From 33b4ab78f2c4a9f367c81c85b2ea8581c16e0fd6 Mon Sep 17 00:00:00 2001 From: Rhed Jao Date: Mon, 4 Oct 2021 19:08:33 +0800 Subject: [PATCH] Enforce package visibility to the api getCreatorPackage App can query which applications are installed on the device via the api PendingIntent#getCreatorPackage. This cl enforces package visibility filter to the getCreatorPackage api to fix this security issue. Bug: 198782887 Test: atest AppEnumerationTests Test: PoC application Change-Id: I4c30a161dc92076861f764ed2d049fab9263d6ab --- .../android/server/am/ActivityManagerService.java | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java index 6a632545bdaac..5330252a6d9b6 100644 --- a/services/core/java/com/android/server/am/ActivityManagerService.java +++ b/services/core/java/com/android/server/am/ActivityManagerService.java @@ -5091,14 +5091,19 @@ public class ActivityManagerService extends IActivityManager.Stub @Override public PendingIntentInfo getInfoForIntentSender(IIntentSender sender) { if (sender instanceof PendingIntentRecord) { - PendingIntentRecord res = (PendingIntentRecord) sender; + final PendingIntentRecord res = (PendingIntentRecord) sender; + final String packageName = res.key.packageName; + final int uid = res.uid; + final boolean shouldFilter = getPackageManagerInternal().filterAppAccess( + packageName, Binder.getCallingUid(), UserHandle.getUserId(uid)); return new PendingIntentInfo( - res.key.packageName, - res.uid, + shouldFilter ? null : packageName, + shouldFilter ? INVALID_UID : uid, (res.key.flags & PendingIntent.FLAG_IMMUTABLE) != 0, res.key.type); } else { - return new PendingIntentInfo(null, -1, false, ActivityManager.INTENT_SENDER_UNKNOWN); + return new PendingIntentInfo(null, INVALID_UID, false, + ActivityManager.INTENT_SENDER_UNKNOWN); } }