Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 98a668f6 authored by Chien-Yu Chen's avatar Chien-Yu Chen
Browse files

Camera: Fix client permission check 

Modify StageFright's CameraSource to forward calling PID as
client PID when connecting to CameraService so CameraService
can check if the client PID has permission to use camera.

Change CameraService to check calling UID is trusted before
using the passed in client PID and client UID to verify permission.

Bug: 24511454
Change-Id: I4906ab73510e2c75714690bed675e3c13aca3ccf
parent 1f36e3b2

camera/Camera.cpp

+2 −2
Original line number Diff line number Diff line
@@ -72,9 +72,9 @@ Camera::~Camera() 
}



sp<Camera> Camera::connect(int cameraId, const String16& clientPackageName,

        int clientUid)

        int clientUid, int clientPid)

{

    return CameraBaseT::connect(cameraId, clientPackageName, clientUid);

    return CameraBaseT::connect(cameraId, clientPackageName, clientUid, clientPid);

}



status_t Camera::connectLegacy(int cameraId, int halVersion,

camera/CameraBase.cpp

+2 −2
Original line number Diff line number Diff line
@@ -92,7 +92,7 @@ const sp<ICameraService>& CameraBase<TCam, TCamTraits>::getCameraService() 
template <typename TCam, typename TCamTraits>

sp<TCam> CameraBase<TCam, TCamTraits>::connect(int cameraId,

                                               const String16& clientPackageName,

                                               int clientUid)

                                               int clientUid, int clientPid)

{

    ALOGV("%s: connect", __FUNCTION__);

    sp<TCam> c = new TCam(cameraId);
@@ -103,7 +103,7 @@ sp<TCam> CameraBase<TCam, TCamTraits>::connect(int cameraId, 
    if (cs != 0) {

        TCamConnectService fnConnectService = TCamTraits::fnConnectService;

        status = (cs.get()->*fnConnectService)(cl, cameraId, clientPackageName, clientUid,

                                             /*out*/ c->mCamera);

                                               clientPid, /*out*/ c->mCamera);

    }

    if (status == OK && c->mCamera != 0) {

        IInterface::asBinder(c->mCamera)->linkToDeath(c);

camera/ICameraService.cpp

+4 −2
Original line number Diff line number Diff line
@@ -172,7 +172,7 @@ public: 


    // connect to camera service (android.hardware.Camera)

    virtual status_t connect(const sp<ICameraClient>& cameraClient, int cameraId,

                             const String16 &clientPackageName, int clientUid,

                             const String16 &clientPackageName, int clientUid, int clientPid,

                             /*out*/

                             sp<ICamera>& device)

    {
@@ -182,6 +182,7 @@ public: 
        data.writeInt32(cameraId);

        data.writeString16(clientPackageName);

        data.writeInt32(clientUid);

        data.writeInt32(clientPid);



        status_t status;

        status = remote()->transact(BnCameraService::CONNECT, data, &reply);
@@ -396,9 +397,10 @@ status_t BnCameraService::onTransact( 
            int32_t cameraId = data.readInt32();

            const String16 clientName = data.readString16();

            int32_t clientUid = data.readInt32();

            int32_t clientPid = data.readInt32();

            sp<ICamera> camera;

            status_t status = connect(cameraClient, cameraId,

                    clientName, clientUid, /*out*/camera);

                    clientName, clientUid, clientPid, /*out*/camera);

            reply->writeNoException();

            reply->writeInt32(status);

            if (camera != NULL) {

include/camera/Camera.h

+5 −2
Original line number Diff line number Diff line
@@ -52,7 +52,7 @@ struct CameraTraits<Camera> 
    typedef ICamera               TCamUser;

    typedef ICameraClient         TCamCallbacks;

    typedef status_t (ICameraService::*TCamConnectService)(const sp<ICameraClient>&,

                                                           int, const String16&, int,

                                                           int, const String16&, int, int,

                                                           /*out*/

                                                           sp<ICamera>&);

    static TCamConnectService     fnConnectService;
@@ -67,12 +67,15 @@ public: 
    enum {

        USE_CALLING_UID = ICameraService::USE_CALLING_UID

    };

    enum {

        USE_CALLING_PID = ICameraService::USE_CALLING_PID

    };



            // construct a camera client from an existing remote

    static  sp<Camera>  create(const sp<ICamera>& camera);

    static  sp<Camera>  connect(int cameraId,

                                const String16& clientPackageName,

                                int clientUid);

                                int clientUid, int clientPid);



    static  status_t  connectLegacy(int cameraId, int halVersion,

                                     const String16& clientPackageName,

include/camera/CameraBase.h

+1 −1
Original line number Diff line number Diff line
@@ -61,7 +61,7 @@ public: 


    static sp<TCam>      connect(int cameraId,

                                 const String16& clientPackageName,

                                 int clientUid);

                                 int clientUid, int clientPid);

    virtual void         disconnect();



    void                 setListener(const sp<TCamListener>& listener);