commit 5663b6e934dfda3d4c36b82c444c98a6848a5191
author Jeff Sharkey <jsharkey@android.com> Thu Sep 06 17:54:29 2012 -0700
committer Jeff Sharkey <jsharkey@android.com> Thu Sep 06 17:59:14 2012 -0700
tree d7859bfa368b6f8c4cde60db84ea7f54c5f1fd30
parent 43fb9baa6c6c65ff13b9a406a57bea1293b99e46

Restrict lockdown and firewall to AID_SYSTEM.

Bug: 7076289
Change-Id: Iafa3054335e8b1c3c8c3b8db2a4191d4ed4c8c41

services/java/com/android/server/ConnectivityService.java

diff --git a/services/java/com/android/server/ConnectivityService.java b/services/java/com/android/server/ConnectivityService.java
index cbbfda1..3a338a9 100644
--- a/services/java/com/android/server/ConnectivityService.java
+++ b/services/java/com/android/server/ConnectivityService.java
@@ -77,6 +77,7 @@
 import android.os.Message;
 import android.os.ParcelFileDescriptor;
 import android.os.PowerManager;
+import android.os.Process;
 import android.os.RemoteException;
 import android.os.ServiceManager;
 import android.os.SystemClock;
@@ -3370,7 +3371,7 @@
 
     @Override
     public boolean updateLockdownVpn() {
-        mContext.enforceCallingOrSelfPermission(CONNECTIVITY_INTERNAL, TAG);
+        enforceSystemUid();
 
         // Tear down existing lockdown if profile was removed
         mLockdownEnabled = LockdownVpnTracker.isEnabled();
@@ -3421,4 +3422,11 @@
             throw new IllegalStateException("Unavailable in lockdown mode");
         }
     }
+
+    private static void enforceSystemUid() {
+        final int uid = Binder.getCallingUid();
+        if (uid != Process.SYSTEM_UID) {
+            throw new SecurityException("Only available to AID_SYSTEM");
+        }
+    }
 }