Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Don't allow sdk sandbox processes to register/unregister CPs" into tm-dev am: 4baae1f703

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/17346984

Change-Id: I0701728ecdc4e5d83de62115e628e48e4caa750f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Nikita Ioffe
2022-03-28 17:52:59 +00:00
committed by Automerger Merge Worker
parent 1ad6ffcaa3 4baae1f703
commit 0c510e67a6
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
services/core/java/com/android/server/am/ContentProviderHelper.java
View File

@@ -112,6 +112,13 @@ public class ContentProviderHelper {
ContentProviderHolder getContentProvider(IApplicationThread caller, String callingPackage,
String name, int userId, boolean stable) {
mService.enforceNotIsolatedCaller("getContentProvider");
if (Process.isSdkSandboxUid(Binder.getCallingUid())) {
// TODO(b/226318628): for sdk sandbox processes only allow accessing CPs registered by
// the WebView apk.
Slog.w(TAG, "Sdk sandbox process " + Binder.getCallingUid()
+ " is accessing content provider " + name
+ ". This access will most likely be blocked in the future");
}
if (caller == null) {
String msg = "null IApplicationThread when getting content provider " + name;
Slog.w(TAG, msg);
@@ -630,7 +637,7 @@ public class ContentProviderHelper {
return;
}
mService.enforceNotIsolatedCaller("publishContentProviders");
mService.enforceNotIsolatedOrSdkSandboxCaller("publishContentProviders");
synchronized (mService) {
final ProcessRecord r = mService.getRecordForAppLOSP(caller);
if (DEBUG_MU) {
@@ -717,7 +724,7 @@ public class ContentProviderHelper {
* Drop a content provider from a ProcessRecord's bookkeeping
*/
void removeContentProvider(IBinder connection, boolean stable) {
mService.enforceNotIsolatedCaller("removeContentProvider");
mService.enforceNotIsolatedOrSdkSandboxCaller("removeContentProvider");
final long ident = Binder.clearCallingIdentity();
try {
ContentProviderConnection conn;