144deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten/*
244deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * Copyright (C) 2012 The Android Open Source Project
344deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten *
444deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * Licensed under the Apache License, Version 2.0 (the "License");
544deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * you may not use this file except in compliance with the License.
644deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * You may obtain a copy of the License at
744deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten *
844deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten *      http://www.apache.org/licenses/LICENSE-2.0
944deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten *
1044deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * Unless required by applicable law or agreed to in writing, software
1144deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * distributed under the License is distributed on an "AS IS" BASIS,
1244deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
1344deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * See the License for the specific language governing permissions and
1444deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * limitations under the License.
1544deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten */
1644deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten
17be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov#include <binder/AppOpsManager.h>
1844deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten#include <binder/IPCThreadState.h>
1944deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten#include <binder/IServiceManager.h>
2044deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten#include <binder/PermissionCache.h>
2140b26470dd29e44f1601ceb6e60948586a4d9f88Glenn Kasten#include <private/android_filesystem_config.h>
2244deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten#include "ServiceUtilities.h"
2344deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten
24be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov/* When performing permission checks we do not use permission cache for
25be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov * runtime permissions (protection level dangerous) as they may change at
26be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov * runtime. All other permissions (protection level normal and dangerous)
27be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov * can be cached as they never change. Of course all permission checked
28be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov * here are platform defined.
29be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov */
30be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov
3144deb053252a3bd2f57a007ab9560f4924f62394Glenn Kastennamespace android {
3244deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten
33949a926cadbc961fbb649c91d76d7aee8ea4d7bdGlenn Kasten// Not valid until initialized by AudioFlinger constructor.  It would have to be
34949a926cadbc961fbb649c91d76d7aee8ea4d7bdGlenn Kasten// re-initialized if the process containing AudioFlinger service forks (which it doesn't).
35dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen// This is often used to validate binder interface calls within audioserver
36dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen// (e.g. AudioPolicyManager to AudioFlinger).
37949a926cadbc961fbb649c91d76d7aee8ea4d7bdGlenn Kastenpid_t getpid_cached;
3844deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten
39dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen// A trusted calling UID may specify the client UID as part of a binder interface call.
40dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen// otherwise the calling UID must be equal to the client UID.
41dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissenbool isTrustedCallingUid(uid_t uid) {
42dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen    switch (uid) {
43dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen    case AID_MEDIA:
44dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen    case AID_AUDIOSERVER:
45dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen        return true;
46dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen    default:
47dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen        return false;
48dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen    }
49dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen}
50be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov
51dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissenbool recordingAllowed(const String16& opPackageName, pid_t pid, uid_t uid) {
52dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen    // we're always OK.
5344deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten    if (getpid_cached == IPCThreadState::self()->getCallingPid()) return true;
54dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen
5544deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten    static const String16 sRecordAudio("android.permission.RECORD_AUDIO");
56be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov
57dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen    // We specify a pid and uid here as mediaserver (aka MediaRecorder or StageFrightRecorder)
58dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen    // may open a record track on behalf of a client.  Note that pid may be a tid.
59be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    // IMPORTANT: Don't use PermissionCache - a runtime permission and may change.
60dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen    const bool ok = checkPermission(sRecordAudio, pid, uid);
61be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    if (!ok) {
62be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov        ALOGE("Request requires android.permission.RECORD_AUDIO");
63be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov        return false;
64be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    }
65be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov
66de07e3743ef9c3dfe45864bf941b918147126500Glenn Kasten    // To permit command-line native tests
67de07e3743ef9c3dfe45864bf941b918147126500Glenn Kasten    if (uid == AID_ROOT) return true;
68de07e3743ef9c3dfe45864bf941b918147126500Glenn Kasten
69be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    String16 checkedOpPackageName = opPackageName;
70be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov
71be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    // In some cases the calling code has no access to the package it runs under.
72be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    // For example, code using the wilhelm framework's OpenSL-ES APIs. In this
73be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    // case we will get the packages for the calling UID and pick the first one
74be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    // for attributing the app op. This will work correctly for runtime permissions
75be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    // as for legacy apps we will toggle the app op for all packages in the UID.
76be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    // The caveat is that the operation may be attributed to the wrong package and
77be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    // stats based on app ops may be slightly off.
78be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    if (checkedOpPackageName.size() <= 0) {
79be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov        sp<IServiceManager> sm = defaultServiceManager();
80be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov        sp<IBinder> binder = sm->getService(String16("permission"));
81be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov        if (binder == 0) {
82be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov            ALOGE("Cannot get permission service");
83be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov            return false;
84be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov        }
85be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov
86be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov        sp<IPermissionController> permCtrl = interface_cast<IPermissionController>(binder);
87be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov        Vector<String16> packages;
88be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov
89be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov        permCtrl->getPackagesForUid(uid, packages);
90be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov
91be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov        if (packages.isEmpty()) {
92be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov            ALOGE("No packages for calling UID");
93be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov            return false;
94be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov        }
95be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov        checkedOpPackageName = packages[0];
96be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    }
97be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov
98be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    AppOpsManager appOps;
99617575b17de9b22247eb59948f134939641bd1bdEric Laurent    if (appOps.noteOp(AppOpsManager::OP_RECORD_AUDIO, uid, checkedOpPackageName)
100be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov            != AppOpsManager::MODE_ALLOWED) {
101be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov        ALOGE("Request denied by app op OP_RECORD_AUDIO");
102be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov        return false;
103be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    }
104be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov
105be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    return true;
10644deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten}
10744deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten
108b2379ba0a32638bae2ea0460644f68cf5a0967ceEric Laurentbool captureAudioOutputAllowed(pid_t pid, uid_t uid) {
109893a5642871114fca3b2a00c6ff8e5699ce3e3edJeff Brown    if (getpid_cached == IPCThreadState::self()->getCallingPid()) return true;
110893a5642871114fca3b2a00c6ff8e5699ce3e3edJeff Brown    static const String16 sCaptureAudioOutput("android.permission.CAPTURE_AUDIO_OUTPUT");
111b2379ba0a32638bae2ea0460644f68cf5a0967ceEric Laurent    bool ok = checkPermission(sCaptureAudioOutput, pid, uid);
112893a5642871114fca3b2a00c6ff8e5699ce3e3edJeff Brown    if (!ok) ALOGE("Request requires android.permission.CAPTURE_AUDIO_OUTPUT");
113893a5642871114fca3b2a00c6ff8e5699ce3e3edJeff Brown    return ok;
114893a5642871114fca3b2a00c6ff8e5699ce3e3edJeff Brown}
115893a5642871114fca3b2a00c6ff8e5699ce3e3edJeff Brown
1169a54bc27876acd5d8be5b1fc3dc46701fe76fbb3Eric Laurentbool captureHotwordAllowed() {
1179a54bc27876acd5d8be5b1fc3dc46701fe76fbb3Eric Laurent    static const String16 sCaptureHotwordAllowed("android.permission.CAPTURE_AUDIO_HOTWORD");
118be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    // IMPORTANT: Use PermissionCache - not a runtime permission and may not change.
119be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    bool ok = PermissionCache::checkCallingPermission(sCaptureHotwordAllowed);
1209a54bc27876acd5d8be5b1fc3dc46701fe76fbb3Eric Laurent    if (!ok) ALOGE("android.permission.CAPTURE_AUDIO_HOTWORD");
1219a54bc27876acd5d8be5b1fc3dc46701fe76fbb3Eric Laurent    return ok;
1229a54bc27876acd5d8be5b1fc3dc46701fe76fbb3Eric Laurent}
1239a54bc27876acd5d8be5b1fc3dc46701fe76fbb3Eric Laurent
12444deb053252a3bd2f57a007ab9560f4924f62394Glenn Kastenbool settingsAllowed() {
12544deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten    if (getpid_cached == IPCThreadState::self()->getCallingPid()) return true;
12644deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten    static const String16 sAudioSettings("android.permission.MODIFY_AUDIO_SETTINGS");
127be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    // IMPORTANT: Use PermissionCache - not a runtime permission and may not change.
128be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    bool ok = PermissionCache::checkCallingPermission(sAudioSettings);
12944deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten    if (!ok) ALOGE("Request requires android.permission.MODIFY_AUDIO_SETTINGS");
13044deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten    return ok;
13144deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten}
13244deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten
1335284ed53c14cd4d15bd793000ede7166d143e69aEric Laurentbool modifyAudioRoutingAllowed() {
1345284ed53c14cd4d15bd793000ede7166d143e69aEric Laurent    static const String16 sModifyAudioRoutingAllowed("android.permission.MODIFY_AUDIO_ROUTING");
135be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    // IMPORTANT: Use PermissionCache - not a runtime permission and may not change.
136be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    bool ok = PermissionCache::checkCallingPermission(sModifyAudioRoutingAllowed);
1375284ed53c14cd4d15bd793000ede7166d143e69aEric Laurent    if (!ok) ALOGE("android.permission.MODIFY_AUDIO_ROUTING");
1385284ed53c14cd4d15bd793000ede7166d143e69aEric Laurent    return ok;
1395284ed53c14cd4d15bd793000ede7166d143e69aEric Laurent}
1405284ed53c14cd4d15bd793000ede7166d143e69aEric Laurent
14144deb053252a3bd2f57a007ab9560f4924f62394Glenn Kastenbool dumpAllowed() {
14244deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten    // don't optimize for same pid, since mediaserver never dumps itself
14344deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten    static const String16 sDump("android.permission.DUMP");
144be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov    // IMPORTANT: Use PermissionCache - not a runtime permission and may not change.
14544deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten    bool ok = PermissionCache::checkCallingPermission(sDump);
14644deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten    // convention is for caller to dump an error message to fd instead of logging here
14744deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten    //if (!ok) ALOGE("Request requires android.permission.DUMP");
14844deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten    return ok;
14944deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten}
15044deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten
15144deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten} // namespace android
152