Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3f4d33bd authored by Rhed Jao's avatar Rhed Jao
Browse files

Fix BlobStoreMultiUserTest checking signatures failed 

Starting from U, package manager enforces cross user visibility
checks for APIs checkSignatures and hasSigningCertificate. The
context of caller's user id should be assigned correctly.

Fix: 230695002
Test: atest BlobStoreMultiUserTest
Change-Id: Ic718e702cf21e514ebcf2fc4264909faf9ef5145
parent cc8b4fda

apex/blobstore/service/java/com/android/server/blob/BlobAccessMode.java

+20 −4
Original line number Diff line number Diff line
@@ -24,6 +24,8 @@ import android.annotation.IntDef; 
import android.annotation.NonNull;

import android.content.Context;

import android.content.pm.PackageManager;

import android.os.Binder;

import android.os.UserHandle;

import android.util.ArraySet;

import android.util.Base64;

import android.util.DebugUtils;
@@ -100,20 +102,21 @@ class BlobAccessMode { 
    }



    boolean isAccessAllowedForCaller(Context context,

            @NonNull String callingPackage, @NonNull String committerPackage) {

            @NonNull String callingPackage, int callingUid, int committerUid) {

        if ((mAccessType & ACCESS_TYPE_PUBLIC) != 0) {

            return true;

        }



        final PackageManager pm = context.getPackageManager();

        if ((mAccessType & ACCESS_TYPE_SAME_SIGNATURE) != 0) {

            if (pm.checkSignatures(committerPackage, callingPackage)

                    == PackageManager.SIGNATURE_MATCH) {

            if (checkSignatures(context, callingUid, committerUid)) {

                return true;

            }

        }



        if ((mAccessType & ACCESS_TYPE_ALLOWLIST) != 0) {

            final UserHandle callingUser = UserHandle.of(UserHandle.getUserId(callingUid));

            final PackageManager pm =

                    context.createContextAsUser(callingUser, 0 /* flags */).getPackageManager();

            for (int i = 0; i < mAllowedPackages.size(); ++i) {

                final PackageIdentifier packageIdentifier = mAllowedPackages.valueAt(i);

                if (packageIdentifier.packageName.equals(callingPackage)
@@ -127,6 +130,19 @@ class BlobAccessMode { 
        return false;

    }



    /**

     * Compare signatures for two packages of different users.

     */

    private boolean checkSignatures(Context context, int uid1, int uid2) {

        final long token = Binder.clearCallingIdentity();

        try {

            return context.getPackageManager().checkSignatures(uid1, uid2)

                    == PackageManager.SIGNATURE_MATCH;

        } finally {

            Binder.restoreCallingIdentity(token);

        }

    }



    int getAccessType() {

        return mAccessType;

    }

apex/blobstore/service/java/com/android/server/blob/BlobMetadata.java

+2 −2
Original line number Diff line number Diff line
@@ -293,7 +293,7 @@ class BlobMetadata { 
                // Check if the caller is allowed access as per the access mode specified

                // by the committer.

                if (committer.blobAccessMode.isAccessAllowedForCaller(mContext,

                        callingPackage, committer.packageName)) {

                        callingPackage, callingUid, committer.uid)) {

                    return true;

                }

            }
@@ -316,7 +316,7 @@ class BlobMetadata { 
                // Check if the caller is allowed access as per the access mode specified

                // by the committer.

                if (committer.blobAccessMode.isAccessAllowedForCaller(mContext,

                        callingPackage, committer.packageName)) {

                        callingPackage, callingUid, committer.uid)) {

                    return true;

                }

            }