Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix exploit where can hide the fact that a location was mocked am: a206a0f17e

Browse Source 
am: d417e54872

Change-Id: I2f47020055f962b36f095137d75c9cbfe6b1a6db
This commit is contained in:
Tom O'Neill
2016-12-22 17:04:07 +00:00
committed by android-build-merger
parent 9a15881184 d417e54872
commit 3380a77516
1 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
services/core/java/com/android/server/LocationManagerService.java
View File

@@ -57,6 +57,8 @@ import android.os.SystemClock;
import android.os.UserHandle; import android.os.UserHandle;
import android.os.WorkSource; import android.os.WorkSource;
import android.provider.Settings; import android.provider.Settings;
import android.text.TextUtils;
import android.util.EventLog;
import android.util.Log; import android.util.Log;
import android.util.Slog; import android.util.Slog;
import com.android.internal.content.PackageMonitor; import com.android.internal.content.PackageMonitor;
@@ -2247,9 +2249,22 @@ public class LocationManagerService extends ILocationManager.Stub {
if (mockProvider == null) { if (mockProvider == null) {
throw new IllegalArgumentException("Provider \"" + provider + "\" unknown"); throw new IllegalArgumentException("Provider \"" + provider + "\" unknown");
} }
// Ensure that the location is marked as being mock. There's some logic to do this in
// handleLocationChanged(), but it fails if loc has the wrong provider (bug 33091107).
Location mock = new Location(loc);
mock.setIsFromMockProvider(true);
if (!TextUtils.isEmpty(loc.getProvider()) && !provider.equals(loc.getProvider())) {
// The location has an explicit provider that is different from the mock provider
// name. The caller may be trying to fool us via bug 33091107.
EventLog.writeEvent(0x534e4554, "33091107", Binder.getCallingUid(),
provider + "!=" + loc.getProvider());
}
// clear calling identity so INSTALL_LOCATION_PROVIDER permission is not required // clear calling identity so INSTALL_LOCATION_PROVIDER permission is not required
long identity = Binder.clearCallingIdentity(); long identity = Binder.clearCallingIdentity();
mockProvider.setLocation(loc); mockProvider.setLocation(mock);
Binder.restoreCallingIdentity(identity); Binder.restoreCallingIdentity(identity);
} }
} }