Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cf72d72c authored by Kwangkyu Park's avatar Kwangkyu Park
Browse files

Camera: Clear identity before access device policy manager 

When cameraserver query device policy via CameraServiceProxy, the proxy
service uses identity of cameraserver. It causes SecurityException and
does not properly returns the actual query result.

Bug: 290329527
Test: Manual test with TestDPC
Change-Id: Ia02aab3276850c16a14b70c027bd03a17a601b8d
parent 9c30117b

services/core/java/com/android/server/camera/CameraServiceProxy.java

+17 −7
Original line number Diff line number Diff line
@@ -595,6 +595,13 @@ public class CameraServiceProxy extends SystemService 


        @Override

        public boolean isCameraDisabled(int userId) {

            if (Binder.getCallingUid() != Process.CAMERASERVER_UID) {

                Slog.e(TAG, "Calling UID: " + Binder.getCallingUid()

                        + " doesn't match expected camera service UID!");

                return false;

            }

            final long ident = Binder.clearCallingIdentity();

            try {

                DevicePolicyManager dpm = mContext.getSystemService(DevicePolicyManager.class);

                if (dpm == null) {

                    Slog.e(TAG, "Failed to get the device policy manager service");
@@ -606,6 +613,9 @@ public class CameraServiceProxy extends SystemService 
                    e.printStackTrace();

                    return false;

                }

            } finally {

                Binder.restoreCallingIdentity(ident);

            }

        }

    };