commit c8c2c0d005a1e099f28dfa96339f3ecaf9b6fc70
author Kurt Dresner <kdresner@google.com> Tue Sep 14 22:19:44 2021 +0000
committer Kurt Dresner <kdresner@google.com> Thu Sep 16 21:00:33 2021 +0000
tree 5512a6288ae831dc9bae811bd57df883c9fbfb1a
parent 9260cf283158ca337c61e109e822b5f5adbcbffa

Clear caller identity in doesPackageHaveCallingUid helper method so it can work across users.

When this helper method is called on a binder thread it checks the caller's permission instead of just using the system service privileges to make the call, resulting in erroneous SecurityExceptions.

Bug: 182832208
Bug: 198860541
Test: CTS/unit tests
Change-Id: I2c71109f2556a47b8e44150565800528496173f5

services/core/java/com/android/server/UiModeManagerService.java

diff --git a/services/core/java/com/android/server/UiModeManagerService.java b/services/core/java/com/android/server/UiModeManagerService.java
index 1007130..81627a0 100644
--- a/services/core/java/com/android/server/UiModeManagerService.java
+++ b/services/core/java/com/android/server/UiModeManagerService.java
@@ -1167,11 +1167,16 @@
     }
 
     private boolean doesPackageHaveCallingUid(@NonNull String packageName) {
+        int callingUid = mInjector.getCallingUid();
+        int callingUserId = UserHandle.getUserId(callingUid);
+        final long ident = Binder.clearCallingIdentity();
         try {
             return getContext().getPackageManager().getPackageUidAsUser(packageName,
-                    UserHandle.getCallingUserId()) == mInjector.getCallingUid();
+                    callingUserId) == callingUid;
         } catch (PackageManager.NameNotFoundException e) {
             return false;
+        } finally {
+            Binder.restoreCallingIdentity(ident);
         }
     }