Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2dfe92c2 authored by Jeff Sharkey's avatar Jeff Sharkey
Browse files

No direct Uri grants from system. 

The system should never be extending Uri permission grants from
itself, since it automatically holds all the permissions.  Instead,
the system should always be a mediator between two specific app, and
it should be using startActivityAsCaller() if it needs to extend
permissions.

Blocking at this level fixes an entire class of confused deputy
security issues.

Test: builds, normal intent resolution UI works
Bug: 33019296
Change-Id: Iaa57c393a386d8068e807d0dd0caccc89d8a11db
parent 2c0dc3e0

services/core/java/com/android/server/am/ActivityManagerService.java

+6 −1
Original line number Original line Diff line number Diff line
@@ -8103,7 +8103,12 @@ public class ActivityManagerService extends IActivityManager.Stub 
















        // Third...  does the caller itself have permission to access







        // Third...  does the caller itself have permission to access











        // this uri?







        // this uri?











        if (UserHandle.getAppId(callingUid) != Process.SYSTEM_UID) {







        final int callingAppId = UserHandle.getAppId(callingUid);














        if ((callingAppId == Process.SYSTEM_UID) || (callingAppId == Process.ROOT_UID)) {














            Slog.w(TAG, "For security reasons, the system cannot issue a Uri permission"














                    + " grant to " + grantUri + "; use startActivityAsCaller() instead");














            return -1;














        } else {











            if (!checkHoldingPermissionsLocked(pm, pi, grantUri, callingUid, modeFlags)) {







            if (!checkHoldingPermissionsLocked(pm, pi, grantUri, callingUid, modeFlags)) {











                // Require they hold a strong enough Uri permission







                // Require they hold a strong enough Uri permission











                if (!checkUriPermissionLocked(grantUri, callingUid, modeFlags)) {







                if (!checkUriPermissionLocked(grantUri, callingUid, modeFlags)) {