Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check component permissions like 'exported' before assigned permissions

Browse Source 
In particular, don't assume that the absence of an explicit permission
requirement means that the activity is freely launchable unless you have
also checked thing like exported="true" first.

Bug 23223804

Change-Id: Idbfd1f5662b374a7a447b738591b267a1c497e41
This commit is contained in:
Christopher Tate
2015-08-17 10:23:22 -07:00
parent ed7961eb5a
commit ff7add011a
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
services/core/java/com/android/server/am/ActivityStackSupervisor.java
View File

@@ -1687,16 +1687,16 @@ public final class ActivityStackSupervisor implements DisplayListener {
private int getComponentRestrictionForCallingPackage(ActivityInfo activityInfo,
String callingPackage, int callingPid, int callingUid, boolean ignoreTargetSecurity) {
if (activityInfo.permission == null) {
return ACTIVITY_RESTRICTION_NONE;
}
if (!ignoreTargetSecurity && mService.checkComponentPermission(activityInfo.permission,
callingPid, callingUid, activityInfo.applicationInfo.uid, activityInfo.exported)
== PackageManager.PERMISSION_DENIED) {
return ACTIVITY_RESTRICTION_PERMISSION;
}
if (activityInfo.permission == null) {
return ACTIVITY_RESTRICTION_NONE;
}
final int opCode = AppOpsManager.permissionToOpCode(activityInfo.permission);
if (opCode == AppOpsManager.OP_NONE) {
return ACTIVITY_RESTRICTION_NONE;