Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7b7cca04 authored by Jack Yu's avatar Jack Yu
Browse files

Fixed UID mismatch in telephony registry 

Telephony registry is running in the system process. When receiving
the binder call from phone, after checking the permission, it should
perform actions in system's identity.

Bug: 271892778
Test: Boot up
Test: Basic phone functionality tests
Test: atest TelephonyRegistryTest
Change-Id: I761b9a73f7654eea14d08f7d2602978d32aedffc
parent 761cab9a

services/core/java/com/android/server/TelephonyRegistry.java

+49 −48
Original line number Diff line number Diff line
@@ -1672,18 +1672,20 @@ public class TelephonyRegistry extends ITelephonyRegistry.Stub { 
            return;

        }



        final long callingIdentity = Binder.clearCallingIdentity();

        try {

            synchronized (mRecords) {

            String str = "notifyServiceStateForSubscriber: subId=" + subId + " phoneId=" + phoneId

                    + " state=" + state;

                String str = "notifyServiceStateForSubscriber: subId=" + subId + " phoneId="

                        + phoneId + " state=" + state;

                if (VDBG) {

                    log(str);

                }

                mLocalLog.log(str);

            // for service state updates, don't notify clients when subId is invalid. This prevents

            // us from sending incorrect notifications like b/133140128

                // for service state updates, don't notify clients when subId is invalid. This

                // prevents us from sending incorrect notifications like b/133140128

                // In the future, we can remove this logic for every notification here and add a

            // callback so listeners know when their PhoneStateListener's subId becomes invalid, but

            // for now we use the simplest fix.

                // callback so listeners know when their PhoneStateListener's subId becomes invalid,

                // but for now we use the simplest fix.

                if (validatePhoneId(phoneId) && SubscriptionManager.isValidSubscriptionId(subId)) {

                    mServiceState[phoneId] = state;
@@ -1723,6 +1725,9 @@ public class TelephonyRegistry extends ITelephonyRegistry.Stub { 
                handleRemoveListLocked();

            }

            broadcastServiceStateChanged(state, phoneId, subId);

        } finally {

            Binder.restoreCallingIdentity(callingIdentity);

        }

    }



    public void notifySimActivationStateChangedForPhoneId(int phoneId, int subId,
@@ -3508,13 +3513,10 @@ public class TelephonyRegistry extends ITelephonyRegistry.Stub { 
    public static final String ACTION_SIGNAL_STRENGTH_CHANGED = "android.intent.action.SIG_STR";



    private void broadcastServiceStateChanged(ServiceState state, int phoneId, int subId) {

        final long ident = Binder.clearCallingIdentity();

        try {

            mBatteryStats.notePhoneState(state.getState());

        } catch (RemoteException re) {

            // Can't do much

        } finally {

            Binder.restoreCallingIdentity(ident);

        }



        // Send the broadcast exactly once to all possible disjoint sets of apps.
@@ -3531,8 +3533,7 @@ public class TelephonyRegistry extends ITelephonyRegistry.Stub { 
        // - Sanitized ServiceState sent to all other apps with READ_PHONE_STATE

        // - Sanitized ServiceState sent to all other apps with READ_PRIVILEGED_PHONE_STATE but not

        //   READ_PHONE_STATE

        if (Binder.withCleanCallingIdentity(() ->

                LocationAccessPolicy.isLocationModeEnabled(mContext, mContext.getUserId()))) {

        if (LocationAccessPolicy.isLocationModeEnabled(mContext, mContext.getUserId())) {

            Intent fullIntent = createServiceStateIntent(state, subId, phoneId, false);

            mContext.createContextAsUser(UserHandle.ALL, 0).sendBroadcastMultiplePermissions(

                    fullIntent,