Merge "Update READ_PHONE_NUMBER security checks" into rvc-dev am: b98be8b6a9 (32d2f79c) · Commits · e / os / android_frameworks_base

telephony/common/com/android/internal/telephony/TelephonyPermissions.java

+27 −3

Original line number	Diff line number	Diff line
		@@ -442,16 +442,40 @@ public final class TelephonyPermissions {
		// NOTE(b/73308711): If an app has one of the following AppOps bits explicitly revoked, they
		// will be denied access, even if they have another permission and AppOps bit if needed.

		// First, check if we can read the phone state and the SDK version is below R.
		// First, check if the SDK version is below R
		boolean preR = false;
		try {
		ApplicationInfo info = context.getPackageManager().getApplicationInfoAsUser(
		callingPackage, 0, UserHandle.getUserHandleForUid(Binder.getCallingUid()));
		if (info.targetSdkVersion <= Build.VERSION_CODES.Q) {
		preR = info.targetSdkVersion <= Build.VERSION_CODES.Q;
		} catch (PackageManager.NameNotFoundException nameNotFoundException) {
		}
		if (preR) {
		// SDK < R allows READ_PHONE_STATE, READ_PRIVILEGED_PHONE_STATE, or carrier privilege
		try {
		return checkReadPhoneState(
		context, subId, pid, uid, callingPackage, callingFeatureId, message);
		} catch (SecurityException readPhoneStateException) {
		}
		} else {
		// SDK >= R allows READ_PRIVILEGED_PHONE_STATE or carrier privilege
		try {
		context.enforcePermission(
		android.Manifest.permission.READ_PRIVILEGED_PHONE_STATE, pid, uid, message);
		// Skip checking for runtime permission since caller has privileged permission
		return true;
		} catch (SecurityException readPrivilegedPhoneStateException) {
		if (SubscriptionManager.isValidSubscriptionId(subId)) {
		try {
		enforceCarrierPrivilege(context, subId, uid, message);
		// Skip checking for runtime permission since caller has carrier privilege
		return true;
		} catch (SecurityException carrierPrivilegeException) {
		}
		} catch (SecurityException \| PackageManager.NameNotFoundException e) {
		}
		}
		}

		// Can be read with READ_SMS too.
		try {
		context.enforcePermission(android.Manifest.permission.READ_SMS, pid, uid, message);