Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 46ed73f7 authored by Sanjana Sunil's avatar Sanjana Sunil
Browse files

Avoid using UserHandle.isSameApp() in package check 

SDK sandbox processes created from the sandbox package do not have the
uid of the package - they use a separate uid range instead.
UserHandle.isSameApp() does not take this account when run for the
sandbox.

Instead, use the API PackageManagerService.isSameApp() that takes into
account the differences between sandbox package uid and sandbox process
uid.

Bug: 340172289
Test: atest IntentTest#testCreateChooser -- --enable-optional-parameterization --enable-parameterized-modules --module-parameter run_on_sdk_sandbox
Change-Id: Iedc34ccf8bb397059268eef373bb4eace7f7d99c
parent 67817d10

services/core/java/com/android/server/am/ActivityManagerService.java

+21 −23
Original line number Diff line number Diff line
@@ -5576,15 +5576,16 @@ public class ActivityManagerService extends IActivityManager.Stub 
            // security checking for it above.

            userId = UserHandle.USER_CURRENT;

        }

        try {















        if (owningUid != 0 && owningUid != SYSTEM_UID) {













                final int uid = AppGlobals.getPackageManager().getPackageUid(packageName,













                        MATCH_DEBUG_TRIAGED_MISSING, UserHandle.getUserId(owningUid));













                if (!UserHandle.isSameApp(owningUid, uid)) {













            if (!getPackageManagerInternal().isSameApp(













                    packageName,













                    MATCH_DEBUG_TRIAGED_MISSING,













                    owningUid,













                    UserHandle.getUserId(owningUid))) {















                String msg = "Permission Denial: getIntentSender() from pid="















                        + Binder.getCallingPid()















                        + ", uid=" + owningUid













                            + ", (need uid=" + uid + ")"















                        + " is not allowed to send as package " + packageName;















                Slog.w(TAG, msg);















                throw new SecurityException(msg);









@@ -5599,9 +5600,6 @@ public class ActivityManagerService extends IActivityManager.Stub













        return mPendingIntentController.getIntentSender(type, packageName, featureId,















                owningUid, userId, token, resultWho, requestCode, intents, resolvedTypes,















                flags, bOptions);













        } catch (RemoteException e) {













            throw new SecurityException(e);













        }















    }





























    @Override