1 files changed, 13 insertions, 4 deletions
diff --git a/apex/service/java/com/android/server/media/MediaCommunicationService.java b/apex/service/java/com/android/server/media/MediaCommunicationService.java
index 3ebb40b..62d2a6a 100644
--- a/apex/service/java/com/android/server/media/MediaCommunicationService.java
+++ b/apex/service/java/com/android/server/media/MediaCommunicationService.java
@@ -16,11 +16,13 @@
 package com.android.server.media;
 
 import static android.Manifest.permission.INTERACT_ACROSS_USERS_FULL;
+import static android.Manifest.permission.MEDIA_CONTENT_CONTROL;
 import static android.os.UserHandle.ALL;
 import static android.os.UserHandle.getUserHandleForUid;
 
 import android.annotation.NonNull;
 import android.annotation.Nullable;
+import android.annotation.RequiresPermission;
 import android.app.ActivityManager;
 import android.app.NotificationManager;
 import android.content.Context;
@@ -418,16 +420,23 @@ public class MediaCommunicationService extends SystemService {
         }
 
         @Override
-        public void registerCallback(IMediaCommunicationServiceCallback callback,
-                String packageName) throws RemoteException {
+        @RequiresPermission(MEDIA_CONTENT_CONTROL)
+        public void registerCallback(@NonNull IMediaCommunicationServiceCallback callback,
+                                     @NonNull String packageName) throws RemoteException {
             Objects.requireNonNull(callback, "callback should not be null");
             Objects.requireNonNull(packageName, "packageName should not be null");
 
+            final int uid = Binder.getCallingUid();
+            final int pid = Binder.getCallingPid();
+            if (!hasMediaControlPermission(pid, uid)){
+                throw new SecurityException("MEDIA_CONTENT_CONTROL permission is required to"
+                        + " register MediaCommunicationServiceCallback");
+            }
+
             synchronized (mLock) {
                 if (findCallbackRecordLocked(callback) == null) {
-
                     CallbackRecord record = new CallbackRecord(callback, packageName,
-                            Binder.getCallingUid(), Binder.getCallingPid());
+                            uid, pid);
                     mCallbackRecords.add(record);
                     try {
                         callback.asBinder().linkToDeath(record, 0);