Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

DO NOT MERGE: Don't trust callers to supply app info to bindBackupAgent()

Browse Source 
Get the canonical identity and metadata about the package from the
Package Manager at time of usage rather than rely on the caller to
have gotten things right, even when the caller has the system uid.

Bug 28795098

Change-Id: I62710b15bb601fdfedd68e32349168c10725eb45
This commit is contained in:
Christopher Tate
2016-06-10 17:59:44 -07:00
parent 4e33c4f8b1
commit d85a4ed283
4 changed files with 23 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
core/java/android/app/ActivityManagerNative.java
View File

@@ -1434,9 +1434,10 @@ public abstract class ActivityManagerNative extends Binder implements IActivityM
case START_BACKUP_AGENT_TRANSACTION: { case START_BACKUP_AGENT_TRANSACTION: {
data.enforceInterface(IActivityManager.descriptor); data.enforceInterface(IActivityManager.descriptor);
ApplicationInfo info = ApplicationInfo.CREATOR.createFromParcel(data); String packageName = data.readString();
int backupRestoreMode = data.readInt(); int backupRestoreMode = data.readInt();
boolean success = bindBackupAgent(info, backupRestoreMode); int userId = data.readInt();
boolean success = bindBackupAgent(packageName, backupRestoreMode, userId);
reply.writeNoException(); reply.writeNoException();
reply.writeInt(success ? 1 : 0); reply.writeInt(success ? 1 : 0);
return true; return true;
@@ -3125,13 +3126,14 @@ class ActivityManagerProxy implements IActivityManager
return binder; return binder;
} }
public boolean bindBackupAgent(ApplicationInfo app, int backupRestoreMode) public boolean bindBackupAgent(String packageName, int backupRestoreMode, int userId)
throws RemoteException { throws RemoteException {
Parcel data = Parcel.obtain(); Parcel data = Parcel.obtain();
Parcel reply = Parcel.obtain(); Parcel reply = Parcel.obtain();
data.writeInterfaceToken(IActivityManager.descriptor); data.writeInterfaceToken(IActivityManager.descriptor);
app.writeToParcel(data, 0); data.writeString(packageName);
data.writeInt(backupRestoreMode); data.writeInt(backupRestoreMode);
data.writeInt(userId);
mRemote.transact(START_BACKUP_AGENT_TRANSACTION, data, reply, 0); mRemote.transact(START_BACKUP_AGENT_TRANSACTION, data, reply, 0);
reply.readException(); reply.readException();
boolean success = reply.readInt() != 0; boolean success = reply.readInt() != 0;

2
core/java/android/app/IActivityManager.java
View File

@@ -163,7 +163,7 @@ public interface IActivityManager extends IInterface {
int res) throws RemoteException; int res) throws RemoteException;
public IBinder peekService(Intent service, String resolvedType) throws RemoteException; public IBinder peekService(Intent service, String resolvedType) throws RemoteException;
public boolean bindBackupAgent(ApplicationInfo appInfo, int backupRestoreMode) public boolean bindBackupAgent(String packageName, int backupRestoreMode, int userId)
throws RemoteException; throws RemoteException;
public void clearPendingBackup() throws RemoteException; public void clearPendingBackup() throws RemoteException;
public void backupAgentCreated(String packageName, IBinder agent) throws RemoteException; public void backupAgentCreated(String packageName, IBinder agent) throws RemoteException;

3
services/java/com/android/server/BackupManagerService.java
View File

@@ -1780,7 +1780,8 @@ class BackupManagerService extends IBackupManager.Stub {
mConnecting = true; mConnecting = true;
mConnectedAgent = null; mConnectedAgent = null;
try { try {
if (mActivityManager.bindBackupAgent(app, mode)) { if (mActivityManager.bindBackupAgent(app.packageName, mode,
UserHandle.USER_OWNER)) {
Slog.d(TAG, "awaiting agent for " + app); Slog.d(TAG, "awaiting agent for " + app);
// success; wait for the agent to arrive // success; wait for the agent to arrive

16
services/java/com/android/server/am/ActivityManagerService.java
View File

@@ -12823,10 +12823,22 @@ public final class ActivityManagerService extends ActivityManagerNative
// Cause the target app to be launched if necessary and its backup agent // Cause the target app to be launched if necessary and its backup agent
// instantiated. The backup agent will invoke backupAgentCreated() on the // instantiated. The backup agent will invoke backupAgentCreated() on the
// activity manager to announce its creation. // activity manager to announce its creation.
public boolean bindBackupAgent(ApplicationInfo app, int backupMode) { public boolean bindBackupAgent(String packageName, int backupMode, int userId) {
if (DEBUG_BACKUP) Slog.v(TAG, "bindBackupAgent: app=" + app + " mode=" + backupMode); if (DEBUG_BACKUP) Slog.v(TAG, "bindBackupAgent: app=" + packageName + " mode=" + backupMode);
enforceCallingPermission("android.permission.CONFIRM_FULL_BACKUP", "bindBackupAgent"); enforceCallingPermission("android.permission.CONFIRM_FULL_BACKUP", "bindBackupAgent");
IPackageManager pm = AppGlobals.getPackageManager();
ApplicationInfo app = null;
try {
app = pm.getApplicationInfo(packageName, 0, userId);
} catch (RemoteException e) {
// can't happen; package manager is process-local
}
if (app == null) {
Slog.w(TAG, "Unable to bind backup agent for " + packageName);
return false;
}
synchronized(this) { synchronized(this) {
// !!! TODO: currently no check here that we're already bound // !!! TODO: currently no check here that we're already bound
BatteryStatsImpl.Uid.Pkg.Serv ss = null; BatteryStatsImpl.Uid.Pkg.Serv ss = null;