From 4c93a26911382dde1089d50ed46b5dc00f4f7fc4 Mon Sep 17 00:00:00 2001 From: Michael Groover Date: Thu, 7 Apr 2022 23:07:29 +0000 Subject: [PATCH] Revert "Revert "Only allow root/system UIDs to send broadcast to unexported receiver"" This reverts commit 391263ceb44bd490baad3474d409fc9c920cec5e. Reason for revert: Affected receivers have been updated to remove the RECEIVER_NOT_EXPORTED flag in ag/17597116 and ag/17575182; all other receivers using this flag are either expecting the broadcast from the local app or a protected-broadcast sent from the system UID. Bug: 225999840 Test: atest ContextTest Test: atest CtsSensorTestCases Test: atest CtsAppExitTestCases Test: atest UiTranslationManagerTest Test: atest CtsAutoFillServiceTestCases:android.autofillservice.cts.dropdown.LoginActivityTest Test: atest AccessibilityWindowReportingTest Test: atest AndroidCarApiTest Test: atest BugReportAppTest Test: atest CarSecurityPermissionTest Test: atest CarServiceTest Test: atest CarServiceUnitTest Test: atest com.android.car.obd2.test Test: atest SampleCustomInputServiceTest Change-Id: Ifd76ed5d84de43eeb8f5215d07e90b0952673180 --- .../core/java/com/android/server/am/BroadcastQueue.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/services/core/java/com/android/server/am/BroadcastQueue.java b/services/core/java/com/android/server/am/BroadcastQueue.java index ea63c080cf68a..6ab18d532ac04 100644 --- a/services/core/java/com/android/server/am/BroadcastQueue.java +++ b/services/core/java/com/android/server/am/BroadcastQueue.java @@ -869,9 +869,9 @@ public final class BroadcastQueue { // Ensure that broadcasts are only sent to other apps if they are explicitly marked as // exported, or are System level broadcasts - if (!skip && !filter.exported && !Process.isCoreUid(r.callingUid) - && filter.receiverList.uid != r.callingUid) { - + if (!skip && !filter.exported && mService.checkComponentPermission(null, r.callingPid, + r.callingUid, filter.receiverList.uid, filter.exported) + != PackageManager.PERMISSION_GRANTED) { Slog.w(TAG, "Exported Denial: sending " + r.intent.toString() + ", action: " + r.intent.getAction()