Skip to content

Commit f203aee

Browse files
author
Amith Yamasani
committed
Enforce permissions for calls with specified userId
Fix a couple of places where incorrect userIds were being passed in. Change-Id: I398c676e0488ff7e584be96e96c8b32652134238
1 parent b2dd4e8 commit f203aee

File tree

8 files changed

+134
-57
lines changed

8 files changed

+134
-57
lines changed

‎core/java/android/app/ApplicationPackageManager.java‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -502,19 +502,27 @@ public List<ResolveInfo> queryIntentActivityOptions(
502502
}
503503
}
504504

505+
/**
506+
* @hide
507+
*/
505508
@Override
506-
public List<ResolveInfo> queryBroadcastReceivers(Intent intent, int flags) {
509+
public List<ResolveInfo> queryBroadcastReceivers(Intent intent, int flags, int userId) {
507510
try {
508511
return mPM.queryIntentReceivers(
509512
intent,
510513
intent.resolveTypeIfNeeded(mContext.getContentResolver()),
511514
flags,
512-
UserHandle.myUserId());
515+
userId);
513516
} catch (RemoteException e) {
514517
throw new RuntimeException("Package manager has died", e);
515518
}
516519
}
517520

521+
@Override
522+
public List<ResolveInfo> queryBroadcastReceivers(Intent intent, int flags) {
523+
return queryBroadcastReceivers(intent, flags, UserHandle.myUserId());
524+
}
525+
518526
@Override
519527
public ResolveInfo resolveService(Intent intent, int flags) {
520528
try {

‎core/java/android/content/pm/PackageManager.java‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1795,6 +1795,26 @@ public abstract List<ResolveInfo> queryIntentActivityOptions(
17951795
public abstract List<ResolveInfo> queryBroadcastReceivers(Intent intent,
17961796
int flags);
17971797

1798+
/**
1799+
* Retrieve all receivers that can handle a broadcast of the given intent, for a specific
1800+
* user.
1801+
*
1802+
* @param intent The desired intent as per resolveActivity().
1803+
* @param flags Additional option flags.
1804+
* @param userId The userId of the user being queried.
1805+
*
1806+
* @return A List&lt;ResolveInfo&gt; containing one entry for each matching
1807+
* Receiver. These are ordered from first to last in priority. If
1808+
* there are no matching receivers, an empty list is returned.
1809+
*
1810+
* @see #MATCH_DEFAULT_ONLY
1811+
* @see #GET_INTENT_FILTERS
1812+
* @see #GET_RESOLVED_FILTER
1813+
* @hide
1814+
*/
1815+
public abstract List<ResolveInfo> queryBroadcastReceivers(Intent intent,
1816+
int flags, int userId);
1817+
17981818
/**
17991819
* Determine the best service to handle for a given Intent.
18001820
*

‎core/java/android/server/search/Searchables.java‎

Lines changed: 42 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
import android.content.pm.IPackageManager;
2828
import android.content.pm.PackageManager;
2929
import android.content.pm.ResolveInfo;
30+
import android.os.Binder;
3031
import android.os.Bundle;
3132
import android.os.RemoteException;
3233
import android.provider.Settings;
@@ -70,7 +71,7 @@ public class Searchables {
7071
"com.google.android.providers.enhancedgooglesearch/.Launcher";
7172

7273
// Cache the package manager instance
73-
private IPackageManager mPm;
74+
final private IPackageManager mPm;
7475
// User for which this Searchables caches information
7576
private int mUserId;
7677

@@ -81,6 +82,7 @@ public class Searchables {
8182
public Searchables (Context context, int userId) {
8283
mContext = context;
8384
mUserId = userId;
85+
mPm = AppGlobals.getPackageManager();
8486
}
8587

8688
/**
@@ -125,50 +127,50 @@ public SearchableInfo getSearchableInfo(ComponentName activity) {
125127

126128
ActivityInfo ai = null;
127129
try {
128-
ai = mContext.getPackageManager().
129-
getActivityInfo(activity, PackageManager.GET_META_DATA );
130-
String refActivityName = null;
130+
ai = mPm.getActivityInfo(activity, PackageManager.GET_META_DATA, mUserId);
131+
} catch (RemoteException re) {
132+
Log.e(LOG_TAG, "Error getting activity info " + re);
133+
return null;
134+
}
135+
String refActivityName = null;
131136

132-
// First look for activity-specific reference
133-
Bundle md = ai.metaData;
137+
// First look for activity-specific reference
138+
Bundle md = ai.metaData;
139+
if (md != null) {
140+
refActivityName = md.getString(MD_LABEL_DEFAULT_SEARCHABLE);
141+
}
142+
// If not found, try for app-wide reference
143+
if (refActivityName == null) {
144+
md = ai.applicationInfo.metaData;
134145
if (md != null) {
135146
refActivityName = md.getString(MD_LABEL_DEFAULT_SEARCHABLE);
136147
}
137-
// If not found, try for app-wide reference
138-
if (refActivityName == null) {
139-
md = ai.applicationInfo.metaData;
140-
if (md != null) {
141-
refActivityName = md.getString(MD_LABEL_DEFAULT_SEARCHABLE);
142-
}
143-
}
148+
}
144149

145-
// Irrespective of source, if a reference was found, follow it.
146-
if (refActivityName != null)
147-
{
148-
// This value is deprecated, return null
149-
if (refActivityName.equals(MD_SEARCHABLE_SYSTEM_SEARCH)) {
150-
return null;
151-
}
152-
String pkg = activity.getPackageName();
153-
ComponentName referredActivity;
154-
if (refActivityName.charAt(0) == '.') {
155-
referredActivity = new ComponentName(pkg, pkg + refActivityName);
156-
} else {
157-
referredActivity = new ComponentName(pkg, refActivityName);
158-
}
150+
// Irrespective of source, if a reference was found, follow it.
151+
if (refActivityName != null)
152+
{
153+
// This value is deprecated, return null
154+
if (refActivityName.equals(MD_SEARCHABLE_SYSTEM_SEARCH)) {
155+
return null;
156+
}
157+
String pkg = activity.getPackageName();
158+
ComponentName referredActivity;
159+
if (refActivityName.charAt(0) == '.') {
160+
referredActivity = new ComponentName(pkg, pkg + refActivityName);
161+
} else {
162+
referredActivity = new ComponentName(pkg, refActivityName);
163+
}
159164

160-
// Now try the referred activity, and if found, cache
161-
// it against the original name so we can skip the check
162-
synchronized (this) {
163-
result = mSearchablesMap.get(referredActivity);
164-
if (result != null) {
165-
mSearchablesMap.put(activity, result);
166-
return result;
167-
}
165+
// Now try the referred activity, and if found, cache
166+
// it against the original name so we can skip the check
167+
synchronized (this) {
168+
result = mSearchablesMap.get(referredActivity);
169+
if (result != null) {
170+
mSearchablesMap.put(activity, result);
171+
return result;
168172
}
169173
}
170-
} catch (PackageManager.NameNotFoundException e) {
171-
// case 3: no metadata
172174
}
173175

174176
// Step 3. None found. Return null.
@@ -208,6 +210,7 @@ public void buildSearchableList() {
208210
// Use intent resolver to generate list of ACTION_SEARCH & ACTION_WEB_SEARCH receivers.
209211
List<ResolveInfo> searchList;
210212
final Intent intent = new Intent(Intent.ACTION_SEARCH);
213+
211214
searchList = queryIntentActivities(intent, PackageManager.GET_META_DATA);
212215

213216
List<ResolveInfo> webSearchInfoList;
@@ -219,6 +222,7 @@ public void buildSearchableList() {
219222
int search_count = (searchList == null ? 0 : searchList.size());
220223
int web_search_count = (webSearchInfoList == null ? 0 : webSearchInfoList.size());
221224
int count = search_count + web_search_count;
225+
long token = Binder.clearCallingIdentity();
222226
for (int ii = 0; ii < count; ii++) {
223227
// for each component, try to find metadata
224228
ResolveInfo info = (ii < search_count)
@@ -237,6 +241,7 @@ public void buildSearchableList() {
237241
}
238242
}
239243
}
244+
Binder.restoreCallingIdentity(token);
240245
}
241246

242247
List<ResolveInfo> newGlobalSearchActivities = findGlobalSearchActivities();
@@ -391,9 +396,6 @@ private ComponentName findWebSearchActivity(ComponentName globalSearchActivity)
391396
}
392397

393398
private List<ResolveInfo> queryIntentActivities(Intent intent, int flags) {
394-
if (mPm == null) {
395-
mPm = AppGlobals.getPackageManager();
396-
}
397399
List<ResolveInfo> activities = null;
398400
try {
399401
activities =

‎services/java/com/android/server/AppWidgetServiceImpl.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1514,11 +1514,12 @@ void readStateFromFileLocked(FileInputStream stream) {
15141514
String pkg = parser.getAttributeValue(null, "pkg");
15151515
String cl = parser.getAttributeValue(null, "cl");
15161516

1517-
final PackageManager packageManager = mContext.getPackageManager();
1517+
final IPackageManager packageManager = AppGlobals.getPackageManager();
15181518
try {
1519-
packageManager.getReceiverInfo(new ComponentName(pkg, cl), 0);
1520-
} catch (PackageManager.NameNotFoundException e) {
1521-
String[] pkgs = packageManager
1519+
packageManager.getReceiverInfo(new ComponentName(pkg, cl), 0,
1520+
UserHandle.getCallingUserId());
1521+
} catch (RemoteException e) {
1522+
String[] pkgs = mContext.getPackageManager()
15221523
.currentToCanonicalPackageNames(new String[] { pkg });
15231524
pkg = pkgs[0];
15241525
}

‎services/java/com/android/server/NotificationManagerService.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
import static org.xmlpull.v1.XmlPullParser.START_TAG;
2222

2323
import android.app.ActivityManagerNative;
24+
import android.app.AppGlobals;
2425
import android.app.IActivityManager;
2526
import android.app.INotificationManager;
2627
import android.app.ITransientNotification;
@@ -1313,14 +1314,14 @@ void checkCallerIsSystemOrSameApp(String pkg) {
13131314
return;
13141315
}
13151316
try {
1316-
ApplicationInfo ai = mContext.getPackageManager().getApplicationInfo(
1317-
pkg, 0);
1317+
ApplicationInfo ai = AppGlobals.getPackageManager().getApplicationInfo(
1318+
pkg, 0, UserHandle.getCallingUserId());
13181319
if (!UserHandle.isSameApp(ai.uid, uid)) {
13191320
throw new SecurityException("Calling uid " + uid + " gave package"
13201321
+ pkg + " which is owned by uid " + ai.uid);
13211322
}
1322-
} catch (PackageManager.NameNotFoundException e) {
1323-
throw new SecurityException("Unknown package " + pkg);
1323+
} catch (RemoteException re) {
1324+
throw new SecurityException("Unknown package " + pkg + "\n" + re);
13241325
}
13251326
}
13261327

‎services/java/com/android/server/am/ActivityManagerService.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8193,7 +8193,7 @@ private void appendDropBoxProcessHeaders(ProcessRecord process, String processNa
81938193
for (String pkg : process.pkgList) {
81948194
sb.append("Package: ").append(pkg);
81958195
try {
8196-
PackageInfo pi = pm.getPackageInfo(pkg, 0, 0);
8196+
PackageInfo pi = pm.getPackageInfo(pkg, 0, UserHandle.getCallingUserId());
81978197
if (pi != null) {
81988198
sb.append(" v").append(pi.versionCode);
81998199
if (pi.versionName != null) {

0 commit comments

Comments
 (0)