Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 96655672 authored by Tom O'Neill's avatar Tom O'Neill Committed by xpduyson
Browse files

Fix exploit where can hide the fact that a location was mocked am: a206a0f1... 

Fix exploit where can hide the fact that a location was mocked am: a206a0f1 am: d417e548 am: 3380a775 am: 0a8978f0 am: 1684e5f3 am: d28eef0c am: 1f458fdc am: d82f8a67 am: 1ac8affd am: 56098f81 am: 7cec76de
am: 2da05d0f

Change-Id: I8c94a06f5fa722312436484609bafcb0585d6d18
parent ac3da968

services/java/com/android/server/LocationManagerService.java

+16 −1
Original line number Diff line number Diff line
@@ -58,6 +58,8 @@ import android.os.SystemClock; 
import android.os.UserHandle;

import android.os.WorkSource;

import android.provider.Settings;

import android.text.TextUtils;

import android.util.EventLog;

import android.util.Log;

import android.util.Slog;

import com.android.internal.content.PackageMonitor;
@@ -2382,9 +2384,22 @@ public class LocationManagerService extends ILocationManager.Stub { 
            if (mockProvider == null) {

                throw new IllegalArgumentException("Provider \"" + provider + "\" unknown");

            }



             // Ensure that the location is marked as being mock. There's some logic to do this in

             // handleLocationChanged(), but it fails if loc has the wrong provider (bug 33091107).

             Location mock = new Location(loc);

             mock.setIsFromMockProvider(true);



             if (!TextUtils.isEmpty(loc.getProvider()) && !provider.equals(loc.getProvider())) {

                 // The location has an explicit provider that is different from the mock provider

                 // name. The caller may be trying to fool us via bug 33091107.

                 EventLog.writeEvent(0x534e4554, "33091107", Binder.getCallingUid(),

                        provider + "!=" + loc.getProvider());

             }



            // clear calling identity so INSTALL_LOCATION_PROVIDER permission is not required

            long identity = Binder.clearCallingIdentity();

            mockProvider.setLocation(loc);

            mockProvider.setLocation(mock);

            Binder.restoreCallingIdentity(identity);

        }

    }