Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "[SettingsProvider] enforce @Readable for getAll*Settings methods" into sc-v2-dev

Browse Source
This commit is contained in:
Songchun Fan
2021-12-22 00:51:01 +00:00
committed by Android (Google) Code Review
parent c3ce07036b 704b302319
commit 827dd0bbda
1 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
View File

@@ -1338,6 +1338,13 @@ public class SettingsProvider extends ContentProvider {
// Anyone can get the global settings, so no security checks. // Anyone can get the global settings, so no security checks.
for (int i = 0; i < nameCount; i++) { for (int i = 0; i < nameCount; i++) {
String name = names.get(i); String name = names.get(i);
try {
enforceSettingReadable(name, SETTINGS_TYPE_GLOBAL,
UserHandle.getCallingUserId());
} catch (SecurityException e) {
// Caller doesn't have permission to read this setting
continue;
}
Setting setting = settingsState.getSettingLocked(name); Setting setting = settingsState.getSettingLocked(name);
appendSettingToCursor(result, setting); appendSettingToCursor(result, setting);
} }
@@ -1515,6 +1522,13 @@ public class SettingsProvider extends ContentProvider {
continue; continue;
} }
try {
enforceSettingReadable(name, SETTINGS_TYPE_SECURE, callingUserId);
} catch (SecurityException e) {
// Caller doesn't have permission to read this setting
continue;
}
// As of Android O, the SSAID is read from an app-specific entry in table // As of Android O, the SSAID is read from an app-specific entry in table
// SETTINGS_FILE_SSAID, unless accessed by a system process. // SETTINGS_FILE_SSAID, unless accessed by a system process.
final Setting setting; final Setting setting;
@@ -1777,7 +1791,12 @@ public class SettingsProvider extends ContentProvider {
for (int i = 0; i < nameCount; i++) { for (int i = 0; i < nameCount; i++) {
String name = names.get(i); String name = names.get(i);
try {
enforceSettingReadable(name, SETTINGS_TYPE_SYSTEM, callingUserId);
} catch (SecurityException e) {
// Caller doesn't have permission to read this setting
continue;
}
// Determine the owning user as some profile settings are cloned from the parent. // Determine the owning user as some profile settings are cloned from the parent.
final int owningUserId = resolveOwningUserIdForSystemSettingLocked(callingUserId, final int owningUserId = resolveOwningUserIdForSystemSettingLocked(callingUserId,
name); name);