Verify caller before auto granting slice permission
Currently SliceManagerService#checkSlicePermission does not verify the caller's identity. This leads to a security vulnerability because checkSlicePermission does more than checking the permission as opposed to simply return a boolean value -- it additionally grants slice access under a certain condition. A malicious app can spoof the calling package to acquire slice access. This CL verifies the caller before granting slice access. Bug: 208232850, 179699767 Test: manual Change-Id: I2539c9ff5ea977c91bb58185c95280b4d533a520 Merged-In: I2539c9ff5ea977c91bb58185c95280b4d533a520 (cherry picked from commit 5bd2196c)
Loading
Please register or sign in to comment