Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fcc515e3 authored by Jackal Guo's avatar Jackal Guo
Browse files

Enforce the calling identity 

As other pm commands, we should have the corresponding calling
identity check to avoid side channel information disclosure.

Bug: 250573325
Test: manually using the PoC in the buganizer to ensure the symptom
      no longer exists.
Test: PackageManagerServiceUnitTests:DomainVerificationEnforcerTest
Change-Id: Idd8045b8c00c51660d8d9b3f7b668b39d0e3e82f
parent 907060a9

services/core/java/com/android/server/pm/verify/domain/DomainVerificationService.java

+2 −0
Original line number Diff line number Diff line
@@ -1209,6 +1209,7 @@ public class DomainVerificationService extends SystemService 
    public void printOwnersForPackage(@NonNull IndentingPrintWriter writer,

            @Nullable String packageName, @Nullable @UserIdInt Integer userId)

            throws NameNotFoundException {

        mEnforcer.assertApprovedQuerent(mConnection.getCallingUid(), mProxy);

        final Computer snapshot = mConnection.snapshot();

        synchronized (mLock) {

            if (packageName == null) {
@@ -1257,6 +1258,7 @@ public class DomainVerificationService extends SystemService 
    @Override

    public void printOwnersForDomains(@NonNull IndentingPrintWriter writer,

            @NonNull List<String> domains, @Nullable @UserIdInt Integer userId) {

        mEnforcer.assertApprovedQuerent(mConnection.getCallingUid(), mProxy);

        final Computer snapshot = mConnection.snapshot();

        synchronized (mLock) {

            int size = domains.size();

services/tests/PackageManagerServiceTests/unit/src/com/android/server/pm/test/verify/domain/DomainVerificationEnforcerTest.kt

+14 −0
Original line number Diff line number Diff line
@@ -219,6 +219,20 @@ class DomainVerificationEnforcerTest { 
                    printState(mock(Computer::class.java), mock(IndentingPrintWriter::class.java),

                        null, null)

                },

                service(Type.QUERENT, "printOwnersForPackage") {

                    printOwnersForPackage(

                        mock(IndentingPrintWriter::class.java),

                        it.targetPackageName,

                        it.userId

                    )

                },

                service(Type.QUERENT, "printOwnersForDomains") {

                    printOwnersForDomains(

                        mock(IndentingPrintWriter::class.java),

                        listOf("example.com"),

                        it.userId

                    )

                },

                service(Type.VERIFIER, "setStatus") {

                    setDomainVerificationStatus(

                        it.targetDomainSetId,