From abc1ce5ba27a28eca90b8533a93f4ba7e3fb904a Mon Sep 17 00:00:00 2001 From: Rhed Jao Date: Wed, 15 Dec 2021 14:35:06 +0800 Subject: [PATCH] Enforce package visibility filters to grantUriPermission() App can query which applications are installed on the device via Context#grantUriPermission. This cl enforces package visibility filters to the api to fix the security issue. Bug: 207133709 Test: atest AppEnumerationTests Test: atest ContextTest Test: atest DownloadManagerTest Test: atest CtsScopedStorageHostTest Test: atest CtsScopedStorageDeviceOnlyTest Test: atest CtsScopedStorageCoreHostTest Test: atest CtsJobSchedulerSharedUidTestCases Test: atest SQLiteTest Test: atest AppSecurityTests Test: atest CtsMediaProviderTranscodeTests Test: atest ExternalStorageHostTest Change-Id: Ic8ed5f2fb46b8de605bd091a2a62d8070e28a1eb --- .../java/com/android/server/am/ActivityManagerService.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java index a33aa600febdf..d6f911c965b00 100644 --- a/services/core/java/com/android/server/am/ActivityManagerService.java +++ b/services/core/java/com/android/server/am/ActivityManagerService.java @@ -5913,6 +5913,10 @@ public class ActivityManagerService extends IActivityManager.Stub if (targetPkg == null) { throw new IllegalArgumentException("null target"); } + final int callingUserId = UserHandle.getUserId(r.uid); + if (mPackageManagerInt.filterAppAccess(targetPkg, r.uid, callingUserId)) { + return; + } Preconditions.checkFlagsArgument(modeFlags, Intent.FLAG_GRANT_READ_URI_PERMISSION | Intent.FLAG_GRANT_WRITE_URI_PERMISSION @@ -5924,7 +5928,7 @@ public class ActivityManagerService extends IActivityManager.Stub intent.setFlags(modeFlags); final NeededUriGrants needed = mUgmInternal.checkGrantUriPermissionFromIntent(intent, - r.uid, targetPkg, UserHandle.getUserId(r.uid)); + r.uid, targetPkg, callingUserId); mUgmInternal.grantUriPermissionUncheckedFromIntent(needed, null); } }