From 75890e5196bfca34414de4c4badb7b03eb001f80 Mon Sep 17 00:00:00 2001
From: Rhed Jao <rhedjao@google.com>
Date: Tue, 22 Jun 2021 22:47:03 +0800
Subject: [PATCH] Enforce package visibility to the api checkUriPermission

App can query which applications are installed on the device via
api grantUriPermission and checkUriPermission. This cl enforces
package visibility filter to the api checkUriPermission to fix
the security issue.

Bug: 180019130
Test: atest AppEnumerationTests
Test: atest CtsProviderTestCases
Test: atest UriGrantsManagerServiceTest
Test: atest UriPermissionTest
Test: atest ContentProviderTest
Test: atest ContentResolverTest
Test: atest DownloadManagerTest
Test: atest MediaProviderTest
Change-Id: Iea2f2d8a83cbdef18592cb7cb5a8493b1a1f5362
---
 .../com/android/server/am/ActivityManagerService.java  | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java
index 2de091bb34bff..0c97724777342 100644
--- a/services/core/java/com/android/server/am/ActivityManagerService.java
+++ b/services/core/java/com/android/server/am/ActivityManagerService.java
@@ -5684,6 +5684,16 @@ public class ActivityManagerService extends IActivityManager.Stub
         if (pid == MY_PID) {
             return PackageManager.PERMISSION_GRANTED;
         }
+        try {
+            if (uid != 0) { // bypass the root
+                final String[] packageNames = getPackageManager().getPackagesForUid(uid);
+                if (ArrayUtils.isEmpty(packageNames)) {
+                    // The uid is not existed or not visible to the caller.
+                    return PackageManager.PERMISSION_DENIED;
+                }
+            }
+        } catch (RemoteException e) {
+        }
         return mUgmInternal.checkUriPermission(new GrantUri(userId, uri, modeFlags), uid, modeFlags)
                 ? PackageManager.PERMISSION_GRANTED : PackageManager.PERMISSION_DENIED;
     }