Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Verify caller before auto granting slice permission

Browse Source 
Currently SliceManagerService#checkSlicePermission does not verify the
caller's identity. This leads to a security vulnerability because
checkSlicePermission does more than checking the permission as opposed
to simply return a boolean value -- it additionally grants slice access
under a certain condition. A malicious app can spoof the calling package
to acquire slice access.

This CL verifies the caller before granting slice access.

Bug: 208232850, 179699767
Test: manual
Change-Id: I2539c9ff5ea977c91bb58185c95280b4d533a520
Merged-In: I2539c9ff5ea977c91bb58185c95280b4d533a520
(cherry picked from commit 5bd2196c53)
This commit is contained in:
Pinyao Ting
2022-03-03 18:24:37 +00:00
parent 4d7ca1dbce
commit 3c92d74d7d
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
services/core/java/com/android/server/slice/SliceManagerService.java
View File

@@ -237,6 +237,8 @@ public class SliceManagerService extends ISliceManager.Stub {
if (autoGrantPermissions != null && callingPkg != null) { if (autoGrantPermissions != null && callingPkg != null) {
// Need to own the Uri to call in with permissions to grant. // Need to own the Uri to call in with permissions to grant.
enforceOwner(callingPkg, uri, userId); enforceOwner(callingPkg, uri, userId);
// b/208232850: Needs to verify caller before granting slice access
verifyCaller(callingPkg);
for (String perm : autoGrantPermissions) { for (String perm : autoGrantPermissions) {
if (mContext.checkPermission(perm, pid, uid) == PERMISSION_GRANTED) { if (mContext.checkPermission(perm, pid, uid) == PERMISSION_GRANTED) {
int providerUser = ContentProvider.getUserIdFromUri(uri, userId); int providerUser = ContentProvider.getUserIdFromUri(uri, userId);