Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d85a4ed2 authored by Christopher Tate's avatar Christopher Tate
Browse files

DO NOT MERGE: Don't trust callers to supply app info to bindBackupAgent() 

Get the canonical identity and metadata about the package from the
Package Manager at time of usage rather than rely on the caller to
have gotten things right, even when the caller has the system uid.

Bug 28795098

Change-Id: I62710b15bb601fdfedd68e32349168c10725eb45
parent 4e33c4f8

core/java/android/app/ActivityManagerNative.java

+6 −4
Original line number Diff line number Diff line
@@ -1434,9 +1434,10 @@ public abstract class ActivityManagerNative extends Binder implements IActivityM 
        

        case START_BACKUP_AGENT_TRANSACTION: {

            data.enforceInterface(IActivityManager.descriptor);

            ApplicationInfo info = ApplicationInfo.CREATOR.createFromParcel(data);

            String packageName = data.readString();

            int backupRestoreMode = data.readInt();

            boolean success = bindBackupAgent(info, backupRestoreMode);

            int userId = data.readInt();

            boolean success = bindBackupAgent(packageName, backupRestoreMode, userId);

            reply.writeNoException();

            reply.writeInt(success ? 1 : 0);

            return true;
@@ -3125,13 +3126,14 @@ class ActivityManagerProxy implements IActivityManager 
        return binder;

    }



    public boolean bindBackupAgent(ApplicationInfo app, int backupRestoreMode)

    public boolean bindBackupAgent(String packageName, int backupRestoreMode, int userId)

            throws RemoteException {

        Parcel data = Parcel.obtain();

        Parcel reply = Parcel.obtain();

        data.writeInterfaceToken(IActivityManager.descriptor);

        app.writeToParcel(data, 0);

        data.writeString(packageName);

        data.writeInt(backupRestoreMode);

        data.writeInt(userId);

        mRemote.transact(START_BACKUP_AGENT_TRANSACTION, data, reply, 0);

        reply.readException();

        boolean success = reply.readInt() != 0;

core/java/android/app/IActivityManager.java

+1 −1
Original line number Diff line number Diff line
@@ -163,7 +163,7 @@ public interface IActivityManager extends IInterface { 
            int res) throws RemoteException;

    public IBinder peekService(Intent service, String resolvedType) throws RemoteException;



    public boolean bindBackupAgent(ApplicationInfo appInfo, int backupRestoreMode)

    public boolean bindBackupAgent(String packageName, int backupRestoreMode, int userId)

            throws RemoteException;

    public void clearPendingBackup() throws RemoteException;

    public void backupAgentCreated(String packageName, IBinder agent) throws RemoteException;

services/java/com/android/server/BackupManagerService.java

+2 −1
Original line number Diff line number Diff line
@@ -1780,7 +1780,8 @@ class BackupManagerService extends IBackupManager.Stub { 
            mConnecting = true;

            mConnectedAgent = null;

            try {

                if (mActivityManager.bindBackupAgent(app, mode)) {

                if (mActivityManager.bindBackupAgent(app.packageName, mode,

                        UserHandle.USER_OWNER)) {

                    Slog.d(TAG, "awaiting agent for " + app);



                    // success; wait for the agent to arrive

services/java/com/android/server/am/ActivityManagerService.java

+14 −2
Original line number Diff line number Diff line
@@ -12823,10 +12823,22 @@ public final class ActivityManagerService extends ActivityManagerNative 
    // Cause the target app to be launched if necessary and its backup agent

    // instantiated.  The backup agent will invoke backupAgentCreated() on the

    // activity manager to announce its creation.

    public boolean bindBackupAgent(ApplicationInfo app, int backupMode) {

        if (DEBUG_BACKUP) Slog.v(TAG, "bindBackupAgent: app=" + app + " mode=" + backupMode);

    public boolean bindBackupAgent(String packageName, int backupMode, int userId) {

        if (DEBUG_BACKUP) Slog.v(TAG, "bindBackupAgent: app=" + packageName + " mode=" + backupMode);

        enforceCallingPermission("android.permission.CONFIRM_FULL_BACKUP", "bindBackupAgent");













        IPackageManager pm = AppGlobals.getPackageManager();













        ApplicationInfo app = null;













        try {













            app = pm.getApplicationInfo(packageName, 0, userId);













        } catch (RemoteException e) {













            // can't happen; package manager is process-local













        }













        if (app == null) {













            Slog.w(TAG, "Unable to bind backup agent for " + packageName);













            return false;













        }



























        synchronized(this) {















            // !!! TODO: currently no check here that we're already bound















            BatteryStatsImpl.Uid.Pkg.Serv ss = null;