Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 698c111a authored by Svetoslav's avatar Svetoslav Committed by The Android Automerger
Browse files

Content and settings shell commands passing invalid calling package.

Change-Id: Ia80099ba0afba054b70511c0d95265ec303446e0
parent 604ed5b7
Loading
Loading
Loading
Loading
+22 −4
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ import android.os.Binder;
import android.os.Bundle;
import android.os.IBinder;
import android.os.ParcelFileDescriptor;
import android.os.Process;
import android.os.UserHandle;
import android.text.TextUtils;

@@ -426,6 +427,22 @@ public class Content {
            }
        }

        public static String resolveCallingPackage() {
            switch (Process.myUid()) {
                case Process.ROOT_UID: {
                    return "root";
                }

                case Process.SHELL_UID: {
                    return "com.android.shell";
                }

                default: {
                    return null;
                }
            }
        }

        protected abstract void onExecute(IContentProvider provider) throws Exception;
    }

@@ -439,7 +456,7 @@ public class Content {

        @Override
        public void onExecute(IContentProvider provider) throws Exception {
            provider.insert(null, mUri, mContentValues);
            provider.insert(resolveCallingPackage(), mUri, mContentValues);
        }
    }

@@ -453,7 +470,7 @@ public class Content {

        @Override
        public void onExecute(IContentProvider provider) throws Exception {
            provider.delete(null, mUri, mWhere, null);
            provider.delete(resolveCallingPackage(), mUri, mWhere, null);
        }
    }

@@ -532,7 +549,8 @@ public class Content {

        @Override
        public void onExecute(IContentProvider provider) throws Exception {
            Cursor cursor = provider.query(null, mUri, mProjection, mWhere, null, mSortOrder, null);
            Cursor cursor = provider.query(resolveCallingPackage(), mUri, mProjection, mWhere,
                    null, mSortOrder, null);
            if (cursor == null) {
                System.out.println("No result found.");
                return;
@@ -594,7 +612,7 @@ public class Content {

        @Override
        public void onExecute(IContentProvider provider) throws Exception {
            provider.update(null, mUri, mContentValues, mWhere, null);
            provider.update(resolveCallingPackage(), mUri, mContentValues, mWhere, null);
        }
    }

+20 −4
Original line number Diff line number Diff line
@@ -24,12 +24,12 @@ import android.net.Uri;
import android.os.Binder;
import android.os.Bundle;
import android.os.IBinder;
import android.os.Process;
import android.os.RemoteException;
import android.os.UserHandle;
import android.provider.Settings;

public final class SettingsCmd {
    static final String TAG = "settings";

    enum CommandVerb {
        UNSPECIFIED,
@@ -188,7 +188,7 @@ public final class SettingsCmd {
        try {
            Bundle arg = new Bundle();
            arg.putInt(Settings.CALL_METHOD_USER_KEY, userHandle);
            Bundle b = provider.call(null, callGetCommand, key, arg);
            Bundle b = provider.call(resolveCallingPackage(), callGetCommand, key, arg);
            if (b != null) {
                result = b.getPairValue();
            }
@@ -213,7 +213,7 @@ public final class SettingsCmd {
            Bundle arg = new Bundle();
            arg.putString(Settings.NameValueTable.VALUE, value);
            arg.putInt(Settings.CALL_METHOD_USER_KEY, userHandle);
            provider.call(null, callPutCommand, key, arg);
            provider.call(resolveCallingPackage(), callPutCommand, key, arg);
        } catch (RemoteException e) {
            System.err.println("Can't set key " + key + " in " + table + " for user " + userHandle);
        }
@@ -232,7 +232,7 @@ public final class SettingsCmd {

        int num = 0;
        try {
            num = provider.delete(null, targetUri, null, null);
            num = provider.delete(resolveCallingPackage(), targetUri, null, null);
        } catch (RemoteException e) {
            System.err.println("Can't clear key " + key + " in " + table + " for user "
                    + userHandle);
@@ -247,4 +247,20 @@ public final class SettingsCmd {
        System.err.println("\n'namespace' is one of {system, secure, global}, case-insensitive");
        System.err.println("If '--user NUM' is not given, the operations are performed on the owner user.");
    }

    public static String resolveCallingPackage() {
        switch (android.os.Process.myUid()) {
            case Process.ROOT_UID: {
                return "root";
            }

            case Process.SHELL_UID: {
                return "com.android.shell";
            }

            default: {
                return null;
            }
        }
    }
}