Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[DO NOT MERGE] Check caller's uid in backupAgentCreated callback

Browse Source 
AM.backupAgentCreated() should enforce that caller belongs the package called in the API.

Bug: 289549315
Test: atest android.security.cts.ActivityManagerTest#testActivityManager_backupAgentCreated_rejectIfCallerUidNotEqualsPackageUid
Change-Id: I9f3ae5ec0b8f00e020d471cc0eddf8bd8bdbb82d
This commit is contained in:
Piyush Mehrotra
2023-07-27 19:35:14 +00:00
parent 59704d24e0
commit 859abb58cd
1 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
services/core/java/com/android/server/am/ActivityManagerService.java
View File

@@ -3074,6 +3074,22 @@ public class ActivityManagerService extends IActivityManager.Stub
}
}
/**
* Enforces that the uid of the caller matches the uid of the package.
*
* @param packageName the name of the package to match uid against.
* @param callingUid the uid of the caller.
* @throws SecurityException if the calling uid doesn't match uid of the package.
*/
private void enforceCallingPackage(String packageName, int callingUid) {
final int userId = UserHandle.getUserId(callingUid);
final int packageUid = getPackageManagerInternal().getPackageUid(packageName,
/*flags=*/ 0, userId);
if (packageUid != callingUid) {
throw new SecurityException(packageName + " does not belong to uid " + callingUid);
}
}
@Override
public void setPackageScreenCompatMode(String packageName, int mode) {
mActivityTaskManager.setPackageScreenCompatMode(packageName, mode);
@@ -13618,13 +13634,16 @@ public class ActivityManagerService extends IActivityManager.Stub
// A backup agent has just come up
@Override
public void backupAgentCreated(String agentPackageName, IBinder agent, int userId) {
final int callingUid = Binder.getCallingUid();
enforceCallingPackage(agentPackageName, callingUid);
// Resolve the target user id and enforce permissions.
userId = mUserController.handleIncomingUser(Binder.getCallingPid(), Binder.getCallingUid(),
userId = mUserController.handleIncomingUser(Binder.getCallingPid(), callingUid,
userId, /* allowAll */ false, ALLOW_FULL_ONLY, "backupAgentCreated", null);
if (DEBUG_BACKUP) {
Slog.v(TAG_BACKUP, "backupAgentCreated: " + agentPackageName + " = " + agent
+ " callingUserId = " + UserHandle.getCallingUserId() + " userId = " + userId
+ " callingUid = " + Binder.getCallingUid() + " uid = " + Process.myUid());
+ " callingUid = " + callingUid + " uid = " + Process.myUid());
}
synchronized(this) {