From 57a56f9104dd523c6c727c053e8c537753123e09 Mon Sep 17 00:00:00 2001
From: Piyush Mehrotra <piee@google.com>
Date: Mon, 1 Aug 2022 15:29:27 +0000
Subject: [PATCH] Enfore caller permission check before reading whether a user
 is ready for backup.

Adds a permission check at the beginning of BackupManagerService#isUserReadyForBackup() which ensures that the caller has appropriate permission ('INTERACT_ACROSS_USERS_FULL') if the target user id doesn't match caller.

Fixes: 230866788
Test: atest -v BackupFrameworksServicesRoboTests

Change-Id: I2423a4baa642901c13e7f18f17bdefa91b42605b
---
 .../server/backup/BackupManagerService.java   |  2 +-
 .../backup/BackupManagerServiceRoboTest.java  | 29 +++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/services/backup/java/com/android/server/backup/BackupManagerService.java b/services/backup/java/com/android/server/backup/BackupManagerService.java
index 38275f7cd3483..1c571a7036ad6 100644
--- a/services/backup/java/com/android/server/backup/BackupManagerService.java
+++ b/services/backup/java/com/android/server/backup/BackupManagerService.java
@@ -25,7 +25,6 @@ import android.annotation.UserIdInt;
 import android.app.ActivityManager;
 import android.app.admin.DevicePolicyManager;
 import android.app.backup.BackupManager;
-import android.app.backup.BackupManager.OperationType;
 import android.app.backup.IBackupManager;
 import android.app.backup.IBackupManagerMonitor;
 import android.app.backup.IBackupObserver;
@@ -284,6 +283,7 @@ public class BackupManagerService extends IBackupManager.Stub {
      */
     @Override
     public boolean isUserReadyForBackup(int userId) {
+        enforceCallingPermissionOnUserId(userId, "isUserReadyForBackup()");
         return mUserServices.get(UserHandle.USER_SYSTEM) != null
                 && mUserServices.get(userId) != null;
     }
diff --git a/services/robotests/backup/src/com/android/server/backup/BackupManagerServiceRoboTest.java b/services/robotests/backup/src/com/android/server/backup/BackupManagerServiceRoboTest.java
index 2219d477630e9..e2f56ba56f3db 100644
--- a/services/robotests/backup/src/com/android/server/backup/BackupManagerServiceRoboTest.java
+++ b/services/robotests/backup/src/com/android/server/backup/BackupManagerServiceRoboTest.java
@@ -301,6 +301,35 @@ public class BackupManagerServiceRoboTest {
         verify(mUserOneService, never()).initializeTransports(transports, /* observer */ null);
     }
 
+    /**
+     * Test that the backup services throws a {@link SecurityException} if the caller does not have
+     * INTERACT_ACROSS_USERS_FULL permission and passes a different user id.
+     */
+    @Test
+    public void testIsUserReadyForBackup_withoutPermission_throwsSecurityException() {
+        BackupManagerService backupManagerService = createService();
+        registerUser(backupManagerService, mUserOneId, mUserOneService);
+        setCallerAndGrantInteractUserPermission(mUserTwoId, /* shouldGrantPermission */ false);
+
+        expectThrows(
+                SecurityException.class,
+                () -> backupManagerService.isUserReadyForBackup(mUserOneId));
+    }
+
+    /**
+     * Test that the backup service does not throw a {@link SecurityException} if the caller has
+     * INTERACT_ACROSS_USERS_FULL permission and passes a different user id.
+     */
+    @Test
+    public void testIsUserReadyForBackup_withPermission_callsMethodForUser() {
+        BackupManagerService backupManagerService = createService();
+        registerUser(backupManagerService, UserHandle.USER_SYSTEM, mUserSystemService);
+        registerUser(backupManagerService, mUserOneId, mUserOneService);
+        setCallerAndGrantInteractUserPermission(mUserTwoId, /* shouldGrantPermission */ true);
+
+        assertThat(backupManagerService.isUserReadyForBackup(mUserOneId)).isTrue();
+    }
+
     /** Test that the backup service routes methods correctly to the user that requests it. */
     @Test
     public void testClearBackupData_onRegisteredUser_callsMethodForUser() throws Exception {