ServiceUtilities.cpp revision b2379ba0a32638bae2ea0460644f68cf5a0967ce
144deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten/* 244deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * Copyright (C) 2012 The Android Open Source Project 344deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * 444deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * Licensed under the Apache License, Version 2.0 (the "License"); 544deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * you may not use this file except in compliance with the License. 644deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * You may obtain a copy of the License at 744deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * 844deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * http://www.apache.org/licenses/LICENSE-2.0 944deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * 1044deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * Unless required by applicable law or agreed to in writing, software 1144deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * distributed under the License is distributed on an "AS IS" BASIS, 1244deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 1344deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * See the License for the specific language governing permissions and 1444deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten * limitations under the License. 1544deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten */ 1644deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten 17be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov#include <binder/AppOpsManager.h> 1844deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten#include <binder/IPCThreadState.h> 1944deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten#include <binder/IServiceManager.h> 2044deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten#include <binder/PermissionCache.h> 2140b26470dd29e44f1601ceb6e60948586a4d9f88Glenn Kasten#include <private/android_filesystem_config.h> 2244deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten#include "ServiceUtilities.h" 2344deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten 24be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov/* When performing permission checks we do not use permission cache for 25be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov * runtime permissions (protection level dangerous) as they may change at 26be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov * runtime. All other permissions (protection level normal and dangerous) 27be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov * can be cached as they never change. Of course all permission checked 28be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov * here are platform defined. 29be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov */ 30be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov 3144deb053252a3bd2f57a007ab9560f4924f62394Glenn Kastennamespace android { 3244deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten 33949a926cadbc961fbb649c91d76d7aee8ea4d7bdGlenn Kasten// Not valid until initialized by AudioFlinger constructor. It would have to be 34949a926cadbc961fbb649c91d76d7aee8ea4d7bdGlenn Kasten// re-initialized if the process containing AudioFlinger service forks (which it doesn't). 35dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen// This is often used to validate binder interface calls within audioserver 36dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen// (e.g. AudioPolicyManager to AudioFlinger). 37949a926cadbc961fbb649c91d76d7aee8ea4d7bdGlenn Kastenpid_t getpid_cached; 3844deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten 39dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen// A trusted calling UID may specify the client UID as part of a binder interface call. 40dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen// otherwise the calling UID must be equal to the client UID. 41dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissenbool isTrustedCallingUid(uid_t uid) { 42dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen switch (uid) { 43dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen case AID_MEDIA: 44dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen case AID_AUDIOSERVER: 45dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen return true; 46dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen default: 47dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen return false; 48dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen } 49dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen} 50be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov 51dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissenbool recordingAllowed(const String16& opPackageName, pid_t pid, uid_t uid) { 52dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen // we're always OK. 5344deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten if (getpid_cached == IPCThreadState::self()->getCallingPid()) return true; 54dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen 5544deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten static const String16 sRecordAudio("android.permission.RECORD_AUDIO"); 56be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov 57dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen // We specify a pid and uid here as mediaserver (aka MediaRecorder or StageFrightRecorder) 58dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen // may open a record track on behalf of a client. Note that pid may be a tid. 59be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov // IMPORTANT: Don't use PermissionCache - a runtime permission and may change. 60dcb346b7dc5b88c3e85db8a70bbd6a2fee8192b9Marco Nelissen const bool ok = checkPermission(sRecordAudio, pid, uid); 61be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov if (!ok) { 62be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov ALOGE("Request requires android.permission.RECORD_AUDIO"); 63be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov return false; 64be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov } 65be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov 66de07e3743ef9c3dfe45864bf941b918147126500Glenn Kasten // To permit command-line native tests 67de07e3743ef9c3dfe45864bf941b918147126500Glenn Kasten if (uid == AID_ROOT) return true; 68de07e3743ef9c3dfe45864bf941b918147126500Glenn Kasten 69be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov String16 checkedOpPackageName = opPackageName; 70be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov 71be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov // In some cases the calling code has no access to the package it runs under. 72be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov // For example, code using the wilhelm framework's OpenSL-ES APIs. In this 73be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov // case we will get the packages for the calling UID and pick the first one 74be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov // for attributing the app op. This will work correctly for runtime permissions 75be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov // as for legacy apps we will toggle the app op for all packages in the UID. 76be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov // The caveat is that the operation may be attributed to the wrong package and 77be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov // stats based on app ops may be slightly off. 78be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov if (checkedOpPackageName.size() <= 0) { 79be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov sp<IServiceManager> sm = defaultServiceManager(); 80be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov sp<IBinder> binder = sm->getService(String16("permission")); 81be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov if (binder == 0) { 82be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov ALOGE("Cannot get permission service"); 83be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov return false; 84be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov } 85be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov 86be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov sp<IPermissionController> permCtrl = interface_cast<IPermissionController>(binder); 87be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov Vector<String16> packages; 88be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov 89be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov permCtrl->getPackagesForUid(uid, packages); 90be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov 91be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov if (packages.isEmpty()) { 92be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov ALOGE("No packages for calling UID"); 93be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov return false; 94be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov } 95be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov checkedOpPackageName = packages[0]; 96be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov } 97be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov 98be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov AppOpsManager appOps; 99617575b17de9b22247eb59948f134939641bd1bdEric Laurent if (appOps.noteOp(AppOpsManager::OP_RECORD_AUDIO, uid, checkedOpPackageName) 100be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov != AppOpsManager::MODE_ALLOWED) { 101be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov ALOGE("Request denied by app op OP_RECORD_AUDIO"); 102be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov return false; 103be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov } 104be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov 105be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov return true; 10644deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten} 10744deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten 108b2379ba0a32638bae2ea0460644f68cf5a0967ceEric Laurentbool captureAudioOutputAllowed(pid_t pid, uid_t uid) { 109893a5642871114fca3b2a00c6ff8e5699ce3e3edJeff Brown if (getpid_cached == IPCThreadState::self()->getCallingPid()) return true; 110893a5642871114fca3b2a00c6ff8e5699ce3e3edJeff Brown static const String16 sCaptureAudioOutput("android.permission.CAPTURE_AUDIO_OUTPUT"); 111b2379ba0a32638bae2ea0460644f68cf5a0967ceEric Laurent bool ok = checkPermission(sCaptureAudioOutput, pid, uid); 112893a5642871114fca3b2a00c6ff8e5699ce3e3edJeff Brown if (!ok) ALOGE("Request requires android.permission.CAPTURE_AUDIO_OUTPUT"); 113893a5642871114fca3b2a00c6ff8e5699ce3e3edJeff Brown return ok; 114893a5642871114fca3b2a00c6ff8e5699ce3e3edJeff Brown} 115893a5642871114fca3b2a00c6ff8e5699ce3e3edJeff Brown 1169a54bc27876acd5d8be5b1fc3dc46701fe76fbb3Eric Laurentbool captureHotwordAllowed() { 1179a54bc27876acd5d8be5b1fc3dc46701fe76fbb3Eric Laurent static const String16 sCaptureHotwordAllowed("android.permission.CAPTURE_AUDIO_HOTWORD"); 118be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov // IMPORTANT: Use PermissionCache - not a runtime permission and may not change. 119be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov bool ok = PermissionCache::checkCallingPermission(sCaptureHotwordAllowed); 1209a54bc27876acd5d8be5b1fc3dc46701fe76fbb3Eric Laurent if (!ok) ALOGE("android.permission.CAPTURE_AUDIO_HOTWORD"); 1219a54bc27876acd5d8be5b1fc3dc46701fe76fbb3Eric Laurent return ok; 1229a54bc27876acd5d8be5b1fc3dc46701fe76fbb3Eric Laurent} 1239a54bc27876acd5d8be5b1fc3dc46701fe76fbb3Eric Laurent 12444deb053252a3bd2f57a007ab9560f4924f62394Glenn Kastenbool settingsAllowed() { 12544deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten if (getpid_cached == IPCThreadState::self()->getCallingPid()) return true; 12644deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten static const String16 sAudioSettings("android.permission.MODIFY_AUDIO_SETTINGS"); 127be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov // IMPORTANT: Use PermissionCache - not a runtime permission and may not change. 128be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov bool ok = PermissionCache::checkCallingPermission(sAudioSettings); 12944deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten if (!ok) ALOGE("Request requires android.permission.MODIFY_AUDIO_SETTINGS"); 13044deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten return ok; 13144deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten} 13244deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten 1335284ed53c14cd4d15bd793000ede7166d143e69aEric Laurentbool modifyAudioRoutingAllowed() { 1345284ed53c14cd4d15bd793000ede7166d143e69aEric Laurent static const String16 sModifyAudioRoutingAllowed("android.permission.MODIFY_AUDIO_ROUTING"); 135be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov // IMPORTANT: Use PermissionCache - not a runtime permission and may not change. 136be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov bool ok = PermissionCache::checkCallingPermission(sModifyAudioRoutingAllowed); 1375284ed53c14cd4d15bd793000ede7166d143e69aEric Laurent if (!ok) ALOGE("android.permission.MODIFY_AUDIO_ROUTING"); 1385284ed53c14cd4d15bd793000ede7166d143e69aEric Laurent return ok; 1395284ed53c14cd4d15bd793000ede7166d143e69aEric Laurent} 1405284ed53c14cd4d15bd793000ede7166d143e69aEric Laurent 14144deb053252a3bd2f57a007ab9560f4924f62394Glenn Kastenbool dumpAllowed() { 14244deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten // don't optimize for same pid, since mediaserver never dumps itself 14344deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten static const String16 sDump("android.permission.DUMP"); 144be71aa29a3c86d2e01cd17839d2a72ab09a1bce5Svet Ganov // IMPORTANT: Use PermissionCache - not a runtime permission and may not change. 14544deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten bool ok = PermissionCache::checkCallingPermission(sDump); 14644deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten // convention is for caller to dump an error message to fd instead of logging here 14744deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten //if (!ok) ALOGE("Request requires android.permission.DUMP"); 14844deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten return ok; 14944deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten} 15044deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten 15144deb053252a3bd2f57a007ab9560f4924f62394Glenn Kasten} // namespace android 152