Access Control Patterns in Android Open Source Project

Access Control Patterns in AOSP

1. Access Control Patterns in AOSP Paul Ratazzi July-September 2015

2. Access Control Pattern Code or data structures that assign powers to subjects or adjudicate subjects’ requests for access to objects.

3. Purposes Gain insight into security architecture Learn ‘proper’ way of adding new features, services, etc. Identify problems, missing controls Find better/best way to fix problems, improve Quickly evaluate vendor customizations or new features Predict where controls should be

4. Breakdown Access control involves Subject Object Decision Look for places where: Subjects are identified Decisions are made Grant/deny results are returned

5. Subject Identification Binder.getCallingUid () Many derivatives, e.g. getCallingUserId () Binder.getCallingPid () GID (method TBD) GID-controlled resources such as BT, Internet, etc. Package name (method TBD)

6. Decision Making and Result Return Use of checkPermission () and related methods to verify manifest permissions Compare current user to calling user DESCRIPTOR check across proxy-stub interface (Parcel class) Permission bypass for system (1000) and root (0) uid s System-only (calling uid == 1000) protected actions Calling app vs. package name check SELinux checks (kernel)

7. Code Example: Permission Bypass for system/root ( ActivityManagerService.getIntentSender () ) if ( callingUid != 0 && callingUid != Process.SYSTEM_UID ) { int uid = AppGlobals.getPackageManager () . getPackageUid ( packageName , UserHandle.getUserId ( callingUid )); if (! UserHandle.isSameApp ( callingUid , uid )) { String msg = "Permission Denial: getIntentSender () from pid =" + Binder.getCallingPid () + ", uid =" + Binder.getCallingUid () + ", (need uid =" + uid + ")" + " is not allowed to send as package " + packageName ; Slog.w (TAG, msg ); throw new SecurityException ( msg ); } }