diff options
| author | Pinyao Ting <pinyaoting@google.com> | 2022-03-03 18:24:37 +0000 |
|---|---|---|
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | 2022-07-07 01:46:17 +0000 |
| commit | ede6398a26f889d902341295bf61cde577cf65e3 (patch) | |
| tree | b2a52f15a379aeed9b45934ef2605a3ea2c4a2a8 | |
| parent | d1b9a4efade681418ce5844179b44e3f172bf96e (diff) | |
| download | base-ede6398a26f889d902341295bf61cde577cf65e3.tar.gz | |
Verify caller before auto granting slice permission
Currently SliceManagerService#checkSlicePermission does not verify the
caller's identity. This leads to a security vulnerability because
checkSlicePermission does more than checking the permission as opposed
to simply return a boolean value -- it additionally grants slice access
under a certain condition. A malicious app can spoof the calling package
to acquire slice access.
This CL verifies the caller before granting slice access.
Bug: 208232850, 179699767
Test: manual
Change-Id: I2539c9ff5ea977c91bb58185c95280b4d533a520
Merged-In: I2539c9ff5ea977c91bb58185c95280b4d533a520
(cherry picked from commit 5bd2196c537ae42a5c1626bdc23c3c6db41fb97f)
(cherry picked from commit 3c92d74d7d74e1d781ae1b071da97b3b2cbc6be9)
Merged-In: I2539c9ff5ea977c91bb58185c95280b4d533a520
| -rw-r--r-- | services/core/java/com/android/server/slice/SliceManagerService.java | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/services/core/java/com/android/server/slice/SliceManagerService.java b/services/core/java/com/android/server/slice/SliceManagerService.java index ee0e5ba916b9..e3dcfd0c89c0 100644 --- a/services/core/java/com/android/server/slice/SliceManagerService.java +++ b/services/core/java/com/android/server/slice/SliceManagerService.java @@ -247,6 +247,8 @@ public class SliceManagerService extends ISliceManager.Stub { if (autoGrantPermissions != null && callingPkg != null) { // Need to own the Uri to call in with permissions to grant. enforceOwner(callingPkg, uri, userId); + // b/208232850: Needs to verify caller before granting slice access + verifyCaller(callingPkg); for (String perm : autoGrantPermissions) { if (mContext.checkPermission(perm, pid, uid) == PERMISSION_GRANTED) { int providerUser = ContentProvider.getUserIdFromUri(uri, userId); |