diff options
author | Dmitry Dementyev <dementyev@google.com> | 2020-11-10 16:01:35 -0800 |
---|---|---|
committer | Anis Assi <anisassi@google.com> | 2020-11-12 11:46:35 -0800 |
commit | bcc5dd17889a98c23ba30189c0648cf343c0f9d6 (patch) | |
tree | dfc5cf2427e99e479b0e6cd879ed28f9d03b21f3 | |
parent | 9c35317ae900bb7bd3f3c949561a4d0e442145d7 (diff) | |
download | base-android-security-10.0.0_r50.tar.gz |
Ignore GrantCredentials call with unexpected calling uid.android-security-10.0.0_r50
Activity can be used only in two cases.
1) Calling uid matches uid grantee.
2) Calling uid is is system. This flow is used by getToken methods with
notifyAuthFailure=true.
Test: Existing CTS tests
Bug: 158480899
Change-Id: I1421c333b6cebb4f7cddcdd8766298f6872e933b
(cherry picked from commit 10d8a114bbd91c07f2feb5009328b16203ff50b1)
-rw-r--r-- | core/java/android/accounts/GrantCredentialsPermissionActivity.java | 34 |
1 files changed, 28 insertions, 6 deletions
diff --git a/core/java/android/accounts/GrantCredentialsPermissionActivity.java b/core/java/android/accounts/GrantCredentialsPermissionActivity.java index 32b61b5ed8cc..5dc6e602e5d6 100644 --- a/core/java/android/accounts/GrantCredentialsPermissionActivity.java +++ b/core/java/android/accounts/GrantCredentialsPermissionActivity.java @@ -16,16 +16,23 @@ package android.accounts; import android.app.Activity; -import android.content.res.Resources; -import android.os.Bundle; -import android.widget.TextView; -import android.widget.LinearLayout; -import android.view.View; -import android.view.LayoutInflater; +import android.app.ActivityTaskManager; import android.content.Context; import android.content.Intent; import android.content.pm.PackageManager; +import android.content.res.Resources; +import android.os.Bundle; +import android.os.IBinder; +import android.os.Process; +import android.os.RemoteException; +import android.os.UserHandle; import android.text.TextUtils; +import android.util.Log; +import android.view.LayoutInflater; +import android.view.View; +import android.widget.LinearLayout; +import android.widget.TextView; + import com.android.internal.R; import java.io.IOException; @@ -42,6 +49,7 @@ public class GrantCredentialsPermissionActivity extends Activity implements View private Account mAccount; private String mAuthTokenType; private int mUid; + private int mCallingUid; private Bundle mResultBundle = null; protected LayoutInflater mInflater; @@ -77,6 +85,20 @@ public class GrantCredentialsPermissionActivity extends Activity implements View return; } + try { + IBinder activityToken = getActivityToken(); + mCallingUid = ActivityTaskManager.getService().getLaunchedFromUid(activityToken); + } catch (RemoteException re) { + // Couldn't figure out caller details + Log.w(getClass().getSimpleName(), "Unable to get caller identity \n" + re); + } + + if (!UserHandle.isSameApp(mCallingUid, Process.SYSTEM_UID) && mCallingUid != mUid) { + setResult(Activity.RESULT_CANCELED); + finish(); + return; + } + String accountTypeLabel; try { accountTypeLabel = getAccountLabel(mAccount); |