From 6ea76aa7e52e3fe8d7a1386c88e7df3431553077 Mon Sep 17 00:00:00 2001 From: Michael Groover Date: Mon, 21 Mar 2022 17:28:33 -0700 Subject: [PATCH] Only allow root/system UIDs to send broadcast to unexported receiver Android T introduced new flags to specify whether a runtime receiver should be exported to other apps on the device. Initially, an unexported runtime receiver could receive broadcasts from any app with a UID that passed the Process#isCoreUid check, but this behavior differs from that of unexported manifest receivers which can only receive broadcasts from the system and root UIDs. This commit updates the behavior of runtime receivers registered with the RECEIVER_NOT_EXPORTED flag to only allow broadcasts to be sent from the local app, system, and root UIDs. Bug: 225999840 Test: atest ContextTest Change-Id: Idc2c42dda58d54859e9beb8bd8baf3810aeabefc --- .../core/java/com/android/server/am/BroadcastQueue.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/services/core/java/com/android/server/am/BroadcastQueue.java b/services/core/java/com/android/server/am/BroadcastQueue.java index ea63c080cf68a..6ab18d532ac04 100644 --- a/services/core/java/com/android/server/am/BroadcastQueue.java +++ b/services/core/java/com/android/server/am/BroadcastQueue.java @@ -869,9 +869,9 @@ public final class BroadcastQueue { // Ensure that broadcasts are only sent to other apps if they are explicitly marked as // exported, or are System level broadcasts - if (!skip && !filter.exported && !Process.isCoreUid(r.callingUid) - && filter.receiverList.uid != r.callingUid) { - + if (!skip && !filter.exported && mService.checkComponentPermission(null, r.callingPid, + r.callingUid, filter.receiverList.uid, filter.exported) + != PackageManager.PERMISSION_GRANTED) { Slog.w(TAG, "Exported Denial: sending " + r.intent.toString() + ", action: " + r.intent.getAction()