Fix side channel disclosure via add or remove permission api
The application can read installed packages without requiring any permission via PackageManager#addPermission or PackageManager#removePermission API. The different messages of security exception were thrown from the API for the application to read installed packages information. This CL used the same exception message in the enforcePermissionTree to fix the issue. Bug: 186405104 Bug: 187408450 Test: Cannot reproduce vai PoC application Change-Id: I80b5c23c56b1652fdf6321cfdde12a4efa087163
This commit is contained in:
@@ -497,13 +497,10 @@ public final class Permission {
|
||||
if (permissionTree.getUid() == UserHandle.getAppId(callingUid)) {
|
||||
return permissionTree;
|
||||
}
|
||||
throw new SecurityException("Calling uid " + callingUid
|
||||
+ " is not allowed to add to permission tree "
|
||||
+ permissionTree.getName() + " owned by uid "
|
||||
+ permissionTree.getUid());
|
||||
}
|
||||
}
|
||||
throw new SecurityException("No permission tree found for " + permissionName);
|
||||
throw new SecurityException("Calling uid " + callingUid
|
||||
+ " is not allowed to add to or remove from the permission tree");
|
||||
}
|
||||
|
||||
@Nullable
|
||||
|
||||
Reference in New Issue
Block a user