Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix issue #31403654: Elevation of privilege vulnerability in deviceidle service

Browse Source 
Whoops, cleared the calling identity too soon.

Change-Id: I93e3daeafafe8ee8ac92b81011f50f08a83e5229
This commit is contained in:
Dianne Hackborn
2016-09-29 14:35:15 -07:00
parent e422b0b29f
commit eb909e3cda
1 changed files with 28 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
services/core/java/com/android/server/DeviceIdleController.java
View File

@@ -2726,12 +2726,12 @@ public class DeviceIdleController extends SystemService
} }
} }
} else if ("whitelist".equals(cmd)) { } else if ("whitelist".equals(cmd)) {
long token = Binder.clearCallingIdentity();
try {
String arg = shell.getNextArg(); String arg = shell.getNextArg();
if (arg != null) { if (arg != null) {
getContext().enforceCallingOrSelfPermission( getContext().enforceCallingOrSelfPermission(
android.Manifest.permission.DEVICE_POWER, null); android.Manifest.permission.DEVICE_POWER, null);
long token = Binder.clearCallingIdentity();
try {
do { do {
if (arg.length() < 1 || (arg.charAt(0) != '-' if (arg.length() < 1 || (arg.charAt(0) != '-'
&& arg.charAt(0) != '+' && arg.charAt(0) != '=')) { && arg.charAt(0) != '+' && arg.charAt(0) != '=')) {
@@ -2754,6 +2754,9 @@ public class DeviceIdleController extends SystemService
pw.println(getPowerSaveWhitelistAppInternal(pkg)); pw.println(getPowerSaveWhitelistAppInternal(pkg));
} }
} while ((arg=shell.getNextArg()) != null); } while ((arg=shell.getNextArg()) != null);
} finally {
Binder.restoreCallingIdentity(token);
}
} else { } else {
synchronized (this) { synchronized (this) {
for (int j=0; j<mPowerSaveWhitelistAppsExceptIdle.size(); j++) { for (int j=0; j<mPowerSaveWhitelistAppsExceptIdle.size(); j++) {
@@ -2776,9 +2779,6 @@ public class DeviceIdleController extends SystemService
} }
} }
} }
} finally {
Binder.restoreCallingIdentity(token);
}
} else if ("tempwhitelist".equals(cmd)) { } else if ("tempwhitelist".equals(cmd)) {
String opt; String opt;
while ((opt=shell.getNextOption()) != null) { while ((opt=shell.getNextOption()) != null) {