Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 256cb47c authored by Martijn Coenen's avatar Martijn Coenen Committed by Dennis Cagle
Browse files

Android: binder: check set_context_mgr permission on time. 



Bug: 32394425
Change-Id: I860c6aab97850bff05a56e96cd3f4b41691bfd96
Signed-off-by: default avatarMartijn Coenen <maco@android.com>
Git-repo: https://android.googlesource.com/kernel/msm


Git-commit: 0d37d64f02e18a301867ae7684c3801bd99c5df2
Signed-off-by: default avatarDennis Cagle <d-cagle@codeaurora.org>
parent d044c402

drivers/staging/android/binder.c

+3 −3
Original line number Diff line number Diff line
@@ -2714,6 +2714,9 @@ static int binder_ioctl_set_ctx_mgr(struct file *filp) 
		ret = -EBUSY;

		goto out;

	}

	ret = security_binder_set_context_mgr(proc->tsk);

	if (ret < 0)

		goto out;

	if (uid_valid(binder_context_mgr_uid)) {

		if (!uid_eq(binder_context_mgr_uid, curr_euid)) {

			pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n",
@@ -2779,9 +2782,6 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		ret = binder_ioctl_set_ctx_mgr(filp);

		if (ret)

			goto err;

		ret = security_binder_set_context_mgr(proc->tsk);

		if (ret < 0)

			goto err;

		break;

	case BINDER_THREAD_EXIT:

		binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n",