commit 8b84e6d77fbd69a71fb051f21eb64b597927cbb1
author android-build-team Robot <android-build-team-robot@google.com> Fri Jan 05 18:58:01 2018 +0000
committer android-build-team Robot <android-build-team-robot@google.com> Fri Jan 05 18:58:01 2018 +0000
tree 3900cb904f3230c37f4c41e2a7de8e4fcfcc003f
parent 9108e61da167e65265986eead444903ec311af74
parent e5bfaa9cebdbbf4c43be6ac430cd38d0e92d9b6d

Snap for 4527419 from e5bfaa9cebdbbf4c43be6ac430cd38d0e92d9b6d to oc-m2-release

Change-Id: I886605a8a7ea170a37e1cb6770f6b8a2fee90b68

keystore/key_store_service.cpp

diff --git a/keystore/key_store_service.cpp b/keystore/key_store_service.cpp
index eb5fe86..f6786b8 100644
--- a/keystore/key_store_service.cpp
+++ b/keystore/key_store_service.cpp
@@ -693,6 +693,8 @@
                                                        const hidl_vec<uint8_t>& entropy, int uid,
                                                        int flags,
                                                        KeyCharacteristics* outCharacteristics) {
+    // TODO(jbires): remove this getCallingUid call upon implementation of b/25646100
+    uid_t originalUid = IPCThreadState::self()->getCallingUid();
     uid = getEffectiveUid(uid);
     KeyStoreServiceReturnCode rc =
         checkBinderPermissionAndKeystoreState(P_INSERT, uid, flags & KEYSTORE_FLAG_ENCRYPTED);
@@ -703,9 +705,11 @@
         ALOGE("Non-system uid %d cannot set FLAG_CRITICAL_TO_DEVICE_ENCRYPTION", uid);
         return ResponseCode::PERMISSION_DENIED;
     }
-
     if (containsTag(params, Tag::INCLUDE_UNIQUE_ID)) {
-        if (!checkBinderPermission(P_GEN_UNIQUE_ID)) return ResponseCode::PERMISSION_DENIED;
+        if (!checkBinderPermission(P_GEN_UNIQUE_ID) ||
+              originalUid != IPCThreadState::self()->getCallingUid()) {
+            return ResponseCode::PERMISSION_DENIED;
+        }
     }
 
     bool usingFallback = false;