From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Pinyao Ting <pinyaoting@google.com>
Date: Thu, 3 Mar 2022 18:24:37 +0000
Subject: [PATCH] Verify caller before auto granting slice permission

Currently SliceManagerService#checkSlicePermission does not verify the
caller's identity. This leads to a security vulnerability because
checkSlicePermission does more than checking the permission as opposed
to simply return a boolean value -- it additionally grants slice access
under a certain condition. A malicious app can spoof the calling package
to acquire slice access.

This CL verifies the caller before granting slice access.

Bug: 208232850, 179699767
Test: manual
Change-Id: I2539c9ff5ea977c91bb58185c95280b4d533a520
Merged-In: I2539c9ff5ea977c91bb58185c95280b4d533a520
(cherry picked from commit 5bd2196c537ae42a5c1626bdc23c3c6db41fb97f)
(cherry picked from commit 3c92d74d7d74e1d781ae1b071da97b3b2cbc6be9)
Merged-In: I2539c9ff5ea977c91bb58185c95280b4d533a520
---
 .../core/java/com/android/server/slice/SliceManagerService.java | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/services/core/java/com/android/server/slice/SliceManagerService.java b/services/core/java/com/android/server/slice/SliceManagerService.java
index f5947ee35ea4..158e6a59ac48 100644
--- a/services/core/java/com/android/server/slice/SliceManagerService.java
+++ b/services/core/java/com/android/server/slice/SliceManagerService.java
@@ -239,6 +239,8 @@ public class SliceManagerService extends ISliceManager.Stub {
         if (autoGrantPermissions != null) {
             // Need to own the Uri to call in with permissions to grant.
             enforceOwner(pkg, uri, userId);
+            // b/208232850: Needs to verify caller before granting slice access
+            verifyCaller(pkg);
             for (String perm : autoGrantPermissions) {
                 if (mContext.checkPermission(perm, pid, uid) == PERMISSION_GRANTED) {
                     int providerUser = ContentProvider.getUserIdFromUri(uri, userId);
