diff --git a/services/core/java/com/android/server/am/ActiveServices.java b/services/core/java/com/android/server/am/ActiveServices.java index 8cdffb7b1b13a..7a619db047125 100644 --- a/services/core/java/com/android/server/am/ActiveServices.java +++ b/services/core/java/com/android/server/am/ActiveServices.java @@ -2460,16 +2460,22 @@ public final class ActiveServices { && mAm.isValidSingletonCall(callingUid, sInfo.applicationInfo.uid)) { userId = 0; smap = getServiceMapLocked(0); - ResolveInfo rInfoForUserId0 = - mAm.getPackageManagerInternalLocked().resolveService(service, - resolvedType, flags, userId, callingUid); - if (rInfoForUserId0 == null) { - Slog.w(TAG_SERVICE, - "Unable to resolve service " + service + " U=" + userId - + ": not found"); - return null; + // Bypass INTERACT_ACROSS_USERS permission check + final long token = Binder.clearCallingIdentity(); + try { + ResolveInfo rInfoForUserId0 = + mAm.getPackageManagerInternalLocked().resolveService(service, + resolvedType, flags, userId, callingUid); + if (rInfoForUserId0 == null) { + Slog.w(TAG_SERVICE, + "Unable to resolve service " + service + " U=" + userId + + ": not found"); + return null; + } + sInfo = rInfoForUserId0.serviceInfo; + } finally { + Binder.restoreCallingIdentity(token); } - sInfo = rInfoForUserId0.serviceInfo; } sInfo = new ServiceInfo(sInfo); sInfo.applicationInfo = mAm.getAppInfoForUser(sInfo.applicationInfo, userId);