Remove redundant enforceCallingPermission()

This CL aims to simplify security checks for

  IInputMethodManager#onShellCommand().

Basically the calling UID check [1] remains to be the main security
policy for that IPC method.  Context#enforceCallingPermission() checks
added in later CLs [2][3] are just redundant with an assumption that
the shell package has those permissions.

For simplicity and readability, let's keep only the most relevant
security check for IMMS#onShellCommand() method.

 [1]: If87189563ccaacd4f9c666bab4f9ad08a9343084
      b8d240fa3f
 [2]: I6fd47b5cc1e7da7222774df20247a2c69a70f45b
      db25df71be
 [3]: If91137e0c144d90ac3046f30607e36bb957a7e0e
      8a2b96bb0a

Bug: 34886274
Test: atest CtsInputMethodServiceHostTestCases:ShellCommandFromAppTest
Change-Id: I19a6833bb7ff6100d4e9428243005377a7fbf432
This commit is contained in:
Yohei Yukawa
2022-07-25 14:46:58 +09:00
parent 0ac31bf658
commit ecac6fd64e

View File

@@ -64,7 +64,6 @@ import android.annotation.EnforcePermission;
import android.annotation.IntDef;
import android.annotation.NonNull;
import android.annotation.Nullable;
import android.annotation.RequiresPermission;
import android.annotation.UiThread;
import android.annotation.UserIdInt;
import android.app.ActivityManager;
@@ -5879,22 +5878,10 @@ public final class InputMethodManagerService extends IInputMethodManager.Stub
mService = service;
}
@RequiresPermission(allOf = {
Manifest.permission.DUMP,
Manifest.permission.INTERACT_ACROSS_USERS_FULL,
Manifest.permission.WRITE_SECURE_SETTINGS,
})
@BinderThread
@ShellCommandResult
@Override
public int onCommand(@Nullable String cmd) {
// For shell command, require all the permissions here in favor of code simplicity.
Arrays.asList(
Manifest.permission.DUMP,
Manifest.permission.INTERACT_ACROSS_USERS_FULL,
Manifest.permission.WRITE_SECURE_SETTINGS
).forEach(permission -> mService.mContext.enforceCallingPermission(permission, null));
final long identity = Binder.clearCallingIdentity();
try {
return onCommandWithSystemIdentity(cmd);