Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "DO NOT MERGE Add permission checks before delivery" into rvc-qpr-dev

Browse Source
This commit is contained in:
TreeHugger Robot
2020-07-31 19:47:51 +00:00
committed by Android (Google) Code Review
parent 1056043851 ca643c5c33
commit 0dd050cbb5
1 changed files with 30 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
services/core/java/com/android/server/location/AppOpsHelper.java
View File

@@ -18,7 +18,9 @@ package com.android.server.location;
import static android.app.AppOpsManager.OP_MONITOR_HIGH_POWER_LOCATION; import static android.app.AppOpsManager.OP_MONITOR_HIGH_POWER_LOCATION;
import static android.app.AppOpsManager.OP_MONITOR_LOCATION; import static android.app.AppOpsManager.OP_MONITOR_LOCATION;
import static android.content.pm.PackageManager.PERMISSION_GRANTED;
import static com.android.server.location.CallerIdentity.PERMISSION_NONE;
import static com.android.server.location.LocationManagerService.D; import static com.android.server.location.LocationManagerService.D;
import static com.android.server.location.LocationManagerService.TAG; import static com.android.server.location.LocationManagerService.TAG;
@@ -122,8 +124,18 @@ public class AppOpsHelper {
Preconditions.checkState(mAppOps != null); Preconditions.checkState(mAppOps != null);
} }
if (callerIdentity.permissionLevel == PERMISSION_NONE) {
return false;
}
long identity = Binder.clearCallingIdentity(); long identity = Binder.clearCallingIdentity();
try { try {
if (mContext.checkPermission(
CallerIdentity.asPermission(callerIdentity.permissionLevel), callerIdentity.pid,
callerIdentity.uid) != PERMISSION_GRANTED) {
return false;
}
return mAppOps.checkOpNoThrow( return mAppOps.checkOpNoThrow(
CallerIdentity.asAppOp(callerIdentity.permissionLevel), CallerIdentity.asAppOp(callerIdentity.permissionLevel),
callerIdentity.uid, callerIdentity.uid,
@@ -138,8 +150,24 @@ public class AppOpsHelper {
* called right before a location is delivered, and if it returns false, the location should not * called right before a location is delivered, and if it returns false, the location should not
* be delivered. * be delivered.
*/ */
public boolean noteLocationAccess(CallerIdentity identity) { public boolean noteLocationAccess(CallerIdentity callerIdentity) {
return noteOpNoThrow(CallerIdentity.asAppOp(identity.permissionLevel), identity); if (callerIdentity.permissionLevel == PERMISSION_NONE) {
return false;
}
long identity = Binder.clearCallingIdentity();
try {
if (mContext.checkPermission(
CallerIdentity.asPermission(callerIdentity.permissionLevel), callerIdentity.pid,
callerIdentity.uid) != PERMISSION_GRANTED) {
return false;
}
} finally {
Binder.restoreCallingIdentity(identity);
}
return noteOpNoThrow(CallerIdentity.asAppOp(callerIdentity.permissionLevel),
callerIdentity);
} }
/** /**