Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RESTRICT AUTOMERGE

Browse Source 
Do not set referrerUri on SessionInfo for non-owners

This change leaves the referrerUri field null when the caller leading to
its production is not the owner of the session.

Bug: 142125338
Test: Manual via test app in related bug
Change-Id: I84679ea0636aa2097e25e23813c48134c9cc1d75
This commit is contained in:
Patrick Baumann
2020-03-06 10:34:17 -08:00
committed by Sterling Huber
parent 09b011ffca
commit 929ab61a14
3 changed files with 51 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
core/java/android/content/pm/PackageInstaller.java
View File

@@ -1571,6 +1571,7 @@ public class PackageInstaller {
/**
* Get the value set in {@link SessionParams#setOriginatingUri(Uri)}.
* Note: This value will only be non-null for the owner of the session.
*/
public @Nullable Uri getOriginatingUri() {
return originatingUri;
@@ -1585,6 +1586,7 @@ public class PackageInstaller {
/**
* Get the value set in {@link SessionParams#setReferrerUri(Uri)}
* Note: This value will only be non-null for the owner of the session.
*/
public @Nullable Uri getReferrerUri() {
return referrerUri;

13
services/core/java/com/android/server/pm/PackageInstallerService.java
View File

@@ -683,20 +683,24 @@ public class PackageInstallerService extends IPackageInstaller.Stub {
public SessionInfo getSessionInfo(int sessionId) {
synchronized (mSessions) {
final PackageInstallerSession session = mSessions.get(sessionId);
return session != null ? session.generateInfo() : null;
return session != null
? session.generateInfoForCaller(true /*withIcon*/, Binder.getCallingUid())
: null;
}
}
@Override
public ParceledListSlice<SessionInfo> getAllSessions(int userId) {
mPm.enforceCrossUserPermission(Binder.getCallingUid(), userId, true, false, "getAllSessions");
final int callingUid = Binder.getCallingUid();
mPm.enforceCrossUserPermission(callingUid, userId, true, false, "getAllSessions");
final List<SessionInfo> result = new ArrayList<>();
synchronized (mSessions) {
for (int i = 0; i < mSessions.size(); i++) {
final PackageInstallerSession session = mSessions.valueAt(i);
if (session.userId == userId) {
result.add(session.generateInfo(false));
result.add(session.generateInfoForCaller(false, callingUid));
}
}
}
@@ -713,7 +717,8 @@ public class PackageInstallerService extends IPackageInstaller.Stub {
for (int i = 0; i < mSessions.size(); i++) {
final PackageInstallerSession session = mSessions.valueAt(i);
SessionInfo info = session.generateInfo(false);
SessionInfo info =
session.generateInfoForCaller(false /*withIcon*/, Process.SYSTEM_UID);
if (Objects.equals(info.getInstallerPackageName(), installerPackageName)
&& session.userId == userId) {
result.add(info);

46
services/core/java/com/android/server/pm/PackageInstallerSession.java
View File

@@ -386,11 +386,41 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub {
}
}
public SessionInfo generateInfo() {
return generateInfo(true);
/**
* Returns {@code true} if the {@link SessionInfo} object should be produced with potentially
* sensitive data scrubbed from its fields.
*
* @param callingUid the uid of the caller; the recipient of the {@link SessionInfo} that may
* need to be scrubbed
*/
private boolean shouldScrubData(int callingUid) {
return !(callingUid < Process.FIRST_APPLICATION_UID || getInstallerUid() == callingUid);
}
public SessionInfo generateInfo(boolean includeIcon) {
/**
* Generates a {@link SessionInfo} object for the provided uid. This may result in some fields
* that may contain sensitive info being filtered.
*
* @param includeIcon true if the icon should be included in the object
* @param callingUid the uid of the caller; the recipient of the {@link SessionInfo} that may
* need to be scrubbed
* @see #shouldScrubData(int)
*/
public SessionInfo generateInfoForCaller(boolean includeIcon, int callingUid) {
return generateInfoInternal(includeIcon, shouldScrubData(callingUid));
}
/**
* Generates a {@link SessionInfo} object to ensure proper hiding of sensitive fields.
*
* @param includeIcon true if the icon should be included in the object
* @see #generateInfoForCaller(boolean, int)
*/
public SessionInfo generateInfoScrubbed(boolean includeIcon) {
return generateInfoInternal(includeIcon, true /*scrubData*/);
}
private SessionInfo generateInfoInternal(boolean includeIcon, boolean scrubData) {
final SessionInfo info = new SessionInfo();
synchronized (mLock) {
info.sessionId = sessionId;
@@ -411,9 +441,13 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub {
info.appLabel = params.appLabel;
info.installLocation = params.installLocation;
info.originatingUri = params.originatingUri;
if (!scrubData) {
info.originatingUri = params.originatingUri;
}
info.originatingUid = params.originatingUid;
info.referrerUri = params.referrerUri;
if (!scrubData) {
info.referrerUri = params.referrerUri;
}
info.grantedRuntimePermissions = params.grantedRuntimePermissions;
info.installFlags = params.installFlags;
}
@@ -1490,7 +1524,7 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub {
// Send broadcast to default launcher only if it's a new install
final boolean isNewInstall = extras == null || !extras.getBoolean(Intent.EXTRA_REPLACING);
if (success && isNewInstall) {
mPm.sendSessionCommitBroadcast(generateInfo(), userId);
mPm.sendSessionCommitBroadcast(generateInfoScrubbed(true /*icon*/), userId);
}
mCallback.onSessionFinished(this, success);