Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check calling user id against current user before setting navbar mode.

Browse Source 
Bug: 247337618
Test: manual.
Change-Id: I3c0a4e855d96decfb24a2fa311f51cc6eb8aaa88
This commit is contained in:
Pat Manning
2022-10-26 15:57:09 +00:00
parent 8a283d04f0
commit 34dd9e380d
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
services/core/java/com/android/server/statusbar/StatusBarManagerService.java
View File

@@ -16,12 +16,15 @@
package com.android.server.statusbar;
import static android.Manifest.permission.INTERACT_ACROSS_USERS;
import static android.Manifest.permission.INTERACT_ACROSS_USERS_FULL;
import static android.app.StatusBarManager.DISABLE2_GLOBAL_ACTIONS;
import static android.app.StatusBarManager.DISABLE2_NOTIFICATION_SHADE;
import static android.app.StatusBarManager.NAV_BAR_MODE_DEFAULT;
import static android.app.StatusBarManager.NAV_BAR_MODE_KIDS;
import static android.app.StatusBarManager.NavBarMode;
import static android.app.StatusBarManager.SessionFlags;
import static android.content.pm.PackageManager.PERMISSION_GRANTED;
import static android.view.Display.DEFAULT_DISPLAY;
import static android.view.WindowManagerPolicyConstants.NAV_BAR_MODE_3BUTTON_OVERLAY;
@@ -1285,6 +1288,11 @@ public class StatusBarManagerService extends IStatusBarService.Stub implements D
"StatusBarManagerService");
}
private boolean doesCallerHoldInteractAcrossUserPermission() {
return mContext.checkCallingPermission(INTERACT_ACROSS_USERS_FULL) == PERMISSION_GRANTED
|| mContext.checkCallingPermission(INTERACT_ACROSS_USERS) == PERMISSION_GRANTED;
}
/**
* For targetSdk S+ we require STATUS_BAR. For targetSdk < S, we only require EXPAND_STATUS_BAR
* but also require that it falls into one of the allowed use-cases to lock down abuse vector.
@@ -1296,7 +1304,7 @@ public class StatusBarManagerService extends IStatusBarService.Stub implements D
enforceStatusBar();
} else {
if (mContext.checkPermission(Manifest.permission.STATUS_BAR, pid, uid)
!= PackageManager.PERMISSION_GRANTED) {
!= PERMISSION_GRANTED) {
enforceExpandStatusBar();
if (!mActivityTaskManager.canCloseSystemDialogs(pid, uid)) {
Slog.e(TAG, "Permission Denial: Method " + method + "() requires permission "
@@ -2002,6 +2010,11 @@ public class StatusBarManagerService extends IStatusBarService.Stub implements D
}
final int userId = mCurrentUserId;
final int callingUserId = UserHandle.getUserId(Binder.getCallingUid());
if (mCurrentUserId != callingUserId && !doesCallerHoldInteractAcrossUserPermission()) {
throw new SecurityException("Calling user id: " + callingUserId
+ ", cannot call on behalf of current user id: " + mCurrentUserId + ".");
}
final long userIdentity = Binder.clearCallingIdentity();
try {
Settings.Secure.putIntForUser(mContext.getContentResolver(),