commit b2379ba0a32638bae2ea0460644f68cf5a0967ce
author Eric Laurent <elaurent@google.com> Mon May 23 17:42:12 2016 -0700
committer Eric Laurent <elaurent@google.com> Tue May 24 17:16:57 2016 +0000
tree 92313531455a4482d97d03d0f4ecb1e727b4076a
parent a0e10ff02b156738c0e5441104821b220eea3d68

Fix android.permission.CAPTURE_AUDIO_OUTPUT permission check

Make sure we use the correct PID and UID when checking
android.permission.CAPTURE_AUDIO_OUTPUT permission from audio
policy service.

Bug: 28772898
Change-Id: I8f0c45bf7a5728b4364a451eefb6c025892ae9a5

services/audiopolicy/service/AudioPolicyInterfaceImpl.cpp

diff --git a/services/audiopolicy/service/AudioPolicyInterfaceImpl.cpp b/services/audiopolicy/service/AudioPolicyInterfaceImpl.cpp
index 92a1285..02603b8 100644
--- a/services/audiopolicy/service/AudioPolicyInterfaceImpl.cpp
+++ b/services/audiopolicy/service/AudioPolicyInterfaceImpl.cpp
@@ -260,6 +260,7 @@
 status_t AudioPolicyService::getInputForAttr(const audio_attributes_t *attr,
                                              audio_io_handle_t *input,
                                              audio_session_t session,
+                                             pid_t pid,
                                              uid_t uid,
                                              uint32_t samplingRate,
                                              audio_format_t format,
@@ -282,11 +283,22 @@
     sp<AudioPolicyEffects>audioPolicyEffects;
     status_t status;
     AudioPolicyInterface::input_type_t inputType;
+
+    bool updatePid = (pid == -1);
     const uid_t callingUid = IPCThreadState::self()->getCallingUid();
-    if (!isTrustedCallingUid(callingUid) || uid == (uid_t)-1) {
-        ALOGW_IF(uid != (uid_t)-1 && uid != callingUid,
+    if (!isTrustedCallingUid(callingUid)) {
+        ALOGW_IF(uid != -1 && uid != (int)callingUid,
                 "%s uid %d tried to pass itself off as %d", __FUNCTION__, callingUid, uid);
         uid = callingUid;
+        updatePid = true;
+    }
+
+    if (updatePid) {
+        const pid_t callingPid = IPCThreadState::self()->getCallingPid();
+        ALOGW_IF(pid != -1 && pid != callingPid,
+                 "%s uid %d pid %d tried to pass itself off as pid %d",
+                 __func__, callingUid, callingPid, pid);
+        pid = callingPid;
     }
 
     {
@@ -306,7 +318,7 @@
             case AudioPolicyInterface::API_INPUT_TELEPHONY_RX:
                 // FIXME: use the same permission as for remote submix for now.
             case AudioPolicyInterface::API_INPUT_MIX_CAPTURE:
-                if (!captureAudioOutputAllowed()) {
+                if (!captureAudioOutputAllowed(pid, uid)) {
                     ALOGE("getInputForAttr() permission denied: capture not allowed");
                     status = PERMISSION_DENIED;
                 }