Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 551df1db authored by Jing Ji's avatar Jing Ji Committed by Nolen Johnson
Browse files

Throw SecurityException as if no CLEAR_APP_USER_DATA permission 

...if the target package is protected for caller w/o MANAGE_USERS
in clearApplicationUserData.

Bug: 187956596
Test: Manual - see b/187956596#comment1
Change-Id: I9216201c753b1a5a954202cbde27f1d675cbf839
parent 06e6b898

services/core/java/com/android/server/am/ActivityManagerService.java

+21 −13
Original line number Diff line number Diff line
@@ -4241,31 +4241,39 @@ public class ActivityManagerService extends IActivityManager.Stub 
        long callingId = Binder.clearCallingIdentity();

        try {

            IPackageManager pm = AppGlobals.getPackageManager();

            boolean permitted = true;

            synchronized(this) {

                // Instant packages are not protected

                if (getPackageManagerInternalLocked().isPackageDataProtected(

                        resolvedUserId, packageName)) {

                    if (ActivityManager.checkUidPermission(android.Manifest.permission.MANAGE_USERS,

                            uid) == PERMISSION_GRANTED) {

                        // The caller has the MANAGE_USERS permission, tell them what's going on.

                        throw new SecurityException(

                                "Cannot clear data for a protected package: " + packageName);

                    } else {

                        permitted = false; // fall through and throw the SecurityException below.

                    }

                }















                ApplicationInfo applicationInfo = null;













                if (permitted) {















                    try {















                        applicationInfo = pm.getApplicationInfo(packageName,















                                MATCH_UNINSTALLED_PACKAGES, resolvedUserId);















                    } catch (RemoteException e) {















                        /* ignore */















                    }













                appInfo = applicationInfo;

























                final boolean clearingOwnUidData = appInfo != null && appInfo.uid == uid;

























                if (!clearingOwnUidData && checkComponentPermission(permission.CLEAR_APP_USER_DATA,













                        pid, uid, -1, true) != PackageManager.PERMISSION_GRANTED) {













                    permitted = (applicationInfo != null && applicationInfo.uid == uid) // own uid data













                            || (checkComponentPermission(permission.CLEAR_APP_USER_DATA,













                                    pid, uid, -1, true) == PackageManager.PERMISSION_GRANTED);













                }













                if (!permitted) {















                    throw new SecurityException("PID " + pid + " does not have permission "















                            + android.Manifest.permission.CLEAR_APP_USER_DATA + " to clear data"















                            + " of package " + packageName);















                }













                appInfo = applicationInfo;





























                final boolean hasInstantMetadata = getPackageManagerInternalLocked()















                        .hasInstantApplicationMetadata(packageName, resolvedUserId);