Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 464f5309 authored by Jim Miller's avatar Jim Miller
Browse files

Add permission check to AccountManagerService to allow keyguard access. 

When keyguard gets moved to its own process, it will need to access
specific user accounts in order to enable features such as the "forgot pattern"
button.  This adds an additional check to allow apps with the
INTERACT_ACROSS_USERS_FULL permission to work.

Change-Id: Id3107bc212ae3005870db781c32ae4405c068ad9
parent e84da7fa

services/java/com/android/server/accounts/AccountManagerService.java

+8 −2
Original line number Diff line number Diff line
@@ -1325,7 +1325,10 @@ public class AccountManagerService 
            int userId) {

        // Only allow the system process to read accounts of other users

        if (userId != UserHandle.getCallingUserId()

                && Binder.getCallingUid() != android.os.Process.myUid()) {

                && Binder.getCallingUid() != android.os.Process.myUid()

                && mContext.checkCallingOrSelfPermission(

                    android.Manifest.permission.INTERACT_ACROSS_USERS_FULL)

                    != PackageManager.PERMISSION_GRANTED) {

            throw new SecurityException("User " + UserHandle.getCallingUserId()

                    + " trying to confirm account credentials for " + userId);

        }
@@ -1583,7 +1586,10 @@ public class AccountManagerService 
    public Account[] getAccountsAsUser(String type, int userId) {

        // Only allow the system process to read accounts of other users

        if (userId != UserHandle.getCallingUserId()

                && Binder.getCallingUid() != android.os.Process.myUid()) {

                && Binder.getCallingUid() != android.os.Process.myUid()

                && mContext.checkCallingOrSelfPermission(

                    android.Manifest.permission.INTERACT_ACROSS_USERS_FULL)

                    != PackageManager.PERMISSION_GRANTED) {

            throw new SecurityException("User " + UserHandle.getCallingUserId()

                    + " trying to get account for " + userId);

        }