From 289e1b7813b872493fb945cbf8677ece38df6894 Mon Sep 17 00:00:00 2001 From: Rhed Jao Date: Tue, 6 Dec 2022 15:43:24 +0800 Subject: [PATCH] Enforce package visibility filter rules to the isTrusted api The api leaks packages that hold media control permission or notification listener enabled on the device. This cl uses package visibility rules to filter the caller and the package name. In normal cases, the package name passed to the api is the caller itself or an app that binds to the caller's session service. Both are legitimate to the package visibility rules. For caller passing arbitrary package names to the api declares package visibility in the manifest is necessary. Bug: 238862819 Test: atest MediaSessionManagerHostTest Test: atest MediaSessionManagerTest Test: atest CtsAppEnumerationTestCases Change-Id: I33579cb8203c8a9658372ba9ed12bb0cbb1155c6 --- .../java/com/android/server/media/MediaSessionService.java | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/services/core/java/com/android/server/media/MediaSessionService.java b/services/core/java/com/android/server/media/MediaSessionService.java index d08150cf0a56b..e51ed1b520a9c 100644 --- a/services/core/java/com/android/server/media/MediaSessionService.java +++ b/services/core/java/com/android/server/media/MediaSessionService.java @@ -2046,6 +2046,11 @@ public class MediaSessionService extends SystemService implements Monitor { int controllerUid) { final int uid = Binder.getCallingUid(); final int userId = UserHandle.getUserHandleForUid(uid).getIdentifier(); + if (LocalServices.getService(PackageManagerInternal.class) + .filterAppAccess(controllerPackageName, uid, userId)) { + // The controllerPackageName is not visible to the caller. + return false; + } final long token = Binder.clearCallingIdentity(); try { // Don't perform check between controllerPackageName and controllerUid.