Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don\'t trust callers to supply app info to bindBackupAgent()

Browse Source 
am: c58054f25f

Change-Id: I3b0bd91c38b5f13770f09f39c2eea78b63c29d7c
This commit is contained in:
Christopher Tate
2016-06-16 22:21:37 +00:00
committed by android-build-merger
parent 0e64d7411e c58054f25f
commit cd777e95a7
4 changed files with 23 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
core/java/android/app/ActivityManagerNative.java
View File

@@ -1529,9 +1529,10 @@ public abstract class ActivityManagerNative extends Binder implements IActivityM
case START_BACKUP_AGENT_TRANSACTION: {
data.enforceInterface(IActivityManager.descriptor);
ApplicationInfo info = ApplicationInfo.CREATOR.createFromParcel(data);
String packageName = data.readString();
int backupRestoreMode = data.readInt();
boolean success = bindBackupAgent(info, backupRestoreMode);
int userId = data.readInt();
boolean success = bindBackupAgent(packageName, backupRestoreMode, userId);
reply.writeNoException();
reply.writeInt(success ? 1 : 0);
return true;
@@ -3591,13 +3592,14 @@ class ActivityManagerProxy implements IActivityManager
return binder;
}
public boolean bindBackupAgent(ApplicationInfo app, int backupRestoreMode)
public boolean bindBackupAgent(String packageName, int backupRestoreMode, int userId)
throws RemoteException {
Parcel data = Parcel.obtain();
Parcel reply = Parcel.obtain();
data.writeInterfaceToken(IActivityManager.descriptor);
app.writeToParcel(data, 0);
data.writeString(packageName);
data.writeInt(backupRestoreMode);
data.writeInt(userId);
mRemote.transact(START_BACKUP_AGENT_TRANSACTION, data, reply, 0);
reply.readException();
boolean success = reply.readInt() != 0;

2
core/java/android/app/IActivityManager.java
View File

@@ -176,7 +176,7 @@ public interface IActivityManager extends IInterface {
int res) throws RemoteException;
public IBinder peekService(Intent service, String resolvedType) throws RemoteException;
public boolean bindBackupAgent(ApplicationInfo appInfo, int backupRestoreMode)
public boolean bindBackupAgent(String packageName, int backupRestoreMode, int userId)
throws RemoteException;
public void clearPendingBackup() throws RemoteException;
public void backupAgentCreated(String packageName, IBinder agent) throws RemoteException;

3
services/backup/java/com/android/server/backup/BackupManagerService.java
View File

@@ -2118,7 +2118,8 @@ public class BackupManagerService {
mConnecting = true;
mConnectedAgent = null;
try {
if (mActivityManager.bindBackupAgent(app, mode)) {
if (mActivityManager.bindBackupAgent(app.packageName, mode,
UserHandle.USER_OWNER)) {
Slog.d(TAG, "awaiting agent for " + app);
// success; wait for the agent to arrive

16
services/core/java/com/android/server/am/ActivityManagerService.java
View File

@@ -15392,10 +15392,22 @@ public final class ActivityManagerService extends ActivityManagerNative
// Cause the target app to be launched if necessary and its backup agent
// instantiated. The backup agent will invoke backupAgentCreated() on the
// activity manager to announce its creation.
public boolean bindBackupAgent(ApplicationInfo app, int backupMode) {
if (DEBUG_BACKUP) Slog.v(TAG, "bindBackupAgent: app=" + app + " mode=" + backupMode);
public boolean bindBackupAgent(String packageName, int backupMode, int userId) {
if (DEBUG_BACKUP) Slog.v(TAG, "bindBackupAgent: app=" + packageName + " mode=" + backupMode);
enforceCallingPermission("android.permission.CONFIRM_FULL_BACKUP", "bindBackupAgent");
IPackageManager pm = AppGlobals.getPackageManager();
ApplicationInfo app = null;
try {
app = pm.getApplicationInfo(packageName, 0, userId);
} catch (RemoteException e) {
// can't happen; package manager is process-local
}
if (app == null) {
Slog.w(TAG, "Unable to bind backup agent for " + packageName);
return false;
}
synchronized(this) {
// !!! TODO: currently no check here that we're already bound
BatteryStatsImpl.Uid.Pkg.Serv ss = null;