From ec3a20c2b28906247e7d13ae4af17c701dd5ee21 Mon Sep 17 00:00:00 2001 From: Brian Julian Date: Fri, 22 Apr 2022 20:28:49 +0000 Subject: [PATCH] DO NOT MERGE. Add a permissions check to LocationManagerService. Prevents apps from reading location requests of other users without INTERACT_ACROSS_USERS permission. Bug: 222473855 Test: Build Change-Id: Id591cd39ed7813c649b44d4a3210f0b1fb79b40d (cherry picked from commit 16560c093091b7ab390c16137618da6fd916d44e) --- .../android/server/location/LocationManagerService.java | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/services/core/java/com/android/server/location/LocationManagerService.java b/services/core/java/com/android/server/location/LocationManagerService.java index 31d5136c80a53..e5eed99284113 100644 --- a/services/core/java/com/android/server/location/LocationManagerService.java +++ b/services/core/java/com/android/server/location/LocationManagerService.java @@ -17,6 +17,7 @@ package com.android.server.location; import static android.Manifest.permission.ACCESS_FINE_LOCATION; +import static android.Manifest.permission.INTERACT_ACROSS_USERS; import static android.Manifest.permission.WRITE_SECURE_SETTINGS; import static android.app.compat.CompatChanges.isChangeEnabled; import static android.content.pm.PackageManager.MATCH_DIRECT_BOOT_AWARE; @@ -1030,8 +1031,10 @@ public class LocationManagerService extends ILocationManager.Stub implements @Override public void addProviderRequestListener(IProviderRequestListener listener) { - for (LocationProviderManager manager : mProviderManagers) { - manager.addProviderRequestListener(listener); + if (mContext.checkCallingOrSelfPermission(INTERACT_ACROSS_USERS) == PERMISSION_GRANTED) { + for (LocationProviderManager manager : mProviderManagers) { + manager.addProviderRequestListener(listener); + } } }