From b80870eff7ad6e47009f11bf3ac688bd8b6bde83 Mon Sep 17 00:00:00 2001 From: John Wu Date: Wed, 2 Feb 2022 14:29:40 -0800 Subject: [PATCH] Prevent inheritKeyStoreKeys from taking effect on system UID apps When an app that used to share UID with system decided to leave shared UID, it should not be allowed to inherit all keys from its previous UID as that will nuke all system UID keys, breaking critical system functionality. Test: manual Bug: 216560195 Change-Id: I27eea398b7c2ec624f1239aee72755cfb8d50339 --- services/core/java/com/android/server/pm/AppDataHelper.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/services/core/java/com/android/server/pm/AppDataHelper.java b/services/core/java/com/android/server/pm/AppDataHelper.java index 9f086e6e4a616..d745a2325b229 100644 --- a/services/core/java/com/android/server/pm/AppDataHelper.java +++ b/services/core/java/com/android/server/pm/AppDataHelper.java @@ -48,8 +48,8 @@ import com.android.server.SystemServerInitThreadPool; import com.android.server.pm.dex.ArtManagerService; import com.android.server.pm.parsing.pkg.AndroidPackage; import com.android.server.pm.parsing.pkg.AndroidPackageUtils; -import com.android.server.pm.pkg.SELinuxUtil; import com.android.server.pm.pkg.PackageStateInternal; +import com.android.server.pm.pkg.SELinuxUtil; import dalvik.system.VMRuntime; @@ -549,6 +549,10 @@ final class AppDataHelper { } public void migrateKeyStoreData(int previousAppId, int appId) { + // If previous UID is system UID, declaring inheritKeyStoreKeys is not supported. + // Silently ignore the request to migrate keys. + if (previousAppId == Process.SYSTEM_UID) return; + for (int userId : mPm.resolveUserIds(UserHandle.USER_ALL)) { int srcUid = UserHandle.getUid(userId, previousAppId); int destUid = UserHandle.getUid(userId, appId);