From dbaecba45520f9183793312a87e84bdc1e09ca51 Mon Sep 17 00:00:00 2001 From: Kevin Chyn Date: Tue, 17 Dec 2019 17:01:44 -0800 Subject: [PATCH] Require permission check when caller's package name is keyguard Fixes: 128598130 Test: Auth on keyguard, auth on BiometricPromptDemo Change-Id: Ib6395a33c74c24c7ac7eaf1f10ee5f69946568e5 --- .../com/android/server/biometrics/BiometricServiceBase.java | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/services/core/java/com/android/server/biometrics/BiometricServiceBase.java b/services/core/java/com/android/server/biometrics/BiometricServiceBase.java index 98e07ab91141b..60f0e8e6c63de 100644 --- a/services/core/java/com/android/server/biometrics/BiometricServiceBase.java +++ b/services/core/java/com/android/server/biometrics/BiometricServiceBase.java @@ -16,6 +16,7 @@ package com.android.server.biometrics; +import static android.Manifest.permission.USE_BIOMETRIC_INTERNAL; import static android.app.ActivityManager.RunningAppProcessInfo.IMPORTANCE_FOREGROUND_SERVICE; import android.app.ActivityManager; @@ -1211,6 +1212,11 @@ public abstract class BiometricServiceBase extends SystemService * @return authenticator id for the calling user */ protected long getAuthenticatorId(String opPackageName) { + if (isKeyguard(opPackageName)) { + // If an app tells us it's keyguard, check that it actually is. + checkPermission(USE_BIOMETRIC_INTERNAL); + } + final int userId = getUserOrWorkProfileId(opPackageName, UserHandle.getCallingUserId()); return mAuthenticatorIds.getOrDefault(userId, 0L); }