From fe58d1c240953a90d4d96645bfad495317ad5026 Mon Sep 17 00:00:00 2001
From: Robin Lee <rgl@google.com>
Date: Thu, 2 Mar 2023 10:38:56 +0000
Subject: [PATCH] Only enforce caller is root for special commands

Commands like "adb shell cmd dreams", "adb shell cmd dreams dump",
and "adb shell cmd dreams help", should all work. Also, when the
other commands are called without being root, print the exception
to the PrintWriter instead of to logcat where it may not be
noticed.

Fix: 272000370
Change-Id: Ida3c9bdb8b54a8897fe8261222f4cb9b1a08e0e4
Test: adb shell cmd dreams help # accepted
Test: adb shell cmd dreams start-dreaming # rejected
---
 .../server/dreams/DreamShellCommand.java      | 36 ++++++++++---------
 1 file changed, 20 insertions(+), 16 deletions(-)

diff --git a/services/core/java/com/android/server/dreams/DreamShellCommand.java b/services/core/java/com/android/server/dreams/DreamShellCommand.java
index ab84ae4c08a22..df70a32c232ce 100644
--- a/services/core/java/com/android/server/dreams/DreamShellCommand.java
+++ b/services/core/java/com/android/server/dreams/DreamShellCommand.java
@@ -39,26 +39,24 @@ public class DreamShellCommand extends ShellCommand {
 
     @Override
     public int onCommand(String cmd) {
-        final int callingUid = Binder.getCallingUid();
-        if (callingUid != Process.ROOT_UID) {
-            Slog.e(TAG, "Must be root before calling Dream shell commands");
-            return -1;
-        }
-
-        if (TextUtils.isEmpty(cmd)) {
-            return super.handleDefaultCommands(cmd);
-        }
         if (DEBUG) {
             Slog.d(TAG, "onCommand:" + cmd);
         }
 
-        switch (cmd) {
-            case "start-dreaming":
-                return startDreaming();
-            case "stop-dreaming":
-                return stopDreaming();
-            default:
-                return super.handleDefaultCommands(cmd);
+        try {
+            switch (cmd) {
+                case "start-dreaming":
+                    enforceCallerIsRoot();
+                    return startDreaming();
+                case "stop-dreaming":
+                    enforceCallerIsRoot();
+                    return stopDreaming();
+                default:
+                    return super.handleDefaultCommands(cmd);
+            }
+        } catch (SecurityException e) {
+            getOutPrintWriter().println(e);
+            return -1;
         }
     }
 
@@ -72,6 +70,12 @@ public class DreamShellCommand extends ShellCommand {
         return 0;
     }
 
+    private void enforceCallerIsRoot() {
+        if (Binder.getCallingUid() != Process.ROOT_UID) {
+            throw new SecurityException("Must be root to call Dream shell commands");
+        }
+    }
+
     @Override
     public void onHelp() {
         PrintWriter pw = getOutPrintWriter();