From 16560c093091b7ab390c16137618da6fd916d44e Mon Sep 17 00:00:00 2001
From: Brian Julian <bjj@google.com>
Date: Fri, 22 Apr 2022 20:28:49 +0000
Subject: [PATCH] Add a permissions check to LocationManagerService.

Prevents apps from reading location requests of other users without INTERACT_ACROSS_USERS permission.
Bug: 222473855
Test: Build

	modified:   services/core/java/com/android/server/location/LocationManagerService.java

Change-Id: Id591cd39ed7813c649b44d4a3210f0b1fb79b40d
---
 core/api/system-current.txt                                    | 2 +-
 location/java/android/location/LocationManager.java            | 3 ++-
 .../com/android/server/location/LocationManagerService.java    | 3 +++
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/core/api/system-current.txt b/core/api/system-current.txt
index 3569985278017..cd578e36ee9df 100644
--- a/core/api/system-current.txt
+++ b/core/api/system-current.txt
@@ -5876,7 +5876,7 @@ package android.location {
   }
 
   public class LocationManager {
-    method @RequiresPermission(android.Manifest.permission.LOCATION_HARDWARE) public void addProviderRequestChangedListener(@NonNull java.util.concurrent.Executor, @NonNull android.location.provider.ProviderRequest.ChangedListener);
+    method @RequiresPermission(allOf={android.Manifest.permission.LOCATION_HARDWARE, android.Manifest.permission.INTERACT_ACROSS_USERS}) public void addProviderRequestChangedListener(@NonNull java.util.concurrent.Executor, @NonNull android.location.provider.ProviderRequest.ChangedListener);
     method @Deprecated @RequiresPermission(android.Manifest.permission.LOCATION_HARDWARE) public void flushGnssBatch();
     method @Deprecated @RequiresPermission(anyOf={android.Manifest.permission.ACCESS_COARSE_LOCATION, android.Manifest.permission.ACCESS_FINE_LOCATION}) public void getCurrentLocation(@NonNull android.location.LocationRequest, @Nullable android.os.CancellationSignal, @NonNull java.util.concurrent.Executor, @NonNull java.util.function.Consumer<android.location.Location>);
     method @Nullable public String getExtraLocationControllerPackage();
diff --git a/location/java/android/location/LocationManager.java b/location/java/android/location/LocationManager.java
index 9d5b18e5bdf99..fd0c8948c321c 100644
--- a/location/java/android/location/LocationManager.java
+++ b/location/java/android/location/LocationManager.java
@@ -2910,7 +2910,8 @@ public class LocationManager {
      * @hide
      */
     @SystemApi
-    @RequiresPermission(Manifest.permission.LOCATION_HARDWARE)
+    @RequiresPermission(allOf = {Manifest.permission.LOCATION_HARDWARE,
+            Manifest.permission.INTERACT_ACROSS_USERS})
     public void addProviderRequestChangedListener(
             @NonNull @CallbackExecutor Executor executor,
             @NonNull ChangedListener listener) {
diff --git a/services/core/java/com/android/server/location/LocationManagerService.java b/services/core/java/com/android/server/location/LocationManagerService.java
index 31d5136c80a53..c6ea5123d9039 100644
--- a/services/core/java/com/android/server/location/LocationManagerService.java
+++ b/services/core/java/com/android/server/location/LocationManagerService.java
@@ -17,6 +17,7 @@
 package com.android.server.location;
 
 import static android.Manifest.permission.ACCESS_FINE_LOCATION;
+import static android.Manifest.permission.INTERACT_ACROSS_USERS;
 import static android.Manifest.permission.WRITE_SECURE_SETTINGS;
 import static android.app.compat.CompatChanges.isChangeEnabled;
 import static android.content.pm.PackageManager.MATCH_DIRECT_BOOT_AWARE;
@@ -1029,7 +1030,9 @@ public class LocationManagerService extends ILocationManager.Stub implements
     }
 
     @Override
+    @RequiresPermission(INTERACT_ACROSS_USERS)
     public void addProviderRequestListener(IProviderRequestListener listener) {
+        mContext.enforceCallingOrSelfPermission(INTERACT_ACROSS_USERS, null);
         for (LocationProviderManager manager : mProviderManagers) {
             manager.addProviderRequestListener(listener);
         }