Merge "Bluetooth: Check if packageName belongs to callingUid in binder calls" into qt-dev (42426472) · Commits · e / os / android_packages_modules_Bluetooth

service/java/com/android/server/bluetooth/BluetoothManagerService.java

+48 −1

Original line number	Diff line number	Diff line
		@@ -19,6 +19,7 @@ package com.android.server;
		import android.Manifest;
		import android.app.ActivityManager;
		import android.app.AppGlobals;
		import android.app.AppOpsManager;
		import android.bluetooth.BluetoothAdapter;
		import android.bluetooth.BluetoothProfile;
		import android.bluetooth.BluetoothProtoEnums;
		@@ -210,6 +211,8 @@ class BluetoothManagerService extends IBluetoothManager.Stub {

		private boolean mIsHearingAidProfileSupported;

		private AppOpsManager mAppOps;

		// Save a ProfileServiceConnections object for each of the bound
		// bluetooth profile services
		private final Map<Integer, ProfileServiceConnections> mProfileServices = new HashMap<>();
		@@ -742,6 +745,12 @@ class BluetoothManagerService extends IBluetoothManager.Stub {
		}

		public int updateBleAppCount(IBinder token, boolean enable, String packageName) {
		// Check if packageName belongs to callingUid
		final int callingUid = Binder.getCallingUid();
		final boolean isCallerSystem = UserHandle.getAppId(callingUid) == Process.SYSTEM_UID;
		if (!isCallerSystem) {
		checkPackage(callingUid, packageName);
		}
		ClientDeathRecipient r = mBleApps.get(token);
		if (r == null && enable) {
		ClientDeathRecipient deathRec = new ClientDeathRecipient(packageName);
		@@ -857,6 +866,13 @@ class BluetoothManagerService extends IBluetoothManager.Stub {
		return false;
		}

		// Check if packageName belongs to callingUid
		final int callingUid = Binder.getCallingUid();
		final boolean isCallerSystem = UserHandle.getAppId(callingUid) == Process.SYSTEM_UID;
		if (!isCallerSystem) {
		checkPackage(callingUid, packageName);
		}

		mContext.enforceCallingOrSelfPermission(BLUETOOTH_ADMIN_PERM,
		"Need BLUETOOTH ADMIN permission");

		@@ -864,7 +880,7 @@ class BluetoothManagerService extends IBluetoothManager.Stub {
		Slog.d(TAG, "enableNoAutoConnect(): mBluetooth =" + mBluetooth + " mBinding = "
		+ mBinding);
		}
		int callingAppId = UserHandle.getAppId(Binder.getCallingUid());
		int callingAppId = UserHandle.getAppId(callingUid);

		if (callingAppId != Process.NFC_UID) {
		throw new SecurityException("no permission to enable Bluetooth quietly");
		@@ -891,6 +907,9 @@ class BluetoothManagerService extends IBluetoothManager.Stub {
		}

		if (!callerSystem) {
		// Check if packageName belongs to callingUid
		checkPackage(callingUid, packageName);

		if (!checkIfCallerIsForegroundUser()) {
		Slog.w(TAG, "enable(): not allowed for non-active and non system user");
		return false;
		@@ -928,6 +947,9 @@ class BluetoothManagerService extends IBluetoothManager.Stub {
		final boolean callerSystem = UserHandle.getAppId(callingUid) == Process.SYSTEM_UID;

		if (!callerSystem) {
		// Check if packageName belongs to callingUid
		checkPackage(callingUid, packageName);

		if (!checkIfCallerIsForegroundUser()) {
		Slog.w(TAG, "disable(): not allowed for non-active and non system user");
		return false;
		@@ -990,6 +1012,30 @@ class BluetoothManagerService extends IBluetoothManager.Stub {
		}
		}

		/**
		* Check if AppOpsManager is available and the packageName belongs to uid
		*
		* A null package belongs to any uid
		*/
		private void checkPackage(int uid, String packageName) {
		if (mAppOps == null) {
		Slog.w(TAG, "checkPackage(): called before system boot up, uid "
		+ uid + ", packageName " + packageName);
		throw new IllegalStateException("System has not boot yet");
		}
		if (packageName == null) {
		Slog.w(TAG, "checkPackage(): called with null packageName from " + uid);
		return;
		}
		try {
		mAppOps.checkPackage(uid, packageName);
		} catch (SecurityException e) {
		Slog.w(TAG, "checkPackage(): " + packageName + " does not belong to uid " + uid);
		android.util.EventLog.writeEvent(0x534e4554, "120574260", uid, "");
		throw new SecurityException(e.getMessage());
		}
		}

		/**
		* Check if the caller must still pass permission check or if the caller is exempted
		* from the consent UI via the MANAGE_BLUETOOTH_WHEN_WIRELESS_CONSENT_REQUIRED check.
		@@ -1122,6 +1168,7 @@ class BluetoothManagerService extends IBluetoothManager.Stub {
		if (DBG) {
		Slog.d(TAG, "Bluetooth boot completed");
		}
		mAppOps = mContext.getSystemService(AppOpsManager.class);
		UserManagerInternal userManagerInternal =
		LocalServices.getService(UserManagerInternal.class);
		userManagerInternal.addUserRestrictionsListener(mUserRestrictionsListener);