Merge "Make sure callingPackage belongs to callingUid when checking BG-FGS restrictions." into tm-dev am: c872b77284 am: 94c2c6230d

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/18214570

Change-Id: Ibfba91719e4de1d436353de7292e2a2fabe3040d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

services/core/java/com/android/server/am/ActiveServices.java

@@ -6475,7 +6475,7 @@ public final class ActiveServices {
             }
         }
 
-        if (ret == REASON_DENIED) {
+        if (ret == REASON_DENIED && verifyPackage(callingPackage, callingUid)) {
             final boolean isAllowedPackage =
                     mAllowListWhileInUsePermissionInFgs.contains(callingPackage);
             if (isAllowedPackage) {
@@ -6882,4 +6882,19 @@ public final class ActiveServices {
                 /* allowBackgroundActivityStarts */ false)
                 != REASON_DENIED;
     }
+
+    /**
+     * Checks if a given packageName belongs to a given uid.
+     * @param packageName the package of the caller
+     * @param uid the uid of the caller
+     * @return true or false
+     */
+    private boolean verifyPackage(String packageName, int uid) {
+        if (uid == ROOT_UID || uid == SYSTEM_UID) {
+            //System and Root are always allowed
+            return true;
+        }
+        return mAm.getPackageManagerInternal().isSameApp(packageName, uid,
+                UserHandle.getUserId(uid));
+    }
 }