From a0c91aac274482dbdbf1808dba69b2cc324a268f Mon Sep 17 00:00:00 2001
From: Julia Reynolds <juliacr@google.com>
Date: Wed, 8 Dec 2021 11:25:42 -0500
Subject: [PATCH] Call into permission system with cleared binder identity

These methods are called when an app posts a notification
and cannot be called with the app's context

Test: enable the permission migration and post a notification
from a non-system app; atest PermissionHelperTest
Bug: 194833441

Change-Id: Ie19ccf0098b5bb93b9d192f4bdece7f1a689bab8
---
 .../server/notification/PermissionHelper.java | 44 +++++++++++++------
 1 file changed, 30 insertions(+), 14 deletions(-)

diff --git a/services/core/java/com/android/server/notification/PermissionHelper.java b/services/core/java/com/android/server/notification/PermissionHelper.java
index e64ec7792fcde..99cb6f03e6da2 100644
--- a/services/core/java/com/android/server/notification/PermissionHelper.java
+++ b/services/core/java/com/android/server/notification/PermissionHelper.java
@@ -27,6 +27,7 @@ import android.content.pm.IPackageManager;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
 import android.content.pm.ParceledListSlice;
+import android.os.Binder;
 import android.os.RemoteException;
 import android.permission.IPermissionManager;
 import android.util.ArrayMap;
@@ -73,7 +74,12 @@ public final class PermissionHelper {
      */
     public boolean hasPermission(int uid) {
         assertFlag();
-        return mPmi.checkUidPermission(uid, NOTIFICATION_PERMISSION) == PERMISSION_GRANTED;
+        final long callingId = Binder.clearCallingIdentity();
+        try {
+            return mPmi.checkUidPermission(uid, NOTIFICATION_PERMISSION) == PERMISSION_GRANTED;
+        } finally {
+            Binder.restoreCallingIdentity(callingId);
+        }
     }
 
     /**
@@ -185,27 +191,37 @@ public final class PermissionHelper {
 
     public boolean isPermissionFixed(String packageName, @UserIdInt int userId) {
         assertFlag();
+        final long callingId = Binder.clearCallingIdentity();
         try {
-            int flags = mPermManager.getPermissionFlags(packageName, NOTIFICATION_PERMISSION,
-                    userId);
-            return (flags & PackageManager.FLAG_PERMISSION_SYSTEM_FIXED) != 0
-                    || (flags & PackageManager.FLAG_PERMISSION_POLICY_FIXED) != 0;
-        } catch (RemoteException e) {
-            Slog.e(TAG, "Could not reach system server", e);
+            try {
+                int flags = mPermManager.getPermissionFlags(packageName, NOTIFICATION_PERMISSION,
+                        userId);
+                return (flags & PackageManager.FLAG_PERMISSION_SYSTEM_FIXED) != 0
+                        || (flags & PackageManager.FLAG_PERMISSION_POLICY_FIXED) != 0;
+            } catch (RemoteException e) {
+                Slog.e(TAG, "Could not reach system server", e);
+            }
+            return false;
+        } finally {
+            Binder.restoreCallingIdentity(callingId);
         }
-        return false;
     }
 
     boolean isPermissionUserSet(String packageName, @UserIdInt int userId) {
         assertFlag();
+        final long callingId = Binder.clearCallingIdentity();
         try {
-            int flags = mPermManager.getPermissionFlags(packageName, NOTIFICATION_PERMISSION,
-                    userId);
-            return (flags & PackageManager.FLAG_PERMISSION_USER_SET) != 0;
-        } catch (RemoteException e) {
-            Slog.e(TAG, "Could not reach system server", e);
+            try {
+                int flags = mPermManager.getPermissionFlags(packageName, NOTIFICATION_PERMISSION,
+                        userId);
+                return (flags & PackageManager.FLAG_PERMISSION_USER_SET) != 0;
+            } catch (RemoteException e) {
+                Slog.e(TAG, "Could not reach system server", e);
+            }
+            return false;
+        } finally {
+            Binder.restoreCallingIdentity(callingId);
         }
-        return false;
     }
 
     private void assertFlag() {