From b2ab2c414fcac5f68edd8d790d3773f1f9330e3b Mon Sep 17 00:00:00 2001
From: Tobias Thierer <tobiast@google.com>
Date: Mon, 19 Oct 2020 19:37:30 +0100
Subject: [PATCH] Enforce BACKUP permission on Service end.

BackupManager runs in the client process, whereas BackupManagerService
runs in the system server process. Therefore, apps permissions need should
be enforced on the service side.

Bug: 158482162
Test: Manually checked that a sample app  encounters SecurityException
      after but not before this CL, when running code similar to the
      sample in http://b/158482162#comment1 to figure out whether
      isBackupServiceActive() for its own uid.
Change-Id: I59693819542a80a065a9c88373393b0ba0dbef65
---
 core/java/android/app/backup/BackupManager.java                 | 2 --
 .../java/com/android/server/backup/BackupManagerService.java    | 2 ++
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/java/android/app/backup/BackupManager.java b/core/java/android/app/backup/BackupManager.java
index 05313592faa51..50b1b3d4b8456 100644
--- a/core/java/android/app/backup/BackupManager.java
+++ b/core/java/android/app/backup/BackupManager.java
@@ -445,8 +445,6 @@ public class BackupManager {
     @SystemApi
     @RequiresPermission(android.Manifest.permission.BACKUP)
     public boolean isBackupServiceActive(UserHandle user) {
-        mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP,
-                "isBackupServiceActive");
         checkServiceBinder();
         if (sService != null) {
             try {
diff --git a/services/backup/java/com/android/server/backup/BackupManagerService.java b/services/backup/java/com/android/server/backup/BackupManagerService.java
index 75bbec67c66e3..250d834921e4c 100644
--- a/services/backup/java/com/android/server/backup/BackupManagerService.java
+++ b/services/backup/java/com/android/server/backup/BackupManagerService.java
@@ -509,6 +509,8 @@ public class BackupManagerService extends IBackupManager.Stub {
      */
     @Override
     public boolean isBackupServiceActive(int userId) {
+        mContext.enforceCallingPermission(android.Manifest.permission.BACKUP,
+                "isBackupServiceActive");
         synchronized (mStateLock) {
             return !mGlobalDisable && isBackupActivatedForUser(userId);
         }