Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "bypass INTERACT_ACROSS_USERS permission check when binding to singleton service for non-0 userId" into rvc-dev

Browse Source
This commit is contained in:
Songchun Fan
2020-06-01 21:19:26 +00:00
committed by Android (Google) Code Review
parent c5111c995b c05f30b494
commit 4cdb5ddeb4
1 changed files with 15 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
services/core/java/com/android/server/am/ActiveServices.java
View File

@@ -2460,6 +2460,9 @@ public final class ActiveServices {
&& mAm.isValidSingletonCall(callingUid, sInfo.applicationInfo.uid)) { && mAm.isValidSingletonCall(callingUid, sInfo.applicationInfo.uid)) {
userId = 0; userId = 0;
smap = getServiceMapLocked(0); smap = getServiceMapLocked(0);
// Bypass INTERACT_ACROSS_USERS permission check
final long token = Binder.clearCallingIdentity();
try {
ResolveInfo rInfoForUserId0 = ResolveInfo rInfoForUserId0 =
mAm.getPackageManagerInternalLocked().resolveService(service, mAm.getPackageManagerInternalLocked().resolveService(service,
resolvedType, flags, userId, callingUid); resolvedType, flags, userId, callingUid);
@@ -2470,6 +2473,9 @@ public final class ActiveServices {
return null; return null;
} }
sInfo = rInfoForUserId0.serviceInfo; sInfo = rInfoForUserId0.serviceInfo;
} finally {
Binder.restoreCallingIdentity(token);
}
} }
sInfo = new ServiceInfo(sInfo); sInfo = new ServiceInfo(sInfo);
sInfo.applicationInfo = mAm.getAppInfoForUser(sInfo.applicationInfo, userId); sInfo.applicationInfo = mAm.getAppInfoForUser(sInfo.applicationInfo, userId);