Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add permission check for owner-info related LockSettings.

Browse Source 
Fixes bug 8512972

Change-Id: I372ef892000e5de9075783f06b722e2911cfc90d
This commit is contained in:
Jim Miller
2013-04-17 15:23:55 -07:00
parent b1e5137a80
commit 158fe19ff8
1 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
services/java/com/android/server/LockSettingsService.java
View File

@@ -19,9 +19,11 @@ package com.android.server;
import android.content.ContentResolver; import android.content.ContentResolver;
import android.content.ContentValues; import android.content.ContentValues;
import android.content.Context; import android.content.Context;
import android.content.pm.PackageManager;
import android.content.pm.UserInfo; import android.content.pm.UserInfo;
import static android.content.Context.USER_SERVICE; import static android.content.Context.USER_SERVICE;
import static android.Manifest.permission.READ_PROFILE;
import android.database.Cursor; import android.database.Cursor;
import android.database.sqlite.SQLiteDatabase; import android.database.sqlite.SQLiteDatabase;
import android.database.sqlite.SQLiteOpenHelper; import android.database.sqlite.SQLiteOpenHelper;
@@ -150,12 +152,16 @@ public class LockSettingsService extends ILockSettings.Stub {
} }
} }
private static final void checkReadPermission(int userId) { private final void checkReadPermission(String requestedKey, int userId) {
final int callingUid = Binder.getCallingUid(); final int callingUid = Binder.getCallingUid();
if (UserHandle.getAppId(callingUid) != android.os.Process.SYSTEM_UID for (int i = 0; i < READ_PROFILE_PROTECTED_SETTINGS.length; i++) {
&& UserHandle.getUserId(callingUid) != userId) { String key = READ_PROFILE_PROTECTED_SETTINGS[i];
if (key.equals(requestedKey) && mContext.checkCallingOrSelfPermission(READ_PROFILE)
!= PackageManager.PERMISSION_GRANTED) {
throw new SecurityException("uid=" + callingUid throw new SecurityException("uid=" + callingUid
+ " not authorized to read settings of user " + userId); + " needs permission " + READ_PROFILE + " to read "
+ requestedKey + " for user " + userId);
}
} }
} }
@@ -182,7 +188,7 @@ public class LockSettingsService extends ILockSettings.Stub {
@Override @Override
public boolean getBoolean(String key, boolean defaultValue, int userId) throws RemoteException { public boolean getBoolean(String key, boolean defaultValue, int userId) throws RemoteException {
//checkReadPermission(userId); checkReadPermission(key, userId);
String value = readFromDb(key, null, userId); String value = readFromDb(key, null, userId);
return TextUtils.isEmpty(value) ? return TextUtils.isEmpty(value) ?
@@ -191,7 +197,7 @@ public class LockSettingsService extends ILockSettings.Stub {
@Override @Override
public long getLong(String key, long defaultValue, int userId) throws RemoteException { public long getLong(String key, long defaultValue, int userId) throws RemoteException {
//checkReadPermission(userId); checkReadPermission(key, userId);
String value = readFromDb(key, null, userId); String value = readFromDb(key, null, userId);
return TextUtils.isEmpty(value) ? defaultValue : Long.parseLong(value); return TextUtils.isEmpty(value) ? defaultValue : Long.parseLong(value);
@@ -199,7 +205,7 @@ public class LockSettingsService extends ILockSettings.Stub {
@Override @Override
public String getString(String key, String defaultValue, int userId) throws RemoteException { public String getString(String key, String defaultValue, int userId) throws RemoteException {
//checkReadPermission(userId); checkReadPermission(key, userId);
return readFromDb(key, defaultValue, userId); return readFromDb(key, defaultValue, userId);
} }
@@ -445,4 +451,7 @@ public class LockSettingsService extends ILockSettings.Stub {
Secure.LOCK_SCREEN_OWNER_INFO_ENABLED, Secure.LOCK_SCREEN_OWNER_INFO_ENABLED,
Secure.LOCK_SCREEN_OWNER_INFO Secure.LOCK_SCREEN_OWNER_INFO
}; };
// These are protected with a read permission
private static final String[] READ_PROFILE_PROTECTED_SETTINGS = MIGRATE_SETTINGS_PER_USER;
} }