commit 8b04725f1426d7543b5f38283ee53c95f071a7bc
author Jeff Brown <jeffbrown@google.com> Fri Apr 10 20:20:13 2015 -0700
committer Dan Stoza <stoza@google.com> Thu May 28 14:19:22 2015 -0700
tree 506961d9b9259357cea18597d78a1619a9578d14
parent ae569747b632c2e04bddced4db969b11b5d72612

Bypass surface flinger permission check for calls from system.

Early during the boot, before activity manager is ready to handle
permission checks, the system needs to be able to change the display
state.  Added a hardcoded exemption for AID_SYSTEM (which already
has permission to talk to surface flinger anyhow).

Bug: 19029490
Change-Id: I6222edcab8e394e5fb6adf7a982be446e4505a1e
(cherry picked from commit 3bfe51d7901e99e7f122f76ed2708e2b67b71cf9)

services/surfaceflinger/SurfaceFlinger.cpp

diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index b6131b5..4f19646 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -2807,7 +2807,7 @@
             IPCThreadState* ipc = IPCThreadState::self();
             const int pid = ipc->getCallingPid();
             const int uid = ipc->getCallingUid();
-            if ((uid != AID_GRAPHICS) &&
+            if ((uid != AID_GRAPHICS && uid != AID_SYSTEM) &&
                     !PermissionCache::checkPermission(sAccessSurfaceFlinger, pid, uid)) {
                 ALOGE("Permission Denial: "
                         "can't access SurfaceFlinger pid=%d, uid=%d", pid, uid);