|
23 | 23 | import java.util.concurrent.atomic.AtomicInteger; |
24 | 24 |
|
25 | 25 | import android.app.ActivityManager; |
26 | | -import android.app.ActivityManagerNative; |
27 | 26 | import android.app.backup.BackupManager; |
28 | 27 | import android.content.BroadcastReceiver; |
29 | 28 | import android.content.ContentProvider; |
|
33 | 32 | import android.content.Intent; |
34 | 33 | import android.content.IntentFilter; |
35 | 34 | import android.content.pm.PackageManager; |
36 | | -import android.content.pm.UserInfo; |
37 | 35 | import android.content.res.AssetFileDescriptor; |
38 | 36 | import android.database.Cursor; |
39 | 37 | import android.database.sqlite.SQLiteDatabase; |
40 | 38 | import android.database.sqlite.SQLiteException; |
41 | 39 | import android.database.sqlite.SQLiteQueryBuilder; |
42 | | -import android.database.sqlite.SQLiteStatement; |
43 | 40 | import android.media.RingtoneManager; |
44 | 41 | import android.net.Uri; |
45 | 42 | import android.os.Binder; |
46 | 43 | import android.os.Bundle; |
47 | 44 | import android.os.FileObserver; |
48 | 45 | import android.os.ParcelFileDescriptor; |
49 | | -import android.os.RemoteException; |
50 | 46 | import android.os.SystemProperties; |
51 | 47 | import android.os.UserHandle; |
52 | 48 | import android.os.UserManager; |
@@ -656,53 +652,59 @@ public Bundle call(String method, String request, Bundle args) { |
656 | 652 | } |
657 | 653 | } |
658 | 654 |
|
659 | | - // Note: we assume that get/put operations for moved-to-global names have already |
660 | | - // been directed to the new location on the caller side (otherwise we'd fix them |
661 | | - // up here). |
662 | | - |
663 | | - DatabaseHelper dbHelper; |
664 | | - SettingsCache cache; |
665 | | - |
666 | | - // Get methods |
667 | | - if (Settings.CALL_METHOD_GET_SYSTEM.equals(method)) { |
668 | | - if (LOCAL_LOGV) Slog.v(TAG, "call(system:" + request + ") for " + callingUser); |
669 | | - dbHelper = getOrEstablishDatabase(callingUser); |
670 | | - cache = sSystemCaches.get(callingUser); |
671 | | - return lookupValue(dbHelper, TABLE_SYSTEM, cache, request); |
672 | | - } |
673 | | - if (Settings.CALL_METHOD_GET_SECURE.equals(method)) { |
674 | | - if (LOCAL_LOGV) Slog.v(TAG, "call(secure:" + request + ") for " + callingUser); |
675 | | - dbHelper = getOrEstablishDatabase(callingUser); |
676 | | - cache = sSecureCaches.get(callingUser); |
677 | | - return lookupValue(dbHelper, TABLE_SECURE, cache, request); |
678 | | - } |
679 | | - if (Settings.CALL_METHOD_GET_GLOBAL.equals(method)) { |
680 | | - if (LOCAL_LOGV) Slog.v(TAG, "call(global:" + request + ") for " + callingUser); |
681 | | - // fast path: owner db & cache are immutable after onCreate() so we need not |
682 | | - // guard on the attempt to look them up |
683 | | - return lookupValue(getOrEstablishDatabase(UserHandle.USER_OWNER), TABLE_GLOBAL, |
684 | | - sGlobalCache, request); |
685 | | - } |
| 655 | + // Okay, permission checks have cleared. Reset to our own identity so we can |
| 656 | + // manipulate all users' data with impunity. |
| 657 | + long oldId = Binder.clearCallingIdentity(); |
| 658 | + try { |
| 659 | + // Note: we assume that get/put operations for moved-to-global names have already |
| 660 | + // been directed to the new location on the caller side (otherwise we'd fix them |
| 661 | + // up here). |
| 662 | + DatabaseHelper dbHelper; |
| 663 | + SettingsCache cache; |
| 664 | + |
| 665 | + // Get methods |
| 666 | + if (Settings.CALL_METHOD_GET_SYSTEM.equals(method)) { |
| 667 | + if (LOCAL_LOGV) Slog.v(TAG, "call(system:" + request + ") for " + callingUser); |
| 668 | + dbHelper = getOrEstablishDatabase(callingUser); |
| 669 | + cache = sSystemCaches.get(callingUser); |
| 670 | + return lookupValue(dbHelper, TABLE_SYSTEM, cache, request); |
| 671 | + } |
| 672 | + if (Settings.CALL_METHOD_GET_SECURE.equals(method)) { |
| 673 | + if (LOCAL_LOGV) Slog.v(TAG, "call(secure:" + request + ") for " + callingUser); |
| 674 | + dbHelper = getOrEstablishDatabase(callingUser); |
| 675 | + cache = sSecureCaches.get(callingUser); |
| 676 | + return lookupValue(dbHelper, TABLE_SECURE, cache, request); |
| 677 | + } |
| 678 | + if (Settings.CALL_METHOD_GET_GLOBAL.equals(method)) { |
| 679 | + if (LOCAL_LOGV) Slog.v(TAG, "call(global:" + request + ") for " + callingUser); |
| 680 | + // fast path: owner db & cache are immutable after onCreate() so we need not |
| 681 | + // guard on the attempt to look them up |
| 682 | + return lookupValue(getOrEstablishDatabase(UserHandle.USER_OWNER), TABLE_GLOBAL, |
| 683 | + sGlobalCache, request); |
| 684 | + } |
686 | 685 |
|
687 | | - // Put methods - new value is in the args bundle under the key named by |
688 | | - // the Settings.NameValueTable.VALUE static. |
689 | | - final String newValue = (args == null) |
690 | | - ? null : args.getString(Settings.NameValueTable.VALUE); |
691 | | - |
692 | | - final ContentValues values = new ContentValues(); |
693 | | - values.put(Settings.NameValueTable.NAME, request); |
694 | | - values.put(Settings.NameValueTable.VALUE, newValue); |
695 | | - if (Settings.CALL_METHOD_PUT_SYSTEM.equals(method)) { |
696 | | - if (LOCAL_LOGV) Slog.v(TAG, "call_put(system:" + request + "=" + newValue + ") for " + callingUser); |
697 | | - insertForUser(Settings.System.CONTENT_URI, values, callingUser); |
698 | | - } else if (Settings.CALL_METHOD_PUT_SECURE.equals(method)) { |
699 | | - if (LOCAL_LOGV) Slog.v(TAG, "call_put(secure:" + request + "=" + newValue + ") for " + callingUser); |
700 | | - insertForUser(Settings.Secure.CONTENT_URI, values, callingUser); |
701 | | - } else if (Settings.CALL_METHOD_PUT_GLOBAL.equals(method)) { |
702 | | - if (LOCAL_LOGV) Slog.v(TAG, "call_put(global:" + request + "=" + newValue + ") for " + callingUser); |
703 | | - insertForUser(Settings.Global.CONTENT_URI, values, callingUser); |
704 | | - } else { |
705 | | - Slog.w(TAG, "call() with invalid method: " + method); |
| 686 | + // Put methods - new value is in the args bundle under the key named by |
| 687 | + // the Settings.NameValueTable.VALUE static. |
| 688 | + final String newValue = (args == null) |
| 689 | + ? null : args.getString(Settings.NameValueTable.VALUE); |
| 690 | + |
| 691 | + final ContentValues values = new ContentValues(); |
| 692 | + values.put(Settings.NameValueTable.NAME, request); |
| 693 | + values.put(Settings.NameValueTable.VALUE, newValue); |
| 694 | + if (Settings.CALL_METHOD_PUT_SYSTEM.equals(method)) { |
| 695 | + if (LOCAL_LOGV) Slog.v(TAG, "call_put(system:" + request + "=" + newValue + ") for " + callingUser); |
| 696 | + insertForUser(Settings.System.CONTENT_URI, values, callingUser); |
| 697 | + } else if (Settings.CALL_METHOD_PUT_SECURE.equals(method)) { |
| 698 | + if (LOCAL_LOGV) Slog.v(TAG, "call_put(secure:" + request + "=" + newValue + ") for " + callingUser); |
| 699 | + insertForUser(Settings.Secure.CONTENT_URI, values, callingUser); |
| 700 | + } else if (Settings.CALL_METHOD_PUT_GLOBAL.equals(method)) { |
| 701 | + if (LOCAL_LOGV) Slog.v(TAG, "call_put(global:" + request + "=" + newValue + ") for " + callingUser); |
| 702 | + insertForUser(Settings.Global.CONTENT_URI, values, callingUser); |
| 703 | + } else { |
| 704 | + Slog.w(TAG, "call() with invalid method: " + method); |
| 705 | + } |
| 706 | + } finally { |
| 707 | + Binder.restoreCallingIdentity(oldId); |
706 | 708 | } |
707 | 709 |
|
708 | 710 | return null; |
@@ -758,7 +760,7 @@ public Cursor query(Uri url, String[] select, String where, String[] whereArgs, |
758 | 760 | return queryForUser(url, select, where, whereArgs, sort, UserHandle.getCallingUserId()); |
759 | 761 | } |
760 | 762 |
|
761 | | - public Cursor queryForUser(Uri url, String[] select, String where, String[] whereArgs, |
| 763 | + private Cursor queryForUser(Uri url, String[] select, String where, String[] whereArgs, |
762 | 764 | String sort, int forUser) { |
763 | 765 | if (LOCAL_LOGV) Slog.v(TAG, "query(" + url + ") for user " + forUser); |
764 | 766 | SqlArguments args = new SqlArguments(url, where, whereArgs); |
|
0 commit comments