commit ebf0c917c3034002b3ca8abb22f7417b6ecc7e30
author Arve Hjønnevåg <arve@android.com> Mon Aug 01 16:05:17 2016 -0700
committer gitbuildkicker <android-build@google.com> Thu Aug 25 21:56:24 2016 -0700
tree 69f4b576b8e49fd56da934cdec4eef15d45ba67a
parent 1ecb999624165ea2a9cf5e16b3f7e93358d503d6

DO NOT MERGE ServiceManager: Restore basic uid check

Prevent apps from registering services without relying on selinux checks.

Bug: 29431260

Change-Id: I38c6e8bc7f7cba1cbd3568e8fed1ae7ac2054a9b
(cherry picked from commit f03ba2c0d878071603d73b7f8e9a4a468364ac27)

cmds/servicemanager/service_manager.c

diff --git a/cmds/servicemanager/service_manager.c b/cmds/servicemanager/service_manager.c
index 7fa9a39..4c993c2 100644
--- a/cmds/servicemanager/service_manager.c
+++ b/cmds/servicemanager/service_manager.c
@@ -107,9 +107,14 @@
     return allowed;
 }
 
-static int svc_can_register(const uint16_t *name, size_t name_len, pid_t spid)
+static int svc_can_register(const uint16_t *name, size_t name_len, pid_t spid, uid_t uid)
 {
     const char *perm = "add";
+
+    if (uid >= AID_APP) {
+        return 0; /* Don't allow apps to register services */
+    }
+
     return check_mac_perms_from_lookup(spid, perm, str8(name, name_len)) ? 1 : 0;
 }
 
@@ -204,7 +209,7 @@
     if (!handle || (len == 0) || (len > 127))
         return -1;
 
-    if (!svc_can_register(s, len, spid)) {
+    if (!svc_can_register(s, len, spid, uid)) {
         ALOGE("add_service('%s',%x) uid=%d - PERMISSION DENIED\n",
              str8(s, len), handle, uid);
         return -1;