Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a5eb4750 authored by Steven Moreland's avatar Steven Moreland Committed by Automerger Merge Worker
Browse files

Merge "installd: more restrictive uid checks" into main am: 44ec0c32 am:... 

Merge "installd: more restrictive uid checks" into main am: 44ec0c32 am: 866fea9d am: e9820bfd am: 30deda2e

Original change: https://android-review.googlesource.com/c/platform/frameworks/native/+/2745770



Change-Id: Idd7b736aeae37eaf2e9865fee1bcc77a4c09e986
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents fe185541 30deda2e

cmds/installd/InstalldNativeService.cpp

+13 −7
Original line number Diff line number Diff line
@@ -252,12 +252,18 @@ binder::Status checkUidInAppRange(int32_t appUid) { 
// in UserHandle.java and carry specific meanings that may not be handled by certain APIs here.

#define ENFORCE_VALID_USER(userId)                                                               \

    {                                                                                            \

        if (static_cast<uid_t>(std::abs(userId)) >=                    \

            std::numeric_limits<uid_t>::max() / AID_USER_OFFSET) {     \

        if (static_cast<uid_t>(userId) >= std::numeric_limits<uid_t>::max() / AID_USER_OFFSET) { \

            return error("userId invalid: " + std::to_string(userId));                           \

        }                                                                                        \

    }



#define ENFORCE_VALID_USER_OR_NULL(userId)             \

    {                                                  \

        if (static_cast<uid_t>(userId) != USER_NULL) { \

            ENFORCE_VALID_USER(userId);                \

        }                                              \

    }



#define CHECK_ARGUMENT_UUID(uuid) {                         \

    binder::Status status = checkArgumentUuid((uuid));      \

    if (!status.isOk()) {                                   \
@@ -3841,7 +3847,7 @@ binder::Status InstalldNativeService::prepareAppProfile(const std::string& packa 
        int32_t userId, int32_t appId, const std::string& profileName, const std::string& codePath,

        const std::optional<std::string>& dexMetadata, bool* _aidl_return) {

    ENFORCE_UID(AID_SYSTEM);

    ENFORCE_VALID_USER(userId);

    ENFORCE_VALID_USER_OR_NULL(userId);

    CHECK_ARGUMENT_PACKAGE_NAME(packageName);

    CHECK_ARGUMENT_PATH(codePath);

    LOCK_PACKAGE_USER();