Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bypass INTERACT_ACROSS_USERS permission check when binding to singleton service for non-0 userId

Browse Source 
BUG: 157822484
Test: manual
Change-Id: Iaf18a009cd7326e7a2f964a9813b11a9365f6ba3
This commit is contained in:
Songchun Fan
2020-06-01 11:23:29 -07:00
parent 89f29261cd
commit c05f30b494
1 changed files with 15 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
services/core/java/com/android/server/am/ActiveServices.java
View File

@@ -2460,16 +2460,22 @@ public final class ActiveServices {
&& mAm.isValidSingletonCall(callingUid, sInfo.applicationInfo.uid)) {
userId = 0;
smap = getServiceMapLocked(0);
ResolveInfo rInfoForUserId0 =
mAm.getPackageManagerInternalLocked().resolveService(service,
resolvedType, flags, userId, callingUid);
if (rInfoForUserId0 == null) {
Slog.w(TAG_SERVICE,
"Unable to resolve service " + service + " U=" + userId
+ ": not found");
return null;
// Bypass INTERACT_ACROSS_USERS permission check
final long token = Binder.clearCallingIdentity();
try {
ResolveInfo rInfoForUserId0 =
mAm.getPackageManagerInternalLocked().resolveService(service,
resolvedType, flags, userId, callingUid);
if (rInfoForUserId0 == null) {
Slog.w(TAG_SERVICE,
"Unable to resolve service " + service + " U=" + userId
+ ": not found");
return null;
}
sInfo = rInfoForUserId0.serviceInfo;
} finally {
Binder.restoreCallingIdentity(token);
}
sInfo = rInfoForUserId0.serviceInfo;
}
sInfo = new ServiceInfo(sInfo);
sInfo.applicationInfo = mAm.getAppInfoForUser(sInfo.applicationInfo, userId);