Merge "Make NETWORK_SETTINGS trump CHANGE_WIFI_STATE" into pi-dev

2 files changed, 76 insertions, 5 deletions

diff --git a/service/java/com/android/server/wifi/WifiServiceImpl.java b/service/java/com/android/server/wifi/WifiServiceImpl.java
index 5d4df7df5..1a5e0e27d 100644
--- a/service/java/com/android/server/wifi/WifiServiceImpl.java
+++ b/service/java/com/android/server/wifi/WifiServiceImpl.java
@@ -725,6 +725,9 @@ public class WifiServiceImpl extends IWifiManager.Stub {
      */
     @CheckResult
     private int enforceChangePermission(String callingPackage) {
+        if (checkNetworkSettingsPermission(Binder.getCallingPid(), Binder.getCallingUid())) {
+            return MODE_ALLOWED;
+        }
         mContext.enforceCallingOrSelfPermission(android.Manifest.permission.CHANGE_WIFI_STATE,
                 "WifiService");
 
diff --git a/tests/wifitests/src/com/android/server/wifi/WifiServiceImplTest.java b/tests/wifitests/src/com/android/server/wifi/WifiServiceImplTest.java
index 996363916..136d029d3 100644
--- a/tests/wifitests/src/com/android/server/wifi/WifiServiceImplTest.java
+++ b/tests/wifitests/src/com/android/server/wifi/WifiServiceImplTest.java
@@ -309,6 +309,8 @@ public class WifiServiceImplTest {
         // Create an OSU provider that can be provisioned via an open OSU AP
         mOsuProvider = PasspointProvisioningTestUtil.generateOsuProvider(true);
         when(mContext.getOpPackageName()).thenReturn(TEST_PACKAGE_NAME);
+        when(mContext.checkPermission(eq(android.Manifest.permission.NETWORK_SETTINGS),
+                anyInt(), anyInt())).thenReturn(PackageManager.PERMISSION_DENIED);
 
         ArgumentCaptor<SoftApCallback> softApCallbackCaptor =
                 ArgumentCaptor.forClass(SoftApCallback.class);
@@ -400,26 +402,36 @@ public class WifiServiceImplTest {
      * Verify a SecurityException is thrown if a caller does not have the correct permission to
      * toggle wifi.
      */
-    @Test(expected = SecurityException.class)
+    @Test
     public void testSetWifiEnableWithoutPermission() throws Exception {
         doThrow(new SecurityException()).when(mContext)
                 .enforceCallingOrSelfPermission(eq(android.Manifest.permission.CHANGE_WIFI_STATE),
                                                 eq("WifiService"));
         when(mSettingsStore.isAirplaneModeOn()).thenReturn(false);
-        mWifiServiceImpl.setWifiEnabled(TEST_PACKAGE_NAME, true);
+        try {
+            mWifiServiceImpl.setWifiEnabled(TEST_PACKAGE_NAME, true);
+            fail();
+        } catch (SecurityException e) {
+
+        }
+
     }
 
     /**
      * Verify a SecurityException is thrown if OPSTR_CHANGE_WIFI_STATE is disabled for the app.
      */
-    @Test(expected = SecurityException.class)
+    @Test
     public void testSetWifiEnableAppOpsRejected() throws Exception {
         when(mSettingsStore.handleWifiToggled(eq(true))).thenReturn(true);
         doThrow(new SecurityException()).when(mAppOpsManager)
                 .noteOp(AppOpsManager.OPSTR_CHANGE_WIFI_STATE, Process.myUid(), TEST_PACKAGE_NAME);
-
         when(mSettingsStore.isAirplaneModeOn()).thenReturn(false);
-        mWifiServiceImpl.setWifiEnabled(TEST_PACKAGE_NAME, true);
+        try {
+            mWifiServiceImpl.setWifiEnabled(TEST_PACKAGE_NAME, true);
+            fail();
+        } catch (SecurityException e) {
+
+        }
         verify(mWifiController, never()).sendMessage(eq(CMD_WIFI_TOGGLED));
     }
 
@@ -2534,6 +2546,55 @@ public class WifiServiceImplTest {
         verify(mScanRequestProxy).startScan(Process.myUid(), SCAN_PACKAGE_NAME);
     }
 
+    /**
+     * Verify that if the caller has NETWORK_SETTINGS permission, then it doesn't need
+     * CHANGE_WIFI_STATE permission.
+     * @throws Exception
+     */
+    @Test
+    public void testDisconnectWithNetworkSettingsPerm() throws Exception {
+        when(mContext.checkPermission(eq(android.Manifest.permission.NETWORK_SETTINGS),
+                anyInt(), anyInt())).thenReturn(PackageManager.PERMISSION_GRANTED);
+        doThrow(new SecurityException()).when(mContext).enforceCallingOrSelfPermission(
+                android.Manifest.permission.CHANGE_WIFI_STATE, "WifiService");
+        doThrow(new SecurityException()).when(mAppOpsManager)
+                .noteOp(AppOpsManager.OPSTR_CHANGE_WIFI_STATE, Process.myUid(), TEST_PACKAGE_NAME);
+        mWifiServiceImpl.disconnect(TEST_PACKAGE_NAME);
+        verify(mWifiStateMachine).disconnectCommand();
+    }
+
+    /**
+     * Verify that if the caller doesn't have NETWORK_SETTINGS permission, it could still
+     * get access with the CHANGE_WIFI_STATE permission.
+     * @throws Exception
+     */
+    @Test
+    public void testDisconnectWithChangeWifiStatePerm() throws Exception {
+        mWifiServiceImpl.disconnect(TEST_PACKAGE_NAME);
+        verifyCheckChangePermission(TEST_PACKAGE_NAME);
+        verify(mWifiStateMachine).disconnectCommand();
+    }
+
+    /**
+     * Verify that the operation fails if the caller has neither NETWORK_SETTINGS or
+     * CHANGE_WIFI_STATE permissions.
+     * @throws Exception
+     */
+    @Test
+    public void testDisconnectRejected() throws Exception {
+        doThrow(new SecurityException()).when(mAppOpsManager)
+                .noteOp(AppOpsManager.OPSTR_CHANGE_WIFI_STATE, Process.myUid(), TEST_PACKAGE_NAME);
+        try {
+            mWifiServiceImpl.disconnect(TEST_PACKAGE_NAME);
+            fail();
+        } catch (SecurityException e) {
+
+        }
+        verifyCheckChangePermission(TEST_PACKAGE_NAME);
+        verify(mWifiStateMachine, never()).disconnectCommand();
+    }
+
+
     private class IdleModeIntentMatcher implements ArgumentMatcher<IntentFilter> {
         @Override
         public boolean matches(IntentFilter filter) {
@@ -2541,7 +2602,14 @@ public class WifiServiceImplTest {
         }
     }
 
+    /**
+     * Verifies that enforceChangePermission(String package) is called and the caller doesn't
+     * have NETWORK_SETTINGS permission
+     */
     private void verifyCheckChangePermission(String callingPackageName) {
+        verify(mContext, atLeastOnce())
+                .checkPermission(eq(android.Manifest.permission.NETWORK_SETTINGS),
+                        anyInt(), anyInt());
         verify(mContext, atLeastOnce()).enforceCallingOrSelfPermission(
                 android.Manifest.permission.CHANGE_WIFI_STATE, "WifiService");
         verify(mAppOpsManager, atLeastOnce()).noteOp(