Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce package visibility to the api getCreatorPackage

Browse Source 
App can query which applications are installed on the device
via the api PendingIntent#getCreatorPackage. This cl enforces
package visibility filter to the getCreatorPackage api to fix
this security issue.

Bug: 198782887
Test: atest AppEnumerationTests
Test: PoC application
Change-Id: I4c30a161dc92076861f764ed2d049fab9263d6ab
This commit is contained in:
Rhed Jao
2021-10-04 19:08:33 +08:00
parent 96b12a2636
commit 33b4ab78f2
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
services/core/java/com/android/server/am/ActivityManagerService.java
View File

@@ -5091,14 +5091,19 @@ public class ActivityManagerService extends IActivityManager.Stub
@Override
public PendingIntentInfo getInfoForIntentSender(IIntentSender sender) {
if (sender instanceof PendingIntentRecord) {
PendingIntentRecord res = (PendingIntentRecord) sender;
final PendingIntentRecord res = (PendingIntentRecord) sender;
final String packageName = res.key.packageName;
final int uid = res.uid;
final boolean shouldFilter = getPackageManagerInternal().filterAppAccess(
packageName, Binder.getCallingUid(), UserHandle.getUserId(uid));
return new PendingIntentInfo(
res.key.packageName,
res.uid,
shouldFilter ? null : packageName,
shouldFilter ? INVALID_UID : uid,
(res.key.flags & PendingIntent.FLAG_IMMUTABLE) != 0,
res.key.type);
} else {
return new PendingIntentInfo(null, -1, false, ActivityManager.INTENT_SENDER_UNKNOWN);
return new PendingIntentInfo(null, INVALID_UID, false,
ActivityManager.INTENT_SENDER_UNKNOWN);
}
}