Security fix: as part of enforcing read privilege permission to check package
privileges in TelephonyManager, clear calling identity to ensure current
functionalities work
Bug: 180938364
Test: cts
Change-Id: I274de9bb6a08f4279e3706948725b90d0a4cbb01
diff --git a/src/java/com/android/internal/telephony/euicc/EuiccController.java b/src/java/com/android/internal/telephony/euicc/EuiccController.java
index 2d81299..4ac3176 100644
--- a/src/java/com/android/internal/telephony/euicc/EuiccController.java
+++ b/src/java/com/android/internal/telephony/euicc/EuiccController.java
@@ -1538,8 +1538,13 @@
// There is no active subscription on the target SIM, checks whether the caller can
// manage any active subscription on any other SIM.
- return mTelephonyManager.checkCarrierPrivilegesForPackageAnyPhone(callingPackage)
+ final long token = Binder.clearCallingIdentity();
+ try {
+ return mTelephonyManager.checkCarrierPrivilegesForPackageAnyPhone(callingPackage)
== TelephonyManager.CARRIER_PRIVILEGE_STATUS_HAS_ACCESS;
+ } finally {
+ Binder.restoreCallingIdentity(token);
+ }
} else {
for (SubscriptionInfo subInfo : subInfoList) {
if (subInfo.isEmbedded()
