From db9e238ec75d356fe9a534b6632d213d0a42d038 Mon Sep 17 00:00:00 2001
From: Samiul Islam <samiul@google.com>
Date: Fri, 8 Apr 2022 16:00:34 +0100
Subject: [PATCH] Disallow external storage access without restricting other
 api calls

Currently, sandbox cannot call any apis from StorageManager that checks
calling package has same uid as calling uid. This CL fixes that by using
pm.isSameApp() api.

Additionally, since Environment.java fetches the initial application
context, the uid for that does not fall under the sandbox uid range. It
falls under app uid range. We fix the problem by checking for
PROPERTY_NO_APP_DATA_STORAGE flag on the application.

Bug: 228424287
Test: atest CtsSdkSandboxInprocessTests (see ag/17657742)
Change-Id: I8d9fca369cfbed47b40a42a44a40ff73acb712ec
---
 core/java/android/os/Environment.java              | 12 ++++++++++++
 .../com/android/server/StorageManagerService.java  | 14 +-------------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/core/java/android/os/Environment.java b/core/java/android/os/Environment.java
index ecdc803c00748..022d213e84dad 100644
--- a/core/java/android/os/Environment.java
+++ b/core/java/android/os/Environment.java
@@ -1361,6 +1361,18 @@ public class Environment {
             return false;
         }
 
+        // Apps with PROPERTY_NO_APP_DATA_STORAGE should not be allowed in scoped storage
+        final String packageName = AppGlobals.getInitialPackage();
+        try {
+            final PackageManager.Property noAppStorageProp = packageManager.getProperty(
+                    PackageManager.PROPERTY_NO_APP_DATA_STORAGE, packageName);
+            if (noAppStorageProp != null && noAppStorageProp.getBoolean()) {
+                return false;
+            }
+        } catch (PackageManager.NameNotFoundException ignore) {
+            // Property not defined for the package
+        }
+
         boolean defaultScopedStorage = Compatibility.isChangeEnabled(DEFAULT_SCOPED_STORAGE);
         boolean forceEnableScopedStorage = Compatibility.isChangeEnabled(
                 FORCE_ENABLE_SCOPED_STORAGE);
diff --git a/services/core/java/com/android/server/StorageManagerService.java b/services/core/java/com/android/server/StorageManagerService.java
index 991c7a9e0a4d3..90fec2920a658 100644
--- a/services/core/java/com/android/server/StorageManagerService.java
+++ b/services/core/java/com/android/server/StorageManagerService.java
@@ -3055,19 +3055,7 @@ class StorageManagerService extends IStorageManager.Stub
             return true;
         }
 
-        if (packageName == null) {
-            return false;
-        }
-
-        final int packageUid = mPmInternal.getPackageUid(packageName,
-                PackageManager.MATCH_DEBUG_TRIAGED_MISSING, UserHandle.getUserId(callerUid));
-
-        if (DEBUG_OBB) {
-            Slog.d(TAG, "packageName = " + packageName + ", packageUid = " +
-                    packageUid + ", callerUid = " + callerUid);
-        }
-
-        return callerUid == packageUid;
+        return mPmInternal.isSameApp(packageName, callerUid, UserHandle.getUserId(callerUid));
     }
 
     @Override