Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce owner rights check to get/setMimeGroup

Browse Source 
In the normal cases, the package name and the calling uid should be
from the same application. Adding this checking to get/setMimeGroup,
and moving the implementation to the internal variants. Also, guard
PackageSetting with the synchronized.

Bug: 184745603
Bug: 184745431
Test: atest CtsDynamicMimeHostTestCases
Test: manually using the PoC in the buganizer to ensure the symptom
      no longer exists.
Change-Id: Ic6956a55077ba4f3aed4df405b6db7219de8b267
This commit is contained in:
Jackal Guo
2021-05-04 10:43:01 +08:00
parent 0a40c03eb1
commit 3d79d7e4e4
1 changed files with 19 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
services/core/java/com/android/server/pm/PackageManagerService.java
View File

@@ -23078,16 +23078,17 @@ public class PackageManagerService extends IPackageManager.Stub
if (UserHandle.getAppId(callingUid) == Process.SYSTEM_UID) {
return;
}
final String[] callerPackageNames = getPackagesForUid(callingUid);
if (!ArrayUtils.contains(callerPackageNames, pkg)) {
throw new SecurityException("Calling uid " + callingUid
+ " does not own package " + pkg);
}
final int callingUserId = UserHandle.getUserId(callingUid);
PackageInfo pi = getPackageInfo(pkg, 0, callingUserId);
if (pi == null) {
throw new IllegalArgumentException("Unknown package " + pkg + " on user "
+ callingUserId);
}
if (!UserHandle.isSameApp(pi.applicationInfo.uid, callingUid)) {
throw new SecurityException("Calling uid " + callingUid
+ " does not own package " + pkg);
}
}
@Override
@@ -27771,7 +27772,7 @@ public class PackageManagerService extends IPackageManager.Stub
@Override
public List<String> getMimeGroup(String packageName, String mimeGroup) {
return PackageManagerService.this.getMimeGroup(packageName, mimeGroup);
return PackageManagerService.this.getMimeGroupInternal(packageName, mimeGroup);
}
@Override
@@ -28397,9 +28398,11 @@ public class PackageManagerService extends IPackageManager.Stub
@Override
public void setMimeGroup(String packageName, String mimeGroup, List<String> mimeTypes) {
boolean changed = mSettings.getPackageLPr(packageName)
.setMimeGroup(mimeGroup, mimeTypes);
enforceOwnerRights(packageName, Binder.getCallingUid());
final boolean changed;
synchronized (mLock) {
changed = mSettings.getPackageLPr(packageName).setMimeGroup(mimeGroup, mimeTypes);
}
if (changed) {
applyMimeGroupChanges(packageName, mimeGroup);
}
@@ -28407,7 +28410,14 @@ public class PackageManagerService extends IPackageManager.Stub
@Override
public List<String> getMimeGroup(String packageName, String mimeGroup) {
return mSettings.getPackageLPr(packageName).getMimeGroup(mimeGroup);
enforceOwnerRights(packageName, Binder.getCallingUid());
return getMimeGroupInternal(packageName, mimeGroup);
}
private List<String> getMimeGroupInternal(String packageName, String mimeGroup) {
synchronized (mLock) {
return mSettings.getPackageLPr(packageName).getMimeGroup(mimeGroup);
}
}
@Override