Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3c92d74d authored by Pinyao Ting's avatar Pinyao Ting
Browse files

Verify caller before auto granting slice permission 

Currently SliceManagerService#checkSlicePermission does not verify the
caller's identity. This leads to a security vulnerability because
checkSlicePermission does more than checking the permission as opposed
to simply return a boolean value -- it additionally grants slice access
under a certain condition. A malicious app can spoof the calling package
to acquire slice access.

This CL verifies the caller before granting slice access.

Bug: 208232850, 179699767
Test: manual
Change-Id: I2539c9ff5ea977c91bb58185c95280b4d533a520
Merged-In: I2539c9ff5ea977c91bb58185c95280b4d533a520
(cherry picked from commit 5bd2196c)
parent 4d7ca1db

services/core/java/com/android/server/slice/SliceManagerService.java

+2 −0
Original line number Diff line number Diff line
@@ -237,6 +237,8 @@ public class SliceManagerService extends ISliceManager.Stub { 
        if (autoGrantPermissions != null && callingPkg != null) {

            // Need to own the Uri to call in with permissions to grant.

            enforceOwner(callingPkg, uri, userId);

            // b/208232850: Needs to verify caller before granting slice access

            verifyCaller(callingPkg);

            for (String perm : autoGrantPermissions) {

                if (mContext.checkPermission(perm, pid, uid) == PERMISSION_GRANTED) {

                    int providerUser = ContentProvider.getUserIdFromUri(uri, userId);