From 090529b1c414e30284f220e7e99e99808691770c Mon Sep 17 00:00:00 2001
From: Kwangkyu Park <kk48.park@samsung.com>
Date: Fri, 7 Jul 2023 22:25:43 +0900
Subject: [PATCH] Camera: Clear identity before access device policy manager

When cameraserver query device policy via CameraServiceProxy, the proxy
service uses identity of cameraserver. It causes SecurityException and
does not properly returns the actual query result.

Bug: 290329527
Test: Manual test with TestDPC
Change-Id: Ia02aab3276850c16a14b70c027bd03a17a601b8d
Merged-In: Ia02aab3276850c16a14b70c027bd03a17a601b8d
---
 .../server/camera/CameraServiceProxy.java     | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/services/core/java/com/android/server/camera/CameraServiceProxy.java b/services/core/java/com/android/server/camera/CameraServiceProxy.java
index 0b04159194d11..f8f0088ac0477 100644
--- a/services/core/java/com/android/server/camera/CameraServiceProxy.java
+++ b/services/core/java/com/android/server/camera/CameraServiceProxy.java
@@ -613,16 +613,26 @@ public class CameraServiceProxy extends SystemService
 
         @Override
         public boolean isCameraDisabled(int userId) {
-            DevicePolicyManager dpm = mContext.getSystemService(DevicePolicyManager.class);
-            if (dpm == null) {
-                Slog.e(TAG, "Failed to get the device policy manager service");
+            if (Binder.getCallingUid() != Process.CAMERASERVER_UID) {
+                Slog.e(TAG, "Calling UID: " + Binder.getCallingUid()
+                        + " doesn't match expected camera service UID!");
                 return false;
             }
+            final long ident = Binder.clearCallingIdentity();
             try {
-                return dpm.getCameraDisabled(null, userId);
-            } catch (Exception e) {
-                e.printStackTrace();
-                return false;
+                DevicePolicyManager dpm = mContext.getSystemService(DevicePolicyManager.class);
+                if (dpm == null) {
+                    Slog.e(TAG, "Failed to get the device policy manager service");
+                    return false;
+                }
+                try {
+                    return dpm.getCameraDisabled(null, userId);
+                } catch (Exception e) {
+                    e.printStackTrace();
+                    return false;
+                }
+            } finally {
+                Binder.restoreCallingIdentity(ident);
             }
         }
     };