Grant MMS Uri permissions as the calling UID.
A recent security fix prevents the system UID from handing out Uri
permission grants directly from itself. Instead, services need to
issue grants as the original calling UID to ensure that the caller
actually has access to the Uris.
Test: builds, boots, send/recv MMS works in primary/secondary users
Bug: 33231106
Change-Id: Ia9fe19843b52977c8a94ee5349b907beda1882fc
diff --git a/services/core/java/com/android/server/MmsServiceBroker.java b/services/core/java/com/android/server/MmsServiceBroker.java
index 0414b47..8402087 100644
--- a/services/core/java/com/android/server/MmsServiceBroker.java
+++ b/services/core/java/com/android/server/MmsServiceBroker.java
@@ -17,6 +17,7 @@
package com.android.server;
import android.Manifest;
+import android.app.ActivityManagerInternal;
import android.app.AppOpsManager;
import android.app.PendingIntent;
import android.content.ComponentName;
@@ -499,13 +500,21 @@
*/
private Uri adjustUriForUserAndGrantPermission(Uri contentUri, String action,
int permission) {
+ final Intent grantIntent = new Intent();
+ grantIntent.setData(contentUri);
+ grantIntent.setFlags(permission);
+
+ final int callingUid = Binder.getCallingUid();
final int callingUserId = UserHandle.getCallingUserId();
if (callingUserId != UserHandle.USER_SYSTEM) {
contentUri = ContentProvider.maybeAddUserId(contentUri, callingUserId);
}
+
long token = Binder.clearCallingIdentity();
try {
- mContext.grantUriPermission(PHONE_PACKAGE_NAME, contentUri, permission);
+ LocalServices.getService(ActivityManagerInternal.class)
+ .grantUriPermissionFromIntent(callingUid, PHONE_PACKAGE_NAME,
+ grantIntent, UserHandle.USER_SYSTEM);
// Grant permission for the carrier app.
Intent intent = new Intent(action);
@@ -514,7 +523,9 @@
List<String> carrierPackages = telephonyManager.getCarrierPackageNamesForIntent(
intent);
if (carrierPackages != null && carrierPackages.size() == 1) {
- mContext.grantUriPermission(carrierPackages.get(0), contentUri, permission);
+ LocalServices.getService(ActivityManagerInternal.class)
+ .grantUriPermissionFromIntent(callingUid, carrierPackages.get(0),
+ grantIntent, UserHandle.USER_SYSTEM);
}
} finally {
Binder.restoreCallingIdentity(token);