From f233a7b8b22ad5605c968cedd2822fa4e80c09f7 Mon Sep 17 00:00:00 2001 From: Nicolas Prevot Date: Thu, 22 May 2014 16:53:34 +0100 Subject: [PATCH] Correcting a bug related to Uri permissions. Making sure that an app cannot hold a permission for a uri on another user. We were allowing apps to hold permissions for a different user, which should not be the case for privacy reasons (an app could just access apps on another profile) As a consequence some of the cross profile share intents were not working because a check for the permission returned true so we did not separately grant permissions for uris. Granting permission for uris is required for accessing the content providers across users. BUG: 15559256 Change-Id: I70765eb659151ce0c5af06075a844143c09429e8 (cherry picked from commit e55e0a1741b9258af77e23e16aa95a6d9e6a5c6f) --- .../java/com/android/server/am/ActivityManagerService.java | 3 +++ 1 file changed, 3 insertions(+) diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java index 70327a69628c4..bd1baacc44f72 100644 --- a/services/core/java/com/android/server/am/ActivityManagerService.java +++ b/services/core/java/com/android/server/am/ActivityManagerService.java @@ -6030,6 +6030,9 @@ public final class ActivityManagerService extends ActivityManagerNative IPackageManager pm, ProviderInfo pi, GrantUri grantUri, int uid, final int modeFlags) { if (DEBUG_URI_PERMISSION) Slog.v(TAG, "checkHoldingPermissionsLocked: uri=" + grantUri + " uid=" + uid); + if (UserHandle.getUserId(uid) != grantUri.sourceUserId) { + return false; + } if (pi.applicationInfo.uid == uid) { return true;