From 5ef2bae3a426555689b0ea5338bc811fa213c401 Mon Sep 17 00:00:00 2001 From: Arthur Ishiguro Date: Thu, 16 Sep 2021 09:08:22 -0700 Subject: [PATCH] Add logic to use system server UID for noteOp call Bug: 194285834 Test: Verify CHQTS pass on AIDL HAL Change-Id: I76457a6f6108e4bd8f3b1bf49fdd7ef9e8611641 --- .../server/location/contexthub/ContextHubClientBroker.java | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/services/core/java/com/android/server/location/contexthub/ContextHubClientBroker.java b/services/core/java/com/android/server/location/contexthub/ContextHubClientBroker.java index 442abc91a3704..dcf415f4cb4ac 100644 --- a/services/core/java/com/android/server/location/contexthub/ContextHubClientBroker.java +++ b/services/core/java/com/android/server/location/contexthub/ContextHubClientBroker.java @@ -605,6 +605,9 @@ public class ContextHubClientBroker extends IContextHubClient.Stub for (String permission : permissions) { int opCode = mAppOpsManager.permissionToOpCode(permission); if (opCode != AppOpsManager.OP_NONE) { + // The noteOp call may check for required permissions. Use the below logic to ensure + // that the system server permission is enforced at the call. + long token = Binder.setCallingWorkSourceUid(android.os.Process.myUid()); try { if (mAppOpsManager.noteOp(opCode, mUid, mPackage, mAttributionTag, noteMessage) != AppOpsManager.MODE_ALLOWED) { @@ -614,6 +617,8 @@ public class ContextHubClientBroker extends IContextHubClient.Stub Log.e(TAG, "SecurityException: noteOp for pkg " + mPackage + " opcode " + opCode + ": " + e.getMessage()); return false; + } finally { + Binder.restoreCallingWorkSource(token); } } }