Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3d79d7e4 authored by Jackal Guo's avatar Jackal Guo
Browse files

Enforce owner rights check to get/setMimeGroup 

In the normal cases, the package name and the calling uid should be
from the same application. Adding this checking to get/setMimeGroup,
and moving the implementation to the internal variants. Also, guard
PackageSetting with the synchronized.

Bug: 184745603
Bug: 184745431
Test: atest CtsDynamicMimeHostTestCases
Test: manually using the PoC in the buganizer to ensure the symptom
      no longer exists.
Change-Id: Ic6956a55077ba4f3aed4df405b6db7219de8b267
parent 0a40c03e

services/core/java/com/android/server/pm/PackageManagerService.java

+19 −9
Original line number Diff line number Diff line
@@ -23078,16 +23078,17 @@ public class PackageManagerService extends IPackageManager.Stub 
        if (UserHandle.getAppId(callingUid) == Process.SYSTEM_UID) {

            return;

        }

        final String[] callerPackageNames = getPackagesForUid(callingUid);

        if (!ArrayUtils.contains(callerPackageNames, pkg)) {

            throw new SecurityException("Calling uid " + callingUid

                    + " does not own package " + pkg);

        }

        final int callingUserId = UserHandle.getUserId(callingUid);

        PackageInfo pi = getPackageInfo(pkg, 0, callingUserId);

        if (pi == null) {

            throw new IllegalArgumentException("Unknown package " + pkg + " on user "

                    + callingUserId);

        }

        if (!UserHandle.isSameApp(pi.applicationInfo.uid, callingUid)) {

            throw new SecurityException("Calling uid " + callingUid

                    + " does not own package " + pkg);

        }

    }















    @Override










@@ -27771,7 +27772,7 @@ public class PackageManagerService extends IPackageManager.Stub



























        @Override















        public List<String> getMimeGroup(String packageName, String mimeGroup) {













            return PackageManagerService.this.getMimeGroup(packageName, mimeGroup);













            return PackageManagerService.this.getMimeGroupInternal(packageName, mimeGroup);















        }





























        @Override










@@ -28397,9 +28398,11 @@ public class PackageManagerService extends IPackageManager.Stub



























    @Override















    public void setMimeGroup(String packageName, String mimeGroup, List<String> mimeTypes) {













        boolean changed = mSettings.getPackageLPr(packageName)













                .setMimeGroup(mimeGroup, mimeTypes);

























        enforceOwnerRights(packageName, Binder.getCallingUid());













        final boolean changed;













        synchronized (mLock) {













            changed = mSettings.getPackageLPr(packageName).setMimeGroup(mimeGroup, mimeTypes);













        }















        if (changed) {















            applyMimeGroupChanges(packageName, mimeGroup);















        }









@@ -28407,8 +28410,15 @@ public class PackageManagerService extends IPackageManager.Stub



























    @Override















    public List<String> getMimeGroup(String packageName, String mimeGroup) {













        enforceOwnerRights(packageName, Binder.getCallingUid());













        return getMimeGroupInternal(packageName, mimeGroup);













    }

























    private List<String> getMimeGroupInternal(String packageName, String mimeGroup) {













        synchronized (mLock) {















            return mSettings.getPackageLPr(packageName).getMimeGroup(mimeGroup);















        }













    }





























    @Override















    public void setSplashScreenTheme(@NonNull String packageName, @Nullable String themeId,