Verify caller before auto granting slice permission
Currently SliceManagerService#checkSlicePermission does not verify the caller's identity. This leads to a security vulnerability because checkSlicePermission does more than checking the permission as opposed to simply return a boolean value -- it additionally grants slice access under a certain condition. A malicious app can spoof the calling package to acquire slice access. This CL verifies the caller before granting slice access. Bug: 208232850 Test: manual Change-Id: I2539c9ff5ea977c91bb58185c95280b4d533a520
Loading
Please register or sign in to comment