From 775fd4309f39bf8f2e1fd6de7a62635d4b297423 Mon Sep 17 00:00:00 2001
From: Bernardo Rufino <brufino@google.com>
Date: Fri, 8 Jun 2018 08:07:30 +0100
Subject: [PATCH] Protect unbindBackupAgent() with CONFIRM_FULL_BACKUP
 permission

To prevent any caller that is not signed w/ the platform certificate
from calling this method.

Bug: 79700331
Test: adb shell bmgr backupnow <package>, verify agents unbound
Change-Id: I1409f015772057c84b4879dcd65bb0aaf2429803
---
 .../core/java/com/android/server/am/ActivityManagerService.java  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java
index 900bf8fb607de..7048e055464b3 100644
--- a/services/core/java/com/android/server/am/ActivityManagerService.java
+++ b/services/core/java/com/android/server/am/ActivityManagerService.java
@@ -20588,6 +20588,7 @@ public class ActivityManagerService extends IActivityManager.Stub
     // done with this agent
     public void unbindBackupAgent(ApplicationInfo appInfo) {
         if (DEBUG_BACKUP) Slog.v(TAG_BACKUP, "unbindBackupAgent: " + appInfo);
+        enforceCallingPermission("android.permission.CONFIRM_FULL_BACKUP", "unbindBackupAgent");
         if (appInfo == null) {
             Slog.w(TAG, "unbind backup agent for null app");
             return;