Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce the owner rights of dumpProfiles

Browse Source 
Move the ownership check to the beginning of the method to secure
the validity.

Bug: 185125569
Test: manually using the PoC in the buganizer to ensure the symptom
      no longer exists.
Test: manually using shell command to dump profiles.
Change-Id: I785d261b20fe15cb526b93acc40d2a875d38a94e
This commit is contained in:
Jackal Guo
2021-06-02 16:37:07 +08:00
parent 8257b7b3af
commit 7f6aaf5672
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
services/core/java/com/android/server/pm/PackageManagerService.java
View File

@@ -12888,6 +12888,15 @@ public class PackageManagerService extends IPackageManager.Stub
@Override
public void dumpProfiles(String packageName) {
/* Only the shell, root, or the app user should be able to dump profiles. */
final int callingUid = Binder.getCallingUid();
final String[] callerPackageNames = getPackagesForUid(callingUid);
if (callingUid != Process.SHELL_UID
&& callingUid != Process.ROOT_UID
&& !ArrayUtils.contains(callerPackageNames, packageName)) {
throw new SecurityException("dumpProfiles");
}
AndroidPackage pkg;
synchronized (mLock) {
pkg = mPackages.get(packageName);
@@ -12895,13 +12904,6 @@ public class PackageManagerService extends IPackageManager.Stub
throw new IllegalArgumentException("Unknown package: " + packageName);
}
}
/* Only the shell, root, or the app user should be able to dump profiles. */
int callingUid = Binder.getCallingUid();
if (callingUid != Process.SHELL_UID &&
callingUid != Process.ROOT_UID &&
callingUid != pkg.getUid()) {
throw new SecurityException("dumpProfiles");
}
synchronized (mInstallLock) {
Trace.traceBegin(TRACE_TAG_PACKAGE_MANAGER, "dump profiles");