Skip to content

Commit 3abd75b

Browse files
committed
Add DUMP permission checks to services
Some services have info that is not readily available any other way. Add a permission check to those services. Bug: 5389201 Change-Id: I5a9724ec89e1c11ef7813eeb52a6a05b3ea92af5
1 parent b9c13d0 commit 3abd75b

File tree

4 files changed

+50
-0
lines changed

4 files changed

+50
-0
lines changed

core/java/android/accounts/AccountManagerService.java

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1811,6 +1811,14 @@ private static boolean scanArgs(String[] args, String value) {
18111811
}
18121812

18131813
protected void dump(FileDescriptor fd, PrintWriter fout, String[] args) {
1814+
if (mContext.checkCallingOrSelfPermission(android.Manifest.permission.DUMP)
1815+
!= PackageManager.PERMISSION_GRANTED) {
1816+
fout.println("Permission Denial: can't dump AccountsManager from from pid="
1817+
+ Binder.getCallingPid() + ", uid=" + Binder.getCallingUid()
1818+
+ " without permission " + android.Manifest.permission.DUMP);
1819+
return;
1820+
}
1821+
18141822
synchronized (mCacheLock) {
18151823
final SQLiteDatabase db = mOpenHelper.getReadableDatabase();
18161824

services/java/com/android/server/am/ActivityManagerService.java

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1318,6 +1318,14 @@ static class MemBinder extends Binder {
13181318

13191319
@Override
13201320
protected void dump(FileDescriptor fd, PrintWriter pw, String[] args) {
1321+
if (mActivityManagerService.checkCallingPermission(android.Manifest.permission.DUMP)
1322+
!= PackageManager.PERMISSION_GRANTED) {
1323+
pw.println("Permission Denial: can't dump meminfo from from pid="
1324+
+ Binder.getCallingPid() + ", uid=" + Binder.getCallingUid()
1325+
+ " without permission " + android.Manifest.permission.DUMP);
1326+
return;
1327+
}
1328+
13211329
mActivityManagerService.dumpApplicationMemoryUsage(fd, pw, " ", args);
13221330
}
13231331
}
@@ -1330,6 +1338,14 @@ static class GraphicsBinder extends Binder {
13301338

13311339
@Override
13321340
protected void dump(FileDescriptor fd, PrintWriter pw, String[] args) {
1341+
if (mActivityManagerService.checkCallingPermission(android.Manifest.permission.DUMP)
1342+
!= PackageManager.PERMISSION_GRANTED) {
1343+
pw.println("Permission Denial: can't dump gfxinfo from from pid="
1344+
+ Binder.getCallingPid() + ", uid=" + Binder.getCallingUid()
1345+
+ " without permission " + android.Manifest.permission.DUMP);
1346+
return;
1347+
}
1348+
13331349
mActivityManagerService.dumpGraphicsHardwareUsage(fd, pw, args);
13341350
}
13351351
}
@@ -1342,6 +1358,14 @@ static class CpuBinder extends Binder {
13421358

13431359
@Override
13441360
protected void dump(FileDescriptor fd, PrintWriter pw, String[] args) {
1361+
if (mActivityManagerService.checkCallingPermission(android.Manifest.permission.DUMP)
1362+
!= PackageManager.PERMISSION_GRANTED) {
1363+
pw.println("Permission Denial: can't dump cpuinfo from from pid="
1364+
+ Binder.getCallingPid() + ", uid=" + Binder.getCallingUid()
1365+
+ " without permission " + android.Manifest.permission.DUMP);
1366+
return;
1367+
}
1368+
13451369
synchronized (mActivityManagerService.mProcessStatsThread) {
13461370
pw.print(mActivityManagerService.mProcessStats.printCurrentLoad());
13471371
pw.print(mActivityManagerService.mProcessStats.printCurrentState(

services/java/com/android/server/am/BatteryStatsService.java

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
import android.bluetooth.BluetoothProfile;
2222
import android.content.Context;
2323
import android.content.pm.ApplicationInfo;
24+
import android.content.pm.PackageManager;
2425
import android.os.Binder;
2526
import android.os.IBinder;
2627
import android.os.Parcel;
@@ -457,6 +458,14 @@ private void dumpHelp(PrintWriter pw) {
457458

458459
@Override
459460
protected void dump(FileDescriptor fd, PrintWriter pw, String[] args) {
461+
if (mContext.checkCallingOrSelfPermission(android.Manifest.permission.DUMP)
462+
!= PackageManager.PERMISSION_GRANTED) {
463+
pw.println("Permission Denial: can't dump BatteryStats from from pid="
464+
+ Binder.getCallingPid() + ", uid=" + Binder.getCallingUid()
465+
+ " without permission " + android.Manifest.permission.DUMP);
466+
return;
467+
}
468+
460469
boolean isCheckin = false;
461470
boolean noOutput = false;
462471
if (args != null) {

services/java/com/android/server/am/UsageStatsService.java

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import android.content.ComponentName;
2020
import android.content.Context;
2121
import android.content.pm.PackageInfo;
22+
import android.content.pm.PackageManager;
2223
import android.os.Binder;
2324
import android.os.IBinder;
2425
import android.os.FileUtils;
@@ -1034,6 +1035,14 @@ private static String scanArgsData(String[] args, String value) {
10341035
* The data persisted to file is parsed and the stats are computed.
10351036
*/
10361037
protected void dump(FileDescriptor fd, PrintWriter pw, String[] args) {
1038+
if (mContext.checkCallingPermission(android.Manifest.permission.DUMP)
1039+
!= PackageManager.PERMISSION_GRANTED) {
1040+
pw.println("Permission Denial: can't dump UsageStats from from pid="
1041+
+ Binder.getCallingPid() + ", uid=" + Binder.getCallingUid()
1042+
+ " without permission " + android.Manifest.permission.DUMP);
1043+
return;
1044+
}
1045+
10371046
final boolean isCheckinRequest = scanArgs(args, "--checkin");
10381047
final boolean isCompactOutput = isCheckinRequest || scanArgs(args, "-c");
10391048
final boolean deleteAfterPrint = isCheckinRequest || scanArgs(args, "-d");

0 commit comments

Comments
 (0)