} or carrier privileges.
|
*
|
* @throws SecurityException if the caller does not have the required permission/privileges
|
*/
|
public static void enforeceCallingOrSelfReadPhoneStatePermissionOrCarrierPrivilege(
|
Context context, int subId, String message) {
|
if (context.checkCallingOrSelfPermission(android.Manifest.permission.READ_PHONE_STATE)
|
== PERMISSION_GRANTED) {
|
return;
|
}
|
|
if (DBG) {
|
Rlog.d(LOG_TAG, "No READ_PHONE_STATE permission, check carrier privilege next.");
|
}
|
|
enforceCallingOrSelfCarrierPrivilege(subId, message);
|
}
|
|
/**
|
* Ensure the caller (or self, if not processing an IPC) has
|
* {@link android.Manifest.permission#READ_PRIVILEGED_PHONE_STATE} or carrier privileges.
|
*
|
* @throws SecurityException if the caller does not have the required permission/privileges
|
*/
|
public static void enforeceCallingOrSelfReadPrivilegedPhoneStatePermissionOrCarrierPrivilege(
|
Context context, int subId, String message) {
|
if (context.checkCallingOrSelfPermission(Manifest.permission.READ_PRIVILEGED_PHONE_STATE)
|
== PERMISSION_GRANTED) {
|
return;
|
}
|
|
if (DBG) {
|
Rlog.d(LOG_TAG, "No READ_PRIVILEDED_PHONE_STATE permission, " +
|
"check carrier privilege next.");
|
}
|
|
enforceCallingOrSelfCarrierPrivilege(subId, message);
|
}
|
|
/**
|
* Make sure the caller (or self, if not processing an IPC) has carrier privileges.
|
*
|
* @throws SecurityException if the caller does not have the required privileges
|
*/
|
public static void enforceCallingOrSelfCarrierPrivilege(int subId, String message) {
|
// NOTE: It's critical that we explicitly pass the calling UID here rather than call
|
// TelephonyManager#hasCarrierPrivileges directly, as the latter only works when called from
|
// the phone process. When called from another process, it will check whether that process
|
// has carrier privileges instead.
|
enforceCarrierPrivilege(subId, Binder.getCallingUid(), message);
|
}
|
|
private static void enforceCarrierPrivilege(int subId, int uid, String message) {
|
enforceCarrierPrivilege(TELEPHONY_SUPPLIER, subId, uid, message);
|
}
|
|
private static void enforceCarrierPrivilege(
|
Supplier<ITelephony> telephonySupplier, int subId, int uid, String message) {
|
if (getCarrierPrivilegeStatus(telephonySupplier, subId, uid) !=
|
TelephonyManager.CARRIER_PRIVILEGE_STATUS_HAS_ACCESS) {
|
if (DBG) Rlog.e(LOG_TAG, "No Carrier Privilege.");
|
throw new SecurityException(message);
|
}
|
}
|
|
/**
|
* Returns whether the provided uid has carrier privileges for any active subscription ID.
|
*/
|
private static boolean checkCarrierPrivilegeForAnySubId(Context context,
|
Supplier<ITelephony> telephonySupplier, int uid) {
|
SubscriptionManager sm = (SubscriptionManager) context.getSystemService(
|
Context.TELEPHONY_SUBSCRIPTION_SERVICE);
|
int[] activeSubIds = sm.getActiveSubscriptionIdList();
|
if (activeSubIds != null) {
|
for (int activeSubId : activeSubIds) {
|
if (getCarrierPrivilegeStatus(telephonySupplier, activeSubId, uid)
|
== TelephonyManager.CARRIER_PRIVILEGE_STATUS_HAS_ACCESS) {
|
return true;
|
}
|
}
|
}
|
return false;
|
}
|
|
|
private static int getCarrierPrivilegeStatus(
|
Supplier<ITelephony> telephonySupplier, int subId, int uid) {
|
ITelephony telephony = telephonySupplier.get();
|
try {
|
if (telephony != null) {
|
return telephony.getCarrierPrivilegeStatusForUid(subId, uid);
|
}
|
} catch (RemoteException e) {
|
// Fallback below.
|
}
|
Rlog.e(LOG_TAG, "Phone process is down, cannot check carrier privileges");
|
return TelephonyManager.CARRIER_PRIVILEGE_STATUS_NO_ACCESS;
|
}
|
|
/**
|
* Throws if the caller is not of a shell (or root) UID.
|
*
|
* @param callingUid pass Binder.callingUid().
|
*/
|
public static void enforceShellOnly(int callingUid, String message) {
|
if (callingUid == Process.SHELL_UID || callingUid == Process.ROOT_UID) {
|
return; // okay
|
}
|
|
throw new SecurityException(message + ": Only shell user can call it");
|
}
|
}
|
