From d752ea5f24ce50f407504ce99f56535d4cece8e2 Mon Sep 17 00:00:00 2001 From: Mugdha Lakhani Date: Thu, 29 Dec 2022 15:18:07 +0000 Subject: [PATCH] DO NOT MERGE Isolated processes must fail registering BRs. Broadcast Receivers should not be allowed to be registered by isolated processes. Bug: b/263358101 Test: atest SdkSandboxRestrictionsHostTest Change-Id: I5bb2ee3ce8a447105a18851fdffa5a769cc3fe49 (cherry picked from commit 43b8a91b0584dd1c6a136702e68e1f0cd519cb51) --- .../android/server/am/ActivityManagerService.java | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java index d78fe8628c601..c183c47c0fa62 100644 --- a/services/core/java/com/android/server/am/ActivityManagerService.java +++ b/services/core/java/com/android/server/am/ActivityManagerService.java @@ -13089,12 +13089,17 @@ public class ActivityManagerService extends IActivityManager.Stub public Intent registerReceiverWithFeature(IApplicationThread caller, String callerPackage, String callerFeatureId, String receiverId, IIntentReceiver receiver, IntentFilter filter, String permission, int userId, int flags) { + enforceNotIsolatedCaller("registerReceiver"); + // Allow Sandbox process to register only unexported receivers. - if ((flags & Context.RECEIVER_NOT_EXPORTED) != 0) { - enforceNotIsolatedCaller("registerReceiver"); - } else if (mSdkSandboxSettings.isBroadcastReceiverRestrictionsEnforced()) { - enforceNotIsolatedOrSdkSandboxCaller("registerReceiver"); + boolean unexported = (flags & Context.RECEIVER_NOT_EXPORTED) != 0; + if (mSdkSandboxSettings.isBroadcastReceiverRestrictionsEnforced() + && Process.isSdkSandboxUid(Binder.getCallingUid()) + && !unexported) { + throw new SecurityException("SDK sandbox process not allowed to call " + + "registerReceiver"); } + ArrayList stickyIntents = null; ProcessRecord callerApp = null; final boolean visibleToInstantApps