DO NOT MERGE Check permissions for URL_SIMINFOcm-14.1

Check permissions if the query is attempting to access URL_SIMINFO,
since it contains sensitive IDs.

Test: atest android.provider.cts.TelephonyProviderTest
Bug: 140622024
Change-Id: Ibcf4cf01a965b5c91aebf65adc98110ba3be89f6
(cherry picked from commit caab85d9144e83165637098ba8cb3c99fcf5cae2)

1 files changed, 20 insertions, 0 deletions

diff --git a/src/com/android/providers/telephony/TelephonyProvider.java b/src/com/android/providers/telephony/TelephonyProvider.java
index 37eb8cb..97250eb 100644
--- a/src/com/android/providers/telephony/TelephonyProvider.java
+++ b/src/com/android/providers/telephony/TelephonyProvider.java
@@ -1963,6 +1963,9 @@ public class TelephonyProvider extends ContentProvider
                 // null returns all columns, so need permission check
                 checkPermission();
             }
+        } else {
+            // For the sim_info table, we only require READ_PHONE_STATE
+            checkReadSimInfoPermission();
         }
 
         SQLiteDatabase db = mOpenHelper.getReadableDatabase();
@@ -2473,6 +2476,23 @@ public class TelephonyProvider extends ContentProvider
         throw new SecurityException("No permission to write APN settings");
     }
 
+    private void checkReadSimInfoPermission() {
+        try {
+            // Even if the caller doesn't have READ_PHONE_STATE, we'll let them access sim_info as
+            // long as they have the more restrictive write_apn_settings or carrier priv.
+            checkPermission();
+            return;
+        } catch (SecurityException e) {
+            int status = getContext().checkCallingOrSelfPermission(
+                    "android.permission.READ_PHONE_STATE");
+            if (status == PackageManager.PERMISSION_GRANTED) {
+                return;
+            }
+            EventLog.writeEvent(0x534e4554, "124107808", Binder.getCallingUid());
+            throw new SecurityException("No READ_PHONE_STATE permission");
+        }
+    }
+
     private DatabaseHelper mOpenHelper;
 
     private void restoreDefaultAPN(int subId) {