From c05f30b49419fa8d10e68c7704c23816ca7b5500 Mon Sep 17 00:00:00 2001
From: Songchun Fan <schfan@google.com>
Date: Mon, 1 Jun 2020 11:23:29 -0700
Subject: [PATCH] bypass INTERACT_ACROSS_USERS permission check when binding to
 singleton service for non-0 userId

BUG: 157822484
Test: manual
Change-Id: Iaf18a009cd7326e7a2f964a9813b11a9365f6ba3
---
 .../com/android/server/am/ActiveServices.java | 24 ++++++++++++-------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/services/core/java/com/android/server/am/ActiveServices.java b/services/core/java/com/android/server/am/ActiveServices.java
index 8cdffb7b1b13a..7a619db047125 100644
--- a/services/core/java/com/android/server/am/ActiveServices.java
+++ b/services/core/java/com/android/server/am/ActiveServices.java
@@ -2460,16 +2460,22 @@ public final class ActiveServices {
                             && mAm.isValidSingletonCall(callingUid, sInfo.applicationInfo.uid)) {
                         userId = 0;
                         smap = getServiceMapLocked(0);
-                        ResolveInfo rInfoForUserId0 =
-                                mAm.getPackageManagerInternalLocked().resolveService(service,
-                                        resolvedType, flags, userId, callingUid);
-                        if (rInfoForUserId0 == null) {
-                            Slog.w(TAG_SERVICE,
-                                    "Unable to resolve service " + service + " U=" + userId
-                                            + ": not found");
-                            return null;
+                        // Bypass INTERACT_ACROSS_USERS permission check
+                        final long token = Binder.clearCallingIdentity();
+                        try {
+                            ResolveInfo rInfoForUserId0 =
+                                    mAm.getPackageManagerInternalLocked().resolveService(service,
+                                            resolvedType, flags, userId, callingUid);
+                            if (rInfoForUserId0 == null) {
+                                Slog.w(TAG_SERVICE,
+                                        "Unable to resolve service " + service + " U=" + userId
+                                                + ": not found");
+                                return null;
+                            }
+                            sInfo = rInfoForUserId0.serviceInfo;
+                        } finally {
+                            Binder.restoreCallingIdentity(token);
                         }
-                        sInfo = rInfoForUserId0.serviceInfo;
                     }
                     sInfo = new ServiceInfo(sInfo);
                     sInfo.applicationInfo = mAm.getAppInfoForUser(sInfo.applicationInfo, userId);