Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 17b12dc0 authored by Alex Buynytskyy's avatar Alex Buynytskyy
Browse files

Don't wait on permission check. 

SELinux makes sure only system services can call installd.

Bug: 244657173
Fixes: 244657173
Test: presubmit
Test: adb bugreport, check that it has installd section
Change-Id: I27a77a12b025cfb27e774c2334e08facdcb4c77e
parent b0b42025

cmds/installd/InstalldNativeService.cpp

+1 −22
Original line number Diff line number Diff line
@@ -125,8 +125,6 @@ static std::once_flag flag; 


namespace {



constexpr const char* kDump = "android.permission.DUMP";



static binder::Status ok() {

    return binder::Status::ok();

}
@@ -150,19 +148,6 @@ static binder::Status error(uint32_t code, const std::string& msg) { 
    return binder::Status::fromServiceSpecificError(code, String8(msg.c_str()));

}



binder::Status checkPermission(const char* permission) {

    pid_t pid;

    uid_t uid;



    if (checkCallingPermission(String16(permission), reinterpret_cast<int32_t*>(&pid),

            reinterpret_cast<int32_t*>(&uid))) {

        return ok();

    } else {

        return exception(binder::Status::EX_SECURITY,

                StringPrintf("UID %d / PID %d lacks permission %s", uid, pid, permission));

    }

}



binder::Status checkUid(uid_t expectedUid) {

    uid_t uid = IPCThreadState::self()->getCallingUid();

    if (uid == expectedUid || uid == AID_ROOT) {
@@ -401,12 +386,6 @@ status_t InstalldNativeService::start() { 
}



status_t InstalldNativeService::dump(int fd, const Vector<String16>& /* args */) {

    const binder::Status dump_permission = checkPermission(kDump);

    if (!dump_permission.isOk()) {

        dprintf(fd, "%s\n", dump_permission.toString8().c_str());

        return PERMISSION_DENIED;

    }



    {

        std::lock_guard<std::recursive_mutex> lock(mMountsLock);

        dprintf(fd, "Storage mounts:\n");