From a31c23da300b5d1f4b1fc261bb0dcb1fee9b61f1 Mon Sep 17 00:00:00 2001
From: Andres Morales <anmorales@google.com>
Date: Thu, 30 Oct 2014 15:31:31 -0700
Subject: [PATCH] Only allow USER_OWNER to access PDB and change OEM unlock
 ability

Bug:18191568
Change-Id: Ie09823945af04accead99216580efc958bf6aefe
---
 .../server/PersistentDataBlockService.java      | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/services/core/java/com/android/server/PersistentDataBlockService.java b/services/core/java/com/android/server/PersistentDataBlockService.java
index 6f378fd42a89f..de90aa2d4e255 100644
--- a/services/core/java/com/android/server/PersistentDataBlockService.java
+++ b/services/core/java/com/android/server/PersistentDataBlockService.java
@@ -72,7 +72,7 @@ public class PersistentDataBlockService extends SystemService {
     private final String mDataBlockFile;
     private final Object mLock = new Object();
 
-    private int mAllowedAppId = -1;
+    private int mAllowedUid = -1;
     /*
      * Separate lock for OEM unlock related operations as they can happen in parallel with regular
      * block operations.
@@ -86,11 +86,11 @@ public class PersistentDataBlockService extends SystemService {
         mContext = context;
         mDataBlockFile = SystemProperties.get(PERSISTENT_DATA_BLOCK_PROP);
         mBlockDeviceSize = -1; // Load lazily
-        mAllowedAppId = getAllowedAppId(UserHandle.USER_OWNER);
+        mAllowedUid = getAllowedUid(UserHandle.USER_OWNER);
     }
 
 
-    private int getAllowedAppId(int userHandle) {
+    private int getAllowedUid(int userHandle) {
         String allowedPackage = mContext.getResources()
                 .getString(R.string.config_persistentDataPackageName);
         PackageManager pm = mContext.getPackageManager();
@@ -101,7 +101,7 @@ public class PersistentDataBlockService extends SystemService {
             // not expected
             Slog.e(TAG, "not able to find package " + allowedPackage, e);
         }
-        return UserHandle.getAppId(allowedUid);
+        return allowedUid;
     }
 
     @Override
@@ -116,11 +116,17 @@ public class PersistentDataBlockService extends SystemService {
     }
 
     private void enforceUid(int callingUid) {
-        if (UserHandle.getAppId(callingUid) != mAllowedAppId) {
+        if (callingUid != mAllowedUid) {
             throw new SecurityException("uid " + callingUid + " not allowed to access PST");
         }
     }
 
+    private void enforceIsOwner() {
+        if (!Binder.getCallingUserHandle().isOwner()) {
+            throw new SecurityException("Only the Owner is allowed to change OEM unlock state");
+        }
+    }
+
     private int getTotalDataSizeLocked(DataInputStream inputStream) throws IOException {
         int totalDataSize;
         int blockId = inputStream.readInt();
@@ -249,6 +255,7 @@ public class PersistentDataBlockService extends SystemService {
                 return;
             }
             enforceOemUnlockPermission();
+            enforceIsOwner();
             FileOutputStream outputStream;
             try {
                 outputStream = new FileOutputStream(new File(mDataBlockFile));