From 3d79d7e4e40c779b83a9c8b610e8232226c05c2c Mon Sep 17 00:00:00 2001
From: Jackal Guo <jackalguo@google.com>
Date: Tue, 4 May 2021 10:43:01 +0800
Subject: [PATCH] Enforce owner rights check to get/setMimeGroup

In the normal cases, the package name and the calling uid should be
from the same application. Adding this checking to get/setMimeGroup,
and moving the implementation to the internal variants. Also, guard
PackageSetting with the synchronized.

Bug: 184745603
Bug: 184745431
Test: atest CtsDynamicMimeHostTestCases
Test: manually using the PoC in the buganizer to ensure the symptom
      no longer exists.
Change-Id: Ic6956a55077ba4f3aed4df405b6db7219de8b267
---
 .../server/pm/PackageManagerService.java      | 28 +++++++++++++------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 2f8ba6da89a30..6b4fe01ec9c94 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -23078,16 +23078,17 @@ public class PackageManagerService extends IPackageManager.Stub
         if (UserHandle.getAppId(callingUid) == Process.SYSTEM_UID) {
             return;
         }
+        final String[] callerPackageNames = getPackagesForUid(callingUid);
+        if (!ArrayUtils.contains(callerPackageNames, pkg)) {
+            throw new SecurityException("Calling uid " + callingUid
+                    + " does not own package " + pkg);
+        }
         final int callingUserId = UserHandle.getUserId(callingUid);
         PackageInfo pi = getPackageInfo(pkg, 0, callingUserId);
         if (pi == null) {
             throw new IllegalArgumentException("Unknown package " + pkg + " on user "
                     + callingUserId);
         }
-        if (!UserHandle.isSameApp(pi.applicationInfo.uid, callingUid)) {
-            throw new SecurityException("Calling uid " + callingUid
-                    + " does not own package " + pkg);
-        }
     }
 
     @Override
@@ -27771,7 +27772,7 @@ public class PackageManagerService extends IPackageManager.Stub
 
         @Override
         public List<String> getMimeGroup(String packageName, String mimeGroup) {
-            return PackageManagerService.this.getMimeGroup(packageName, mimeGroup);
+            return PackageManagerService.this.getMimeGroupInternal(packageName, mimeGroup);
         }
 
         @Override
@@ -28397,9 +28398,11 @@ public class PackageManagerService extends IPackageManager.Stub
 
     @Override
     public void setMimeGroup(String packageName, String mimeGroup, List<String> mimeTypes) {
-        boolean changed = mSettings.getPackageLPr(packageName)
-                .setMimeGroup(mimeGroup, mimeTypes);
-
+        enforceOwnerRights(packageName, Binder.getCallingUid());
+        final boolean changed;
+        synchronized (mLock) {
+            changed = mSettings.getPackageLPr(packageName).setMimeGroup(mimeGroup, mimeTypes);
+        }
         if (changed) {
             applyMimeGroupChanges(packageName, mimeGroup);
         }
@@ -28407,7 +28410,14 @@ public class PackageManagerService extends IPackageManager.Stub
 
     @Override
     public List<String> getMimeGroup(String packageName, String mimeGroup) {
-        return mSettings.getPackageLPr(packageName).getMimeGroup(mimeGroup);
+        enforceOwnerRights(packageName, Binder.getCallingUid());
+        return getMimeGroupInternal(packageName, mimeGroup);
+    }
+
+    private List<String> getMimeGroupInternal(String packageName, String mimeGroup) {
+        synchronized (mLock) {
+            return mSettings.getPackageLPr(packageName).getMimeGroup(mimeGroup);
+        }
     }
 
     @Override