summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSuprabh Shukla <suprabh@google.com>2017-02-27 15:56:11 -0800
committerMSe <mse1969@posteo.de>2017-07-06 21:55:55 +0200
commita31cffb3f9a7bb67259c6c2d1f712420de17d891 (patch)
tree2a3dcd7ee42dc2469efc9d4920e3544344454116
parent7723638d32afd0ce217e3c41bbc7be0d9b568625 (diff)
downloadandroid_packages_providers_DownloadProvider-a31cffb3f9a7bb67259c6c2d1f712420de17d891.zip
android_packages_providers_DownloadProvider-a31cffb3f9a7bb67259c6c2d1f712420de17d891.tar.gz
android_packages_providers_DownloadProvider-a31cffb3f9a7bb67259c6c2d1f712420de17d891.tar.bz2
DO NOT MERGE Deleting downloads for removed uids on downloadprovider startreplicant-6.0-0002
After uninstalling an app, if the system was shutdown before the download provider received the broadcast for UID_REMOVED, another app installed later in the same uid might be able to gain access to the files downloaded by this app. Removing any such hanging downloads at the start up of the download provider should fix this issue. Test: Manually tested by uninstalling an app and killing and restarting the process android.process.media, to check that the downloaded files of the uninstalled app were deleted. Bug:22011579 Merged in: I7382c4846f99035b40412a01715aee5873efa9e6 AOSP-Change-Id: I7382c4846f99035b40412a01715aee5873efa9e6 (cherry picked from commit 2ab9a2d15c63cd567805adb8fa4b9c524afc5ceb) (cherry picked from commit 3b15466b3cb6207660a73d1cea44a2d018ada23f) CVE-2017-0668 Change-Id: I8c5fee862185b958a539c7489443480c5c65ace6
-rw-r--r--src/com/android/providers/downloads/DownloadProvider.java55
1 files changed, 45 insertions, 10 deletions
diff --git a/src/com/android/providers/downloads/DownloadProvider.java b/src/com/android/providers/downloads/DownloadProvider.java
index 13ab545..75a4fa2 100644
--- a/src/com/android/providers/downloads/DownloadProvider.java
+++ b/src/com/android/providers/downloads/DownloadProvider.java
@@ -467,14 +467,26 @@ public final class DownloadProvider extends ContentProvider {
final SQLiteDatabase db = mOpenHelper.getReadableDatabase();
final Cursor cursor = db.query(DB_TABLE, new String[] {
Downloads.Impl._ID, Constants.UID }, null, null, null, null, null);
+ final ArrayList<Long> idsToDelete = new ArrayList<>();
try {
while (cursor.moveToNext()) {
- grantAllDownloadsPermission(cursor.getLong(0), cursor.getInt(1));
+ final long downloadId = cursor.getLong(0);
+ final int uid = cursor.getInt(1);
+ final String ownerPackage = getPackageForUid(uid);
+ if (ownerPackage == null) {
+ idsToDelete.add(downloadId);
+ } else {
+ grantAllDownloadsPermission(ownerPackage, downloadId);
+ }
}
} finally {
cursor.close();
}
-
+ if (idsToDelete.size() > 0) {
+ Log.i(Constants.TAG,
+ "Deleting downloads with ids " + idsToDelete + " as owner package is missing");
+ deleteDownloadsWithIds(idsToDelete);
+ }
// start the DownloadService class. don't wait for the 1st download to be issued.
// saves us by getting some initialization code in DownloadService out of the way.
Context context = getContext();
@@ -482,6 +494,19 @@ public final class DownloadProvider extends ContentProvider {
return true;
}
+ private void deleteDownloadsWithIds(ArrayList<Long> downloadIds) {
+ final int N = downloadIds.size();
+ if (N == 0) {
+ return;
+ }
+ final StringBuilder queryBuilder = new StringBuilder(Downloads.Impl._ID + " in (");
+ for (int i = 0; i < N; i++) {
+ queryBuilder.append(downloadIds.get(i));
+ queryBuilder.append((i == N - 1) ? ")" : ",");
+ }
+ delete(Downloads.Impl.ALL_DOWNLOADS_CONTENT_URI, queryBuilder.toString(), null);
+ }
+
/**
* Returns the content-provider-style MIME types of the various
* types accessible through this content provider.
@@ -700,7 +725,13 @@ public final class DownloadProvider extends ContentProvider {
}
insertRequestHeaders(db, rowID, values);
- grantAllDownloadsPermission(rowID, Binder.getCallingUid());
+
+ final String callingPackage = getPackageForUid(Binder.getCallingUid());
+ if (callingPackage == null) {
+ Log.e(Constants.TAG, "Package does not exist for calling uid");
+ return null;
+ }
+ grantAllDownloadsPermission(callingPackage, rowID);
notifyContentChanged(uri, match);
// Always start service to handle notifications and/or scanning
@@ -710,6 +741,15 @@ public final class DownloadProvider extends ContentProvider {
return ContentUris.withAppendedId(Downloads.Impl.CONTENT_URI, rowID);
}
+ private String getPackageForUid(int uid) {
+ String[] packages = getContext().getPackageManager().getPackagesForUid(uid);
+ if (packages == null || packages.length == 0) {
+ return null;
+ }
+ // For permission related purposes, any package belonging to the given uid should work.
+ return packages[0];
+ }
+
/**
* Check that the file URI provided for DESTINATION_FILE_URI is valid.
*/
@@ -1442,14 +1482,9 @@ public final class DownloadProvider extends ContentProvider {
}
}
- private void grantAllDownloadsPermission(long id, int uid) {
- final String[] packageNames = getContext().getPackageManager().getPackagesForUid(uid);
- if (packageNames == null || packageNames.length == 0) return;
-
- // We only need to grant to the first package, since the
- // platform internally tracks based on UIDs
+ private void grantAllDownloadsPermission(String toPackage, long id) {
final Uri uri = ContentUris.withAppendedId(Downloads.Impl.ALL_DOWNLOADS_CONTENT_URI, id);
- getContext().grantUriPermission(packageNames[0], uri,
+ getContext().grantUriPermission(toPackage, uri,
Intent.FLAG_GRANT_READ_URI_PERMISSION | Intent.FLAG_GRANT_WRITE_URI_PERMISSION);
}