Merge changes from topic 'allow-vrcore' into oc-dev
* changes:
Check for caller permissions in virtual touchpad service
Restrict VR HWC access to services with RESTRICTED_VR_ACCESS permission
diff --git a/services/vr/hardware_composer/vr_composer.cpp b/services/vr/hardware_composer/vr_composer.cpp
index c15f8fd..c45fbf4 100644
--- a/services/vr/hardware_composer/vr_composer.cpp
+++ b/services/vr/hardware_composer/vr_composer.cpp
@@ -1,7 +1,25 @@
#include "vr_composer.h"
+#include <binder/IPCThreadState.h>
+#include <binder/PermissionCache.h>
+
namespace android {
namespace dvr {
+namespace {
+
+bool CheckPermission() {
+ const android::IPCThreadState* ipc = android::IPCThreadState::self();
+ const pid_t pid = ipc->getCallingPid();
+ const uid_t uid = ipc->getCallingUid();
+ const bool permission = PermissionCache::checkPermission(
+ String16("android.permission.RESTRICTED_VR_ACCESS"), pid, uid);
+ if (!permission)
+ ALOGE("permission denied to pid=%d uid=%u", pid, uid);
+
+ return permission;
+}
+
+} // namespace
VrComposer::VrComposer() {}
@@ -11,6 +29,9 @@
const sp<IVrComposerCallback>& callback) {
std::lock_guard<std::mutex> guard(mutex_);
+ if (!CheckPermission())
+ return binder::Status::fromStatusT(PERMISSION_DENIED);
+
if (callback_.get()) {
ALOGE("Failed to register callback, already registered");
return binder::Status::fromStatusT(ALREADY_EXISTS);
diff --git a/services/vr/virtual_touchpad/Android.bp b/services/vr/virtual_touchpad/Android.bp
index c8bc884..3d5dfb2 100644
--- a/services/vr/virtual_touchpad/Android.bp
+++ b/services/vr/virtual_touchpad/Android.bp
@@ -80,7 +80,6 @@
cppflags: ["-std=c++11"],
cflags: [
"-DLOG_TAG=\"VrVirtualTouchpad\"",
- "-DSELINUX_ACCESS_CONTROL",
],
host_ldlibs: ["-llog"],
name: "virtual_touchpad",
diff --git a/services/vr/virtual_touchpad/VirtualTouchpadService.cpp b/services/vr/virtual_touchpad/VirtualTouchpadService.cpp
index 191bcfb..81edd32 100644
--- a/services/vr/virtual_touchpad/VirtualTouchpadService.cpp
+++ b/services/vr/virtual_touchpad/VirtualTouchpadService.cpp
@@ -122,9 +122,6 @@
bool VirtualTouchpadService::CheckTouchPermission(pid_t* out_pid) {
const android::IPCThreadState* ipc = android::IPCThreadState::self();
*out_pid = ipc->getCallingPid();
-#ifdef SELINUX_ACCESS_CONTROL
- return true;
-#else
const uid_t uid = ipc->getCallingUid();
const bool permission = PermissionCache::checkPermission(kTouchPermission, *out_pid, uid);
if (!permission) {
@@ -132,7 +129,6 @@
static_cast<long>(uid));
}
return permission;
-#endif
}
} // namespace dvr