Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[DO NOT MERGE] Check caller's uid in backupAgentCreated callback am: c31434d6a0

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/24308837

Change-Id: I238dbf50435d6fc7daf8c8a49d5cb2de3bd20a20
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Piyush Mehrotra
2023-08-08 15:42:26 +00:00
committed by Automerger Merge Worker
parent 5a613ecc28 c31434d6a0
commit 975f451f75
1 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
services/core/java/com/android/server/am/ActivityManagerService.java
View File

@@ -2988,6 +2988,22 @@ public class ActivityManagerService extends IActivityManager.Stub
}
}
/**
* Enforces that the uid of the caller matches the uid of the package.
*
* @param packageName the name of the package to match uid against.
* @param callingUid the uid of the caller.
* @throws SecurityException if the calling uid doesn't match uid of the package.
*/
private void enforceCallingPackage(String packageName, int callingUid) {
final int userId = UserHandle.getUserId(callingUid);
final int packageUid = getPackageManagerInternal().getPackageUid(packageName,
/*flags=*/ 0, userId);
if (packageUid != callingUid) {
throw new SecurityException(packageName + " does not belong to uid " + callingUid);
}
}
@Override
public void setPackageScreenCompatMode(String packageName, int mode) {
mActivityTaskManager.setPackageScreenCompatMode(packageName, mode);
@@ -12918,13 +12934,16 @@ public class ActivityManagerService extends IActivityManager.Stub
// A backup agent has just come up
@Override
public void backupAgentCreated(String agentPackageName, IBinder agent, int userId) {
final int callingUid = Binder.getCallingUid();
enforceCallingPackage(agentPackageName, callingUid);
// Resolve the target user id and enforce permissions.
userId = mUserController.handleIncomingUser(Binder.getCallingPid(), Binder.getCallingUid(),
userId = mUserController.handleIncomingUser(Binder.getCallingPid(), callingUid,
userId, /* allowAll */ false, ALLOW_FULL_ONLY, "backupAgentCreated", null);
if (DEBUG_BACKUP) {
Slog.v(TAG_BACKUP, "backupAgentCreated: " + agentPackageName + " = " + agent
+ " callingUserId = " + UserHandle.getCallingUserId() + " userId = " + userId
+ " callingUid = " + Binder.getCallingUid() + " uid = " + Process.myUid());
+ " callingUid = " + callingUid + " uid = " + Process.myUid());
}
synchronized(this) {