Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c5944b17 authored by Santiago Seifert's avatar Santiago Seifert
Browse files

Enforce MEDIA_CONTENT_CONTROL in verifyPackageName 

Also rename verifyPackageName to verifyPackageExists,
which probably reflects behavior a bit better.

Before this change, an app can use a direct binder
call to ask the system whether a package is installed
without having any permissions. Since the method now
requires MEDIA_CONTENT_CONTROL, we don't need
enforceMediaContentControlPermission anymore.

Bug: 205124386
Test: atest MediaRouter2HostSideTest CtsMediaBetterTogetherTestCases
Change-Id: I66723a00cf8b22b40aa0cd680a7dbe4bb71fddb6
parent b7a1333b

media/java/android/media/IMediaRouterService.aidl

+1 −2
Original line number Diff line number Diff line
@@ -50,8 +50,7 @@ interface IMediaRouterService { 
    // MediaRouterService.java for readability.



    // Methods for MediaRouter2

    boolean verifyPackageName(String clientPackageName);

    void enforceMediaContentControlPermission();

    boolean verifyPackageExists(String clientPackageName);

    List<MediaRoute2Info> getSystemRoutes();

    RoutingSessionInfo getSystemSessionInfo();

media/java/android/media/MediaRouter2.java

+3 −3
Original line number Diff line number Diff line
@@ -208,9 +208,9 @@ public final class MediaRouter2 { 
                IMediaRouterService.Stub.asInterface(

                        ServiceManager.getService(Context.MEDIA_ROUTER_SERVICE));

        try {

            // SecurityException will be thrown if there's no permission.

            serviceBinder.enforceMediaContentControlPermission();

            if (!serviceBinder.verifyPackageName(clientPackageName)) {

            // verifyPackageExists throws SecurityException if the caller doesn't hold

            // MEDIA_CONTENT_CONTROL permission.

            if (!serviceBinder.verifyPackageExists(clientPackageName)) {

                Log.e(TAG, "Package " + clientPackageName + " not found. Ignoring.");

                return null;

            }

services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java

+8 −15
Original line number Diff line number Diff line
@@ -154,10 +154,17 @@ class MediaRouter2ServiceImpl { 
    // Start of methods that implement MediaRouter2 operations.



    @NonNull

    public boolean verifyPackageName(@NonNull String clientPackageName) {

    public boolean verifyPackageExists(@NonNull String clientPackageName) {

        final int pid = Binder.getCallingPid();

        final int uid = Binder.getCallingUid();

        final long token = Binder.clearCallingIdentity();



        try {

            mContext.enforcePermission(

                    Manifest.permission.MEDIA_CONTENT_CONTROL,

                    pid,

                    uid,

                    "Must hold MEDIA_CONTENT_CONTROL permission.");

            PackageManager pm = mContext.getPackageManager();

            pm.getPackageInfo(clientPackageName, PackageManager.PackageInfoFlags.of(0));

            return true;
@@ -168,20 +175,6 @@ class MediaRouter2ServiceImpl { 
        }

    }



    @NonNull

    public void enforceMediaContentControlPermission() {

        final int pid = Binder.getCallingPid();

        final int uid = Binder.getCallingUid();

        final long token = Binder.clearCallingIdentity();



        try {

            mContext.enforcePermission(Manifest.permission.MEDIA_CONTENT_CONTROL, pid, uid,

                    "Must hold MEDIA_CONTENT_CONTROL permission.");

        } finally {

            Binder.restoreCallingIdentity(token);

        }

    }



    @NonNull

    public List<MediaRoute2Info> getSystemRoutes() {

        final int uid = Binder.getCallingUid();

services/core/java/com/android/server/media/MediaRouterService.java

+2 −8
Original line number Diff line number Diff line
@@ -380,14 +380,8 @@ public final class MediaRouterService extends IMediaRouterService.Stub 


    // Binder call

    @Override

    public boolean verifyPackageName(String clientPackageName) {

        return mService2.verifyPackageName(clientPackageName);

    }



    // Binder call

    @Override

    public void enforceMediaContentControlPermission() {

        mService2.enforceMediaContentControlPermission();

    public boolean verifyPackageExists(String clientPackageName) {

        return mService2.verifyPackageExists(clientPackageName);

    }



    // Binder call