Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a0345676 authored by Rhed Jao's avatar Rhed Jao
Browse files

Enforce package visibility filters to am#getRunningServiceControlPanel 

Fix the side channel information disclosure of the package existence
caused by the am#getRunningServiceControlPanel api.

Bug: 232796464
Test: atest AppEnumerationTests
Change-Id: I0a8186670a60edfd295229df8b546dea72dad5f9
parent 011618a5

services/core/java/com/android/server/am/ActivityManagerService.java

+6 −0
Original line number Diff line number Diff line
@@ -12484,6 +12484,12 @@ public class ActivityManagerService extends IActivityManager.Stub 
    @Override

    public PendingIntent getRunningServiceControlPanel(ComponentName name) {

        enforceNotIsolatedCaller("getRunningServiceControlPanel");

        final int callingUid = Binder.getCallingUid();

        final int callingUserId = UserHandle.getUserId(callingUid);

        if (name == null || getPackageManagerInternal()

                .filterAppAccess(name.getPackageName(), callingUid, callingUserId)) {

            return null;

        }

        synchronized (this) {

            return mServices.getRunningServiceControlPanelLocked(name);

        }