Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Added permission checks for explicit grant while logging for getType calls."

Browse Source
This commit is contained in:
Ashish Kumar Gaurav
2023-01-25 17:09:39 +00:00
committed by Android (Google) Code Review
parent cf81e99dfc b0419cc11d
commit d1b629b27f
2 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
core/java/android/content/ContentProvider.java
View File

@@ -339,10 +339,17 @@ public abstract class ContentProvider implements ContentInterface, ComponentCall
final ProviderInfo cpi = mContext.getPackageManager()
.resolveContentProvider(uri.getAuthority(),
PackageManager.ComponentInfoFlags.of(PackageManager.GET_META_DATA));
final int callingUserId = UserHandle.getUserId(callingUid);
final Uri userUri = (mSingleUser
&& !UserHandle.isSameUser(mMyUid, callingUid))
? maybeAddUserId(uri, callingUserId) : uri;
if (cpi.forceUriPermissions
&& mInterface.checkUriPermission(uri,
callingUid, Intent.FLAG_GRANT_READ_URI_PERMISSION)
!= PermissionChecker.PERMISSION_GRANTED) {
!= PermissionChecker.PERMISSION_GRANTED
&& getContext().checkUriPermission(userUri, Binder.getCallingPid(),
callingUid, Intent.FLAG_GRANT_READ_URI_PERMISSION)
!= PackageManager.PERMISSION_GRANTED) {
FrameworkStatsLog.write(GET_TYPE_ACCESSED_WITHOUT_PERMISSION,
enumCheckUriPermission,
callingUid, uri.getAuthority(), type);

8
services/core/java/com/android/server/am/ContentProviderHelper.java
View File

@@ -1121,11 +1121,15 @@ public class ContentProviderHelper {
final String permissionCheck =
checkContentProviderPermission(cpi, callingPid, callingUid,
userId, checkUser, null);
if (permissionCheck != null) {
final boolean grantCheck = mService.checkUriPermission(uri, callingPid, callingUid,
Intent.FLAG_GRANT_READ_URI_PERMISSION , userId, null)
== PackageManager.PERMISSION_GRANTED;
if (!grantCheck && permissionCheck != null) {
FrameworkStatsLog.write(GET_TYPE_ACCESSED_WITHOUT_PERMISSION,
GET_TYPE_ACCESSED_WITHOUT_PERMISSION__LOCATION__AM_FRAMEWORK_PERMISSION,
callingUid, authority, type);
} else if (cpi.forceUriPermissions
} else if (!grantCheck && cpi.forceUriPermissions
&& holder.provider.checkUriPermission(attributionSource,
uri, callingUid, Intent.FLAG_GRANT_READ_URI_PERMISSION)
!= PermissionChecker.PERMISSION_GRANTED) {