commit ee4d7be21948307a0fedc6ab75a21d41660aa0c5
author Nikita Ioffe <ioffe@google.com> Thu Feb 28 21:35:02 2019 +0000
committer Nikita Ioffe <ioffe@google.com> Wed Mar 13 17:01:56 2019 +0000
tree b4e56124c3ae516b0d8a7bdf8646a0ca959ff7c7
parent a018254b452a04e0f4822b38c15b47df9c0a230d

Add a whitelist to control packages that can use Bugreporting API

Test: checked SecurityException is thrown for my custom app
Test: whiltelisted my custom app, checked no SecurityException is thrown
Bug: 126541701
Change-Id: Id0b61ccc1adf40bcb455d3b59b640f4b160bdd84
Merged-In: Id0b61ccc1adf40bcb455d3b59b640f4b160bdd84
(cherry picked from commit 07964b49ac81b9955d9ecf5cf60c0bb1fc32c501)

services/core/java/com/android/server/os/BugreportManagerServiceImpl.java

diff --git a/services/core/java/com/android/server/os/BugreportManagerServiceImpl.java b/services/core/java/com/android/server/os/BugreportManagerServiceImpl.java
index f4454ae..ba5ca9c 100644
--- a/services/core/java/com/android/server/os/BugreportManagerServiceImpl.java
+++ b/services/core/java/com/android/server/os/BugreportManagerServiceImpl.java
@@ -31,10 +31,12 @@
 import android.os.SystemClock;
 import android.os.SystemProperties;
 import android.os.UserManager;
+import android.util.ArraySet;
 import android.util.Slog;
 
 import com.android.internal.annotations.GuardedBy;
 import com.android.internal.util.Preconditions;
+import com.android.server.SystemConfig;
 
 import java.io.FileDescriptor;
 
@@ -55,10 +57,13 @@
     private final Object mLock = new Object();
     private final Context mContext;
     private final AppOpsManager mAppOps;
+    private final ArraySet<String> mBugreportWhitelistedPackages;
 
     BugreportManagerServiceImpl(Context context) {
         mContext = context;
         mAppOps = (AppOpsManager) context.getSystemService(Context.APP_OPS_SERVICE);
+        mBugreportWhitelistedPackages =
+                SystemConfig.getInstance().getBugreportWhitelistedPackages();
     }
 
     @Override
@@ -83,6 +88,10 @@
         int callingUid = Binder.getCallingUid();
         mAppOps.checkPackage(callingUid, callingPackage);
 
+        if (!mBugreportWhitelistedPackages.contains(callingPackage)) {
+            throw new SecurityException(
+                    callingPackage + " is not whitelisted to use Bugreport API");
+        }
         synchronized (mLock) {
             startBugreportLocked(callingUid, callingPackage, bugreportFd, screenshotFd,
                     bugreportMode, listener);