[RESTRICT AUTOMERGE] Pass correct realCallingUid to startActivity() if provided by PendingIntentRecord#sendInner()
Previously we'd ignore realCallingPid and realCallingUid that
PendingIntentRecord#sendInner() provided to startActivityInPackage().
Now we correctly pass it on, preserving past behaviour if none
provided.
Test: manual; we added logging statements to check the value of realCallingUid
in startActivitiesMayWait when launching the calendar app from the calendar widget
and verified that it was the calendar uid rather than the system uid.
Bug: 123013720
Change-Id: I0ef42c2f89b537a720f1ad5aefac756b0ccac52e
Merged-In: I0ef42c2f89b537a720f1ad5aefac756b0ccac52e
(cherry picked from commit 13a804ee271845b2ab95183a5c0d0c5a02bdefa2)
diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java
index 90bd32f..0327842 100644
--- a/services/core/java/com/android/server/am/ActivityManagerService.java
+++ b/services/core/java/com/android/server/am/ActivityManagerService.java
@@ -4891,9 +4891,9 @@
userId, false, ALLOW_FULL_ONLY, "startActivityInPackage", null);
// TODO: Switch to user app stacks here.
- int ret = mActivityStarter.startActivityMayWait(null, uid, callingPackage, intent,
- resolvedType, null, null, resultTo, resultWho, requestCode, startFlags,
- null, null, null, bOptions, false, userId, container, inTask, reason);
+ int ret = mActivityStarter.startActivityMayWait(null, uid, ActivityStarter.PID_NULL, uid,
+ callingPackage, intent, resolvedType, null, null, resultTo, resultWho, requestCode,
+ startFlags, null, null, null, bOptions, false, userId, container, inTask, reason);
return ret;
}
@@ -4914,13 +4914,20 @@
final int startActivitiesInPackage(int uid, String callingPackage,
Intent[] intents, String[] resolvedTypes, IBinder resultTo,
Bundle bOptions, int userId) {
+ return startActivitiesInPackage(uid, ActivityStarter.PID_NULL, UserHandle.USER_NULL,
+ callingPackage, intents, resolvedTypes, resultTo, bOptions, userId);
+ }
+
+ final int startActivitiesInPackage(int uid, int realCallingPid, int realCallingUid,
+ String callingPackage, Intent[] intents, String[] resolvedTypes,
+ IBinder resultTo, Bundle bOptions, int userId) {
final String reason = "startActivityInPackage";
userId = mUserController.handleIncomingUser(Binder.getCallingPid(), Binder.getCallingUid(),
userId, false, ALLOW_FULL_ONLY, reason, null);
// TODO: Switch to user app stacks here.
- int ret = mActivityStarter.startActivities(null, uid, callingPackage, intents, resolvedTypes,
- resultTo, bOptions, userId, reason);
+ int ret = mActivityStarter.startActivities(null, uid, realCallingPid, realCallingUid,
+ callingPackage, intents, resolvedTypes, resultTo, bOptions, userId, reason);
return ret;
}
diff --git a/services/core/java/com/android/server/am/ActivityStarter.java b/services/core/java/com/android/server/am/ActivityStarter.java
index a145435..7401fff 100644
--- a/services/core/java/com/android/server/am/ActivityStarter.java
+++ b/services/core/java/com/android/server/am/ActivityStarter.java
@@ -137,6 +137,8 @@
* an activity and associated task and stack.
*/
class ActivityStarter {
+ public static final int PID_NULL = 0;
+
private static final String TAG = TAG_WITH_CLASS_NAME ? "ActivityStarter" : TAG_AM;
private static final String TAG_RESULTS = TAG + POSTFIX_RESULTS;
private static final String TAG_FOCUS = TAG + POSTFIX_FOCUS;
@@ -672,6 +674,20 @@
ProfilerInfo profilerInfo, WaitResult outResult,
Configuration globalConfig, Bundle bOptions, boolean ignoreTargetSecurity, int userId,
IActivityContainer iContainer, TaskRecord inTask, String reason) {
+ return startActivityMayWait(caller, callingUid, PID_NULL, UserHandle.USER_NULL,
+ callingPackage, intent, resolvedType, voiceSession, voiceInteractor, resultTo,
+ resultWho, requestCode, startFlags, profilerInfo, outResult, globalConfig, bOptions,
+ ignoreTargetSecurity, userId, iContainer, inTask, reason);
+ }
+
+ final int startActivityMayWait(IApplicationThread caller, int callingUid,
+ int requestRealCallingPid, int requestRealCallingUid,
+ String callingPackage, Intent intent, String resolvedType,
+ IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
+ IBinder resultTo, String resultWho, int requestCode, int startFlags,
+ ProfilerInfo profilerInfo, WaitResult outResult,
+ Configuration globalConfig, Bundle bOptions, boolean ignoreTargetSecurity, int userId,
+ IActivityContainer iContainer, TaskRecord inTask, String reason) {
// Refuse possible leaked file descriptors
if (intent != null && intent.hasFileDescriptors()) {
throw new IllegalArgumentException("File descriptors passed in Intent");
@@ -732,8 +748,14 @@
// Cannot start a child activity if the parent is not resumed.
return ActivityManager.START_CANCELED;
}
- final int realCallingPid = Binder.getCallingPid();
- final int realCallingUid = Binder.getCallingUid();
+
+ final int realCallingPid = requestRealCallingPid != PID_NULL
+ ? requestRealCallingPid
+ : Binder.getCallingPid();
+ final int realCallingUid = requestRealCallingUid != UserHandle.USER_NULL
+ ? requestRealCallingUid
+ : Binder.getCallingUid();
+
int callingPid;
if (callingUid >= 0) {
callingPid = -1;
@@ -744,6 +766,7 @@
callingPid = callingUid = -1;
}
+
final ActivityStack stack;
if (container == null || container.mStack.isOnHomeDisplay()) {
stack = mSupervisor.mFocusedStack;
@@ -890,6 +913,14 @@
final int startActivities(IApplicationThread caller, int callingUid, String callingPackage,
Intent[] intents, String[] resolvedTypes, IBinder resultTo,
Bundle bOptions, int userId, String reason) {
+ return startActivities(caller, callingUid, PID_NULL, UserHandle.USER_NULL, callingPackage,
+ intents, resolvedTypes, resultTo, bOptions, userId, reason);
+ }
+
+ final int startActivities(IApplicationThread caller, int callingUid,
+ int incomingRealCallingPid, int incomingRealCallingUid, String callingPackage,
+ Intent[] intents, String[] resolvedTypes, IBinder resultTo,
+ Bundle bOptions, int userId, String reason) {
if (intents == null) {
throw new NullPointerException("intents is null");
}
@@ -900,8 +931,13 @@
throw new IllegalArgumentException("intents are length different than resolvedTypes");
}
- final int realCallingPid = Binder.getCallingPid();
- final int realCallingUid = Binder.getCallingUid();
+ final int realCallingPid = incomingRealCallingPid != PID_NULL
+ ? incomingRealCallingPid
+ : Binder.getCallingPid();
+
+ final int realCallingUid = incomingRealCallingUid != UserHandle.USER_NULL
+ ? incomingRealCallingUid
+ : Binder.getCallingUid();
int callingPid;
if (callingUid >= 0) {
diff --git a/services/core/java/com/android/server/am/PendingIntentRecord.java b/services/core/java/com/android/server/am/PendingIntentRecord.java
index cad5dcf..62138ed 100644
--- a/services/core/java/com/android/server/am/PendingIntentRecord.java
+++ b/services/core/java/com/android/server/am/PendingIntentRecord.java
@@ -341,8 +341,9 @@
}
allIntents[allIntents.length-1] = finalIntent;
allResolvedTypes[allResolvedTypes.length-1] = resolvedType;
- owner.startActivitiesInPackage(uid, key.packageName, allIntents,
- allResolvedTypes, resultTo, options, userId);
+ owner.startActivitiesInPackage(uid, callingPid, callingUid,
+ key.packageName, allIntents, allResolvedTypes, resultTo,
+ options, userId);
} else {
owner.startActivityInPackage(uid, key.packageName, finalIntent,
resolvedType, resultTo, resultWho, requestCode, 0,
