diff --git a/services/core/java/com/android/server/am/ActiveServices.java b/services/core/java/com/android/server/am/ActiveServices.java index 5046070647d64..c5c3cafa88132 100644 --- a/services/core/java/com/android/server/am/ActiveServices.java +++ b/services/core/java/com/android/server/am/ActiveServices.java @@ -2460,16 +2460,22 @@ public final class ActiveServices { && mAm.isValidSingletonCall(callingUid, sInfo.applicationInfo.uid)) { userId = 0; smap = getServiceMapLocked(0); - ResolveInfo rInfoForUserId0 = - mAm.getPackageManagerInternalLocked().resolveService(service, - resolvedType, flags, userId, callingUid); - if (rInfoForUserId0 == null) { - Slog.w(TAG_SERVICE, - "Unable to resolve service " + service + " U=" + userId - + ": not found"); - return null; + // Bypass INTERACT_ACROSS_USERS permission check + final long token = Binder.clearCallingIdentity(); + try { + ResolveInfo rInfoForUserId0 = + mAm.getPackageManagerInternalLocked().resolveService(service, + resolvedType, flags, userId, callingUid); + if (rInfoForUserId0 == null) { + Slog.w(TAG_SERVICE, + "Unable to resolve service " + service + " U=" + userId + + ": not found"); + return null; + } + sInfo = rInfoForUserId0.serviceInfo; + } finally { + Binder.restoreCallingIdentity(token); } - sInfo = rInfoForUserId0.serviceInfo; } sInfo = new ServiceInfo(sInfo); sInfo.applicationInfo = mAm.getAppInfoForUser(sInfo.applicationInfo, userId);