Snap for 5452883 from 540d579f3079b1796414f12118632c6adc9387e3 to qt-releaseandroid-vts-10.0_r9android-vts-10.0_r8android-vts-10.0_r7android-vts-10.0_r6android-vts-10.0_r5android-vts-10.0_r4android-vts-10.0_r3android-vts-10.0_r2android-vts-10.0_r16android-vts-10.0_r15android-vts-10.0_r14android-vts-10.0_r13android-vts-10.0_r12android-vts-10.0_r11android-vts-10.0_r10android-vts-10.0_r1android-security-10.0.0_r75android-security-10.0.0_r74android-security-10.0.0_r73android-security-10.0.0_r72android-security-10.0.0_r71android-security-10.0.0_r70android-security-10.0.0_r69android-security-10.0.0_r68android-security-10.0.0_r67android-security-10.0.0_r66android-security-10.0.0_r65android-security-10.0.0_r64android-security-10.0.0_r63android-security-10.0.0_r62android-security-10.0.0_r61android-security-10.0.0_r60android-security-10.0.0_r59android-security-10.0.0_r58android-security-10.0.0_r57android-security-10.0.0_r56android-security-10.0.0_r55android-security-10.0.0_r54android-security-10.0.0_r53android-security-10.0.0_r52android-security-10.0.0_r51android-security-10.0.0_r50android-security-10.0.0_r49android-security-10.0.0_r48android-mainline-10.0.0_r3android-mainline-10.0.0_r2android-mainline-10.0.0_r1android-cts-10.0_r9android-cts-10.0_r8android-cts-10.0_r7android-cts-10.0_r6android-cts-10.0_r5android-cts-10.0_r4android-cts-10.0_r3android-cts-10.0_r2android-cts-10.0_r16android-cts-10.0_r15android-cts-10.0_r14android-cts-10.0_r13android-cts-10.0_r12android-cts-10.0_r11android-cts-10.0_r10android-cts-10.0_r1android-10.0.0_r6android-10.0.0_r5android-10.0.0_r47android-10.0.0_r46android-10.0.0_r4android-10.0.0_r3android-10.0.0_r2android-10.0.0_r17android-10.0.0_r11android-10.0.0_r10android-10.0.0_r1android10-tests-releaseandroid10-security-releaseandroid10-s3-releaseandroid10-s2-releaseandroid10-s1-releaseandroid10-releaseandroid10-mainline-releaseandroid10-mainline-a-releaseandroid10-gsi

Change-Id: I75a62e1cb397cb3e7beddd525ad85d7c6fda38e6

1 files changed, 19 insertions, 0 deletions

diff --git a/ashmemd_client.cpp b/ashmemd_client.cpp
index 3380209..a9041a0 100644
--- a/ashmemd_client.cpp
+++ b/ashmemd_client.cpp
@@ -17,6 +17,7 @@
 #include <android-base/logging.h>
 #include <android/ashmemd/IAshmemDeviceService.h>
 #include <binder/IServiceManager.h>
+#include <cutils/android_filesystem_config.h>
 
 using android::IBinder;
 using android::IServiceManager;
@@ -27,7 +28,25 @@ using android::os::ParcelFileDescriptor;
 namespace android {
 namespace ashmemd {
 
+static bool checkBinderAccess() {
+    // Isolated apps are potentially subject to seccomp policy that restricts use of access()
+    // (b/129483782). However, apps always have access to binder, so return true.
+    auto uid = getuid() % AID_USER;
+    if (AID_ISOLATED_START <= uid && uid <= AID_ISOLATED_END) {
+        return true;
+    }
+    if (access("/dev/binder", R_OK | W_OK) == 0) {
+        return true;
+    }
+    return false;
+}
+
 sp<IAshmemDeviceService> getAshmemService() {
+    // Calls to defaultServiceManager() crash the process if it doesn't have appropriate
+    // binder permissions. Check these permissions proactively.
+    if (!checkBinderAccess()) {
+        return nullptr;
+    }
     sp<IServiceManager> sm = android::defaultServiceManager();
     sp<IBinder> binder = sm->checkService(String16("ashmem_device_service"));
     return interface_cast<IAshmemDeviceService>(binder);