From 28a9850a8da2dd80920f5f3ff78f54ef5eedcf32 Mon Sep 17 00:00:00 2001 From: Cassie Wang Date: Thu, 22 Jul 2021 18:55:19 +0000 Subject: [PATCH 1/2] Rename the user-to-execute-as to "targetUser". Aligns it with more common conventions of "target" meaning the potentially different user we'll be executing as. And keeping "calling" to refer to the original user who made the request. Bug: 194413082 Test: presubmit Change-Id: Id762ed7be8da783f7372841b68e22f088a889b97 --- .../appsearch/AppSearchManagerService.java | 273 +++++++++++------- 1 file changed, 162 insertions(+), 111 deletions(-) diff --git a/apex/appsearch/service/java/com/android/server/appsearch/AppSearchManagerService.java b/apex/appsearch/service/java/com/android/server/appsearch/AppSearchManagerService.java index db23a6dc3047f..6a4f4db5ef246 100644 --- a/apex/appsearch/service/java/com/android/server/appsearch/AppSearchManagerService.java +++ b/apex/appsearch/service/java/com/android/server/appsearch/AppSearchManagerService.java @@ -332,17 +332,20 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); List schemas = new ArrayList<>(schemaBundles.size()); for (int i = 0; i < schemaBundles.size(); i++) { schemas.add(new AppSearchSchema(schemaBundles.get(i))); @@ -359,7 +362,7 @@ public class AppSearchManagerService extends SystemService { } schemasVisibleToPackages.put(entry.getKey(), packageIdentifiers); } - instance = mAppSearchUserInstanceManager.getUserInstance(callingUser); + instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); SetSchemaResponse setSchemaResponse = instance.getAppSearchImpl().setSchema( packageName, databaseName, @@ -418,15 +421,18 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(callback); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); AppSearchUserInstance instance = - mAppSearchUserInstanceManager.getUserInstance(callingUser); + mAppSearchUserInstanceManager.getUserInstance(targetUser); GetSchemaResponse response = instance.getAppSearchImpl().getSchema(packageName, databaseName); invokeCallbackOnResult( @@ -450,15 +456,18 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(callback); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); AppSearchUserInstance instance = - mAppSearchUserInstanceManager.getUserInstance(callingUser); + mAppSearchUserInstanceManager.getUserInstance(targetUser); List namespaces = instance.getAppSearchImpl().getNamespaces(packageName, databaseName); invokeCallbackOnResult( @@ -485,20 +494,23 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); AppSearchBatchResult.Builder resultBuilder = new AppSearchBatchResult.Builder<>(); - instance = mAppSearchUserInstanceManager.getUserInstance(callingUser); + instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); for (int i = 0; i < documentBundles.size(); i++) { GenericDocument document = new GenericDocument(documentBundles.get(i)); try { @@ -571,20 +583,23 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); AppSearchBatchResult.Builder resultBuilder = new AppSearchBatchResult.Builder<>(); - instance = mAppSearchUserInstanceManager.getUserInstance(callingUser); + instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); for (int i = 0; i < ids.size(); i++) { String id = ids.get(i); try { @@ -652,18 +667,21 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); - instance = mAppSearchUserInstanceManager.getUserInstance(callingUser); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); + instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); SearchResultPage searchResultPage = instance.getAppSearchImpl().query( packageName, databaseName, @@ -718,18 +736,21 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); - instance = mAppSearchUserInstanceManager.getUserInstance(callingUser); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); + instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); boolean callerHasSystemAccess = instance.getVisibilityStore().doesCallerHaveSystemAccess(packageName); @@ -783,17 +804,20 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(callback); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); // TODO(b/162450968) check nextPageToken is being advanced by the same uid as originally // opened it EXECUTOR.execute(() -> { try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); AppSearchUserInstance instance = - mAppSearchUserInstanceManager.getUserInstance(callingUser); + mAppSearchUserInstanceManager.getUserInstance(targetUser); SearchResultPage searchResultPage = instance.getAppSearchImpl().getNextPage(packageName, nextPageToken); invokeCallbackOnResult( @@ -812,15 +836,18 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(userHandle); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); AppSearchUserInstance instance = - mAppSearchUserInstanceManager.getUserInstance(callingUser); + mAppSearchUserInstanceManager.getUserInstance(targetUser); instance.getAppSearchImpl().invalidateNextPageToken(packageName, nextPageToken); } catch (Throwable t) { Log.e(TAG, "Unable to invalidate the query page token", t); @@ -846,15 +873,18 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(callback); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); AppSearchUserInstance instance = - mAppSearchUserInstanceManager.getUserInstance(callingUser); + mAppSearchUserInstanceManager.getUserInstance(targetUser); // we don't need to append the file. The file is always brand new. try (DataOutputStream outputStream = new DataOutputStream( new FileOutputStream(fileDescriptor.getFileDescriptor()))) { @@ -895,15 +925,18 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(callback); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); AppSearchUserInstance instance = - mAppSearchUserInstanceManager.getUserInstance(callingUser); + mAppSearchUserInstanceManager.getUserInstance(targetUser); GenericDocument document; ArrayList migrationFailureBundles = new ArrayList<>(); @@ -957,15 +990,18 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(callback); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); AppSearchUserInstance instance = - mAppSearchUserInstanceManager.getUserInstance(callingUser); + mAppSearchUserInstanceManager.getUserInstance(targetUser); if (systemUsage && !instance.getVisibilityStore() @@ -1004,20 +1040,23 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); AppSearchBatchResult.Builder resultBuilder = new AppSearchBatchResult.Builder<>(); - instance = mAppSearchUserInstanceManager.getUserInstance(callingUser); + instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); for (int i = 0; i < ids.size(); i++) { String id = ids.get(i); try { @@ -1090,18 +1129,21 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); - instance = mAppSearchUserInstanceManager.getUserInstance(callingUser); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); + instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); instance.getAppSearchImpl().removeByQuery( packageName, databaseName, @@ -1154,15 +1196,18 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(callback); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); AppSearchUserInstance instance = - mAppSearchUserInstanceManager.getUserInstance(callingUser); + mAppSearchUserInstanceManager.getUserInstance(targetUser); StorageInfo storageInfo = instance.getAppSearchImpl() .getStorageInfoForDatabase(packageName, databaseName); Bundle storageInfoBundle = storageInfo.getBundle(); @@ -1184,18 +1229,21 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); - instance = mAppSearchUserInstanceManager.getUserInstance(callingUser); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); + instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); instance.getAppSearchImpl().persistToDisk(PersistType.Code.FULL); ++operationSuccessCount; } catch (Throwable t) { @@ -1236,7 +1284,7 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle callingUser = handleIncomingUser(userHandle, callingUid); + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; @@ -1244,12 +1292,15 @@ public class AppSearchManagerService extends SystemService { int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context userContext = mContext.createContextAsUser(callingUser, /*flags=*/ 0); - verifyUserUnlocked(callingUser); - verifyCallingPackage(userContext, callingUser, callingUid, packageName); - verifyNotInstantApp(userContext, packageName); + Context targetUserContext = mContext.createContextAsUser(targetUser, + /*flags=*/ 0); + verifyUserUnlocked(targetUser); + // TODO(b/193902620): Pass in the callingUser and not the targetUser. + verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); + // TODO(b/194939218): Pass in the callingUser and not the targetUser. + verifyNotInstantApp(targetUserContext, packageName); instance = mAppSearchUserInstanceManager.getOrCreateUserInstance( - userContext, callingUser, AppSearchConfig.getInstance(EXECUTOR)); + targetUserContext, targetUser, AppSearchConfig.getInstance(EXECUTOR)); ++operationSuccessCount; invokeCallbackOnResult(callback, AppSearchResult.newSuccessfulResult(null)); } catch (Throwable t) { @@ -1354,26 +1405,26 @@ public class AppSearchManagerService extends SystemService { /** * Helper for dealing with incoming user arguments to system service calls. * - * @param requestedUser The user which the caller is requesting to execute as. + * @param targetUserHandle The user which the caller is requesting to execute as. * @param callingUid The actual uid of the caller as determined by Binder. * @return the user handle that the call should run as. Will always be a concrete user. */ @NonNull - private UserHandle handleIncomingUser(@NonNull UserHandle requestedUser, int callingUid) { - UserHandle callingUser = UserHandle.getUserHandleForUid(callingUid); - if (callingUser.equals(requestedUser)) { - return requestedUser; + private UserHandle handleIncomingUser(@NonNull UserHandle targetUserHandle, int callingUid) { + UserHandle callingUserHandle = UserHandle.getUserHandleForUid(callingUid); + if (callingUserHandle.equals(targetUserHandle)) { + return targetUserHandle; } // Duplicates UserController#ensureNotSpecialUser - if (requestedUser.getIdentifier() < 0) { + if (targetUserHandle.getIdentifier() < 0) { throw new IllegalArgumentException( - "Call does not support special user " + requestedUser); + "Call does not support special user " + targetUserHandle); } throw new SecurityException( - "Requested user, " + requestedUser + ", is not the same as the calling user, " - + callingUser + "."); + "Requested user, " + targetUserHandle + ", is not the same as the calling user, " + + callingUserHandle + "."); } /** From d5ecf755db10bf6bf6da39d0265910af06d64c87 Mon Sep 17 00:00:00 2001 From: Cassie Wang Date: Thu, 29 Jul 2021 22:22:30 +0000 Subject: [PATCH 2/2] Run verifications on callingUser, not targetUser. We have two verifications on each API call: 1) that the caller is not coming from an instant app, in which case it shouldn't have access to other app data, and 2) that the calling uid matches the caller's package name and user handle. We were previously running these checks on the targetUser, which could be different from the callingUser. This is one of the blockers re-enabling cross-user support. Bug: 193902620 Bug: 194939218 Test: atest -m -c --rebuild-module-info CtsAppSearchTestCases FrameworksCoreTests:android.app.appsearch FrameworksServicesTests:com.android.server.appsearch CtsAppSearchHostTestCases Change-Id: I9ef21efcbf26e2680c712867f05fd4adbf243b8e --- .../appsearch/AppSearchManagerService.java | 308 +++++++++--------- 1 file changed, 162 insertions(+), 146 deletions(-) diff --git a/apex/appsearch/service/java/com/android/server/appsearch/AppSearchManagerService.java b/apex/appsearch/service/java/com/android/server/appsearch/AppSearchManagerService.java index 6a4f4db5ef246..c33d5ecc5d164 100644 --- a/apex/appsearch/service/java/com/android/server/appsearch/AppSearchManagerService.java +++ b/apex/appsearch/service/java/com/android/server/appsearch/AppSearchManagerService.java @@ -332,20 +332,20 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + List schemas = new ArrayList<>(schemaBundles.size()); for (int i = 0; i < schemaBundles.size(); i++) { schemas.add(new AppSearchSchema(schemaBundles.get(i))); @@ -421,16 +421,16 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(callback); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + AppSearchUserInstance instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); GetSchemaResponse response = @@ -456,16 +456,16 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(callback); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + AppSearchUserInstance instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); List namespaces = @@ -494,20 +494,20 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + AppSearchBatchResult.Builder resultBuilder = new AppSearchBatchResult.Builder<>(); instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); @@ -583,20 +583,20 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + AppSearchBatchResult.Builder resultBuilder = new AppSearchBatchResult.Builder<>(); instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); @@ -667,20 +667,20 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); SearchResultPage searchResultPage = instance.getAppSearchImpl().query( packageName, @@ -736,20 +736,20 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); boolean callerHasSystemAccess = @@ -804,18 +804,16 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(callback); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); - // TODO(b/162450968) check nextPageToken is being advanced by the same uid as originally - // opened it EXECUTOR.execute(() -> { try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + AppSearchUserInstance instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); SearchResultPage searchResultPage = @@ -836,16 +834,16 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(userHandle); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + AppSearchUserInstance instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); instance.getAppSearchImpl().invalidateNextPageToken(packageName, nextPageToken); @@ -873,16 +871,16 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(callback); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + AppSearchUserInstance instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); // we don't need to append the file. The file is always brand new. @@ -925,16 +923,16 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(callback); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + AppSearchUserInstance instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); @@ -990,16 +988,16 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(callback); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + AppSearchUserInstance instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); @@ -1040,20 +1038,20 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + AppSearchBatchResult.Builder resultBuilder = new AppSearchBatchResult.Builder<>(); instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); @@ -1129,20 +1127,20 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); instance.getAppSearchImpl().removeByQuery( packageName, @@ -1196,16 +1194,16 @@ public class AppSearchManagerService extends SystemService { Objects.requireNonNull(callback); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + AppSearchUserInstance instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); StorageInfo storageInfo = instance.getAppSearchImpl() @@ -1229,20 +1227,20 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; AppSearchUserInstance instance = null; int operationSuccessCount = 0; int operationFailureCount = 0; try { - Context targetUserContext = mContext.createContextAsUser(targetUser, - /*flags=*/ 0); + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); + instance = mAppSearchUserInstanceManager.getUserInstance(targetUser); instance.getAppSearchImpl().persistToDisk(PersistType.Code.FULL); ++operationSuccessCount; @@ -1284,7 +1282,6 @@ public class AppSearchManagerService extends SystemService { long totalLatencyStartTimeMillis = SystemClock.elapsedRealtime(); int callingUid = Binder.getCallingUid(); - UserHandle targetUser = handleIncomingUser(userHandle, callingUid); EXECUTOR.execute(() -> { @AppSearchResult.ResultCode int statusCode = AppSearchResult.RESULT_OK; @@ -1292,13 +1289,16 @@ public class AppSearchManagerService extends SystemService { int operationSuccessCount = 0; int operationFailureCount = 0; try { + verifyCaller(callingUid, packageName); + + // Obtain the user where the client wants to run the operations in. This should + // end up being the same as userHandle, assuming it is not a special user and + // the client is allowed to run operations in that user. + UserHandle targetUser = handleIncomingUser(userHandle, callingUid); + verifyUserUnlocked(targetUser); + Context targetUserContext = mContext.createContextAsUser(targetUser, /*flags=*/ 0); - verifyUserUnlocked(targetUser); - // TODO(b/193902620): Pass in the callingUser and not the targetUser. - verifyCallingPackage(targetUserContext, targetUser, callingUid, packageName); - // TODO(b/194939218): Pass in the callingUser and not the targetUser. - verifyNotInstantApp(targetUserContext, packageName); instance = mAppSearchUserInstanceManager.getOrCreateUserInstance( targetUserContext, targetUser, AppSearchConfig.getInstance(EXECUTOR)); ++operationSuccessCount; @@ -1329,29 +1329,6 @@ public class AppSearchManagerService extends SystemService { }); } - private void verifyCallingPackage( - @NonNull Context userContext, - @NonNull UserHandle actualCallingUser, - int actualCallingUid, - @NonNull String claimedCallingPackage) { - Objects.requireNonNull(actualCallingUser); - Objects.requireNonNull(claimedCallingPackage); - - int claimedCallingUid = PackageUtil.getPackageUid( - userContext, claimedCallingPackage); - if (claimedCallingUid == INVALID_UID) { - throw new SecurityException( - "Specified calling package [" + claimedCallingPackage + "] not found"); - } - if (claimedCallingUid != actualCallingUid) { - throw new SecurityException( - "Specified calling package [" - + claimedCallingPackage - + "] does not match the calling uid " - + actualCallingUid); - } - } - /** Invokes the {@link IAppSearchResultCallback} with the result. */ private void invokeCallbackOnResult( IAppSearchResultCallback callback, AppSearchResult result) { @@ -1428,10 +1405,49 @@ public class AppSearchManagerService extends SystemService { } /** - * Helper for ensuring instant apps can't make calls to AppSearch. + * Verify various aspects of the calling user. + * + * @param callingUid Uid of the caller, usually retrieved from Binder for authenticity. + * @param claimedCallingPackage Package name the caller claims to be. + */ + private void verifyCaller(int callingUid, @NonNull String claimedCallingPackage) { + // Obtain the user where the client is running in. Note that this could be different from + // the userHandle where the client wants to run the AppSearch operation in. + UserHandle callingUserHandle = UserHandle.getUserHandleForUid(callingUid); + Context callingUserContext = mContext.createContextAsUser(callingUserHandle, + /*flags=*/ 0); + + verifyCallingPackage(callingUserContext, callingUid, claimedCallingPackage); + verifyNotInstantApp(callingUserContext, claimedCallingPackage); + } + + /** + * Check that the caller's supposed package name matches the uid making the call. + * + * @throws SecurityException if the package name and uid don't match. + */ + private void verifyCallingPackage( + @NonNull Context actualCallingUserContext, + int actualCallingUid, + @NonNull String claimedCallingPackage) { + int claimedCallingUid = PackageUtil.getPackageUid( + actualCallingUserContext, claimedCallingPackage); + if (claimedCallingUid == INVALID_UID) { + throw new SecurityException( + "Specified calling package [" + claimedCallingPackage + "] not found"); + } + if (claimedCallingUid != actualCallingUid) { + throw new SecurityException( + "Specified calling package [" + + claimedCallingPackage + + "] does not match the calling uid " + + actualCallingUid); + } + } + + /** + * Ensure instant apps can't make calls to AppSearch. * - * @param userContext Context of the user making the call. - * @param packageName Package name of the caller. * @throws SecurityException if the caller is an instant app. */ private void verifyNotInstantApp(@NonNull Context userContext, @NonNull String packageName) {