diff options
author | Tom O'Neill <tomo@google.com> | 2016-12-22 17:09:09 +0000 |
---|---|---|
committer | Jesse Badash <badash@google.com> | 2017-01-20 22:24:05 +0000 |
commit | 5e017ef63149c84749a99f1fb445b5e0e4ed26da (patch) | |
tree | 37ad471b72d80b5f377dca4c83d3b751079a6b20 | |
parent | dcd0acffd8a3561e46eb97ad0b0e587e47ac6829 (diff) | |
download | base-5e017ef63149c84749a99f1fb445b5e0e4ed26da.tar.gz |
Fix exploit where can hide the fact that a location was mocked am: a206a0f17e am: d417e54872
am: 3380a77516
Change-Id: Ice61f337e1fcfd0569431538e475d94f9d205423
(cherry picked from commit 0a8978f04b4cc2e273545568b424756ee5a40a3d)
-rw-r--r-- | services/core/java/com/android/server/LocationManagerService.java | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/services/core/java/com/android/server/LocationManagerService.java b/services/core/java/com/android/server/LocationManagerService.java index 468ead0e9c92..66d40deb503d 100644 --- a/services/core/java/com/android/server/LocationManagerService.java +++ b/services/core/java/com/android/server/LocationManagerService.java @@ -87,6 +87,8 @@ import android.os.UserHandle; import android.os.UserManager; import android.os.WorkSource; import android.provider.Settings; +import android.text.TextUtils; +import android.util.EventLog; import android.util.Log; import android.util.Slog; @@ -2505,9 +2507,22 @@ public class LocationManagerService extends ILocationManager.Stub { if (mockProvider == null) { throw new IllegalArgumentException("Provider \"" + provider + "\" unknown"); } + + // Ensure that the location is marked as being mock. There's some logic to do this in + // handleLocationChanged(), but it fails if loc has the wrong provider (bug 33091107). + Location mock = new Location(loc); + mock.setIsFromMockProvider(true); + + if (!TextUtils.isEmpty(loc.getProvider()) && !provider.equals(loc.getProvider())) { + // The location has an explicit provider that is different from the mock provider + // name. The caller may be trying to fool us via bug 33091107. + EventLog.writeEvent(0x534e4554, "33091107", Binder.getCallingUid(), + provider + "!=" + loc.getProvider()); + } + // clear calling identity so INSTALL_LOCATION_PROVIDER permission is not required long identity = Binder.clearCallingIdentity(); - mockProvider.setLocation(loc); + mockProvider.setLocation(mock); Binder.restoreCallingIdentity(identity); } } |