Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 17badbcb authored by Sumedh Sen's avatar Sumedh Sen
Browse files

Check whether the correct callingUid has the necessary permissions 

Using callingUid from the Binder may not always check the correct
caller's permission - like when the calling identity is cleared or when
the check is initiated from the system server. Thus explicitly pass the
callingUid to check permissions.

Also update tests afftected by this change - by adding methods to mocked
objects

Bug: 334024639
Test: presubmits
Flag: EXEMPT. Bug fix only
Change-Id: I215e391016970b2aae197f98e387b8973c8e68ea
parent 73e56ea3

services/core/java/com/android/server/pm/ComputerEngine.java

+3 −3
Original line number Diff line number Diff line
@@ -2208,10 +2208,10 @@ public class ComputerEngine implements Computer { 
            return true;

        }

        boolean permissionGranted = requireFullPermission ? hasPermission(

                Manifest.permission.INTERACT_ACROSS_USERS_FULL)

                Manifest.permission.INTERACT_ACROSS_USERS_FULL, callingUid)

                : (hasPermission(

                        android.Manifest.permission.INTERACT_ACROSS_USERS_FULL)

                        || hasPermission(Manifest.permission.INTERACT_ACROSS_USERS));

                        android.Manifest.permission.INTERACT_ACROSS_USERS_FULL, callingUid)

                        || hasPermission(Manifest.permission.INTERACT_ACROSS_USERS, callingUid));

        if (!permissionGranted) {

            if (Process.isIsolatedUid(callingUid) && isKnownIsolatedComputeApp(callingUid)) {

                return checkIsolatedOwnerHasPermission(callingUid, requireFullPermission);

services/core/java/com/android/server/pm/LauncherAppsService.java

+1 −1
Original line number Diff line number Diff line
@@ -716,7 +716,7 @@ public class LauncherAppsService extends SystemService { 
                    visiblePackages.add(info.getActivityInfo().packageName);

                }

                final List<ApplicationInfo> installedPackages =

                        mPackageManagerInternal.getInstalledApplications(

                        mPackageManagerInternal.getInstalledApplicationsCrossUser(

                                /* flags= */ 0, user.getIdentifier(), callingUid);

                for (ApplicationInfo applicationInfo : installedPackages) {

                    if (!visiblePackages.contains(applicationInfo.packageName)) {

services/tests/PackageManagerComponentOverrideTests/src/com/android/server/pm/test/override/PackageManagerComponentLabelIconOverrideTest.kt

+5 −0
Original line number Diff line number Diff line
@@ -57,6 +57,7 @@ import org.junit.BeforeClass 
import org.junit.Test

import org.junit.runner.RunWith

import org.junit.runners.Parameterized

import org.mockito.ArgumentMatchers.eq

import org.mockito.Mockito.any

import org.mockito.Mockito.anyInt

import org.mockito.Mockito.doReturn
@@ -383,6 +384,10 @@ class PackageManagerComponentLabelIconOverrideTest { 
                    android.Manifest.permission.INTERACT_ACROSS_USERS_FULL)) {

                PackageManager.PERMISSION_GRANTED

            }

            whenever(this.checkPermission(

                eq(android.Manifest.permission.INTERACT_ACROSS_USERS_FULL), anyInt(), anyInt())) {

                PackageManager.PERMISSION_GRANTED

            }

        }

        val mockSharedLibrariesImpl: SharedLibrariesImpl = mock {

            whenever(this.snapshot()) { this@mock }