commit dbaecba45520f9183793312a87e84bdc1e09ca51
author Kevin Chyn <kchyn@google.com> Tue Dec 17 17:01:44 2019 -0800
committer Kevin Chyn <kchyn@google.com> Tue Dec 17 17:01:47 2019 -0800
tree 6fd93301ce223653e21728e06e0d0a8bfe88672e
parent 24e9073b42376b9e4f7f7a0e2b4350eda3cd62a7

Require permission check when caller's package name is keyguard

Fixes: 128598130

Test: Auth on keyguard, auth on BiometricPromptDemo
Change-Id: Ib6395a33c74c24c7ac7eaf1f10ee5f69946568e5

services/core/java/com/android/server/biometrics/BiometricServiceBase.java

diff --git a/services/core/java/com/android/server/biometrics/BiometricServiceBase.java b/services/core/java/com/android/server/biometrics/BiometricServiceBase.java
index 98e07ab..60f0e8e 100644
--- a/services/core/java/com/android/server/biometrics/BiometricServiceBase.java
+++ b/services/core/java/com/android/server/biometrics/BiometricServiceBase.java
@@ -16,6 +16,7 @@
 
 package com.android.server.biometrics;
 
+import static android.Manifest.permission.USE_BIOMETRIC_INTERNAL;
 import static android.app.ActivityManager.RunningAppProcessInfo.IMPORTANCE_FOREGROUND_SERVICE;
 
 import android.app.ActivityManager;
@@ -1211,6 +1212,11 @@
      * @return authenticator id for the calling user
      */
     protected long getAuthenticatorId(String opPackageName) {
+        if (isKeyguard(opPackageName)) {
+            // If an app tells us it's keyguard, check that it actually is.
+            checkPermission(USE_BIOMETRIC_INTERNAL);
+        }
+
         final int userId = getUserOrWorkProfileId(opPackageName, UserHandle.getCallingUserId());
         return mAuthenticatorIds.getOrDefault(userId, 0L);
     }