Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb909e3c authored by Dianne Hackborn's avatar Dianne Hackborn
Browse files

Fix issue #31403654: Elevation of privilege vulnerability in deviceidle service 

Whoops, cleared the calling identity too soon.

Change-Id: I93e3daeafafe8ee8ac92b81011f50f08a83e5229
parent e422b0b2

services/core/java/com/android/server/DeviceIdleController.java

+28 −28
Original line number Diff line number Diff line
@@ -2726,12 +2726,12 @@ public class DeviceIdleController extends SystemService 
                }

            }

        } else if ("whitelist".equals(cmd)) {

            long token = Binder.clearCallingIdentity();

            try {

            String arg = shell.getNextArg();

            if (arg != null) {

                getContext().enforceCallingOrSelfPermission(

                        android.Manifest.permission.DEVICE_POWER, null);

                long token = Binder.clearCallingIdentity();

                try {

                    do {

                        if (arg.length() < 1 || (arg.charAt(0) != '-'

                                && arg.charAt(0) != '+' && arg.charAt(0) != '=')) {
@@ -2754,6 +2754,9 @@ public class DeviceIdleController extends SystemService 
                            pw.println(getPowerSaveWhitelistAppInternal(pkg));

                        }

                    } while ((arg=shell.getNextArg()) != null);

                } finally {

                    Binder.restoreCallingIdentity(token);

                }

            } else {

                synchronized (this) {

                    for (int j=0; j<mPowerSaveWhitelistAppsExceptIdle.size(); j++) {
@@ -2776,9 +2779,6 @@ public class DeviceIdleController extends SystemService 
                    }

                }

            }

            } finally {

                Binder.restoreCallingIdentity(token);

            }

        } else if ("tempwhitelist".equals(cmd)) {

            String opt;

            while ((opt=shell.getNextOption()) != null) {