commit 1cc2d5562a70dfd66b73bccb129141cbb27ed44e
author Holly Jiuyu Sun <jiuyu@google.com> Fri Jan 26 15:51:16 2018 -0800
committer Holly Jiuyu Sun <jiuyu@google.com> Mon Jan 29 14:02:05 2018 -0800
tree 95fb471454ecf01b98219c8723154cf3da1b0e61
parent d9a9b4f7f9a6e5a60a669704e34762dd6bb0d1b5

Only allow LPA to select ISD-R using iccTransmitApduBasicChannel

Bug: 72561613
Test: test on phone
Change-Id: Id39b86b19c24fd2dd431090f449f0555afe12142

src/com/android/phone/PhoneInterfaceManager.java

diff --git a/src/com/android/phone/PhoneInterfaceManager.java b/src/com/android/phone/PhoneInterfaceManager.java
index 8127eae..9d7605f 100644
--- a/src/com/android/phone/PhoneInterfaceManager.java
+++ b/src/com/android/phone/PhoneInterfaceManager.java
@@ -183,6 +183,12 @@
     private static final int CMD_SWITCH_SLOTS = 50;
     private static final int EVENT_SWITCH_SLOTS_DONE = 51;
 
+    // Parameters of select command.
+    private static final int SELECT_COMMAND = 0xA4;
+    private static final int SELECT_P1 = 0x04;
+    private static final int SELECT_P2 = 0;
+    private static final int SELECT_P3 = 0x10;
+
     /** The singleton instance. */
     private static PhoneInterfaceManager sInstance;
 
@@ -2419,10 +2425,23 @@
     }
 
     @Override
-    public String iccTransmitApduBasicChannel(int subId, int cla, int command, int p1, int p2,
-                int p3, String data) {
+    public String iccTransmitApduBasicChannel(int subId, String callingPackage, int cla,
+            int command, int p1, int p2, int p3, String data) {
         enforceModifyPermissionOrCarrierPrivilege(subId);
 
+        if (command == SELECT_COMMAND && p1 == SELECT_P1 && p2 == SELECT_P2 && p3 == SELECT_P3
+                && TextUtils.equals(ISDR_AID, data)) {
+            // Only allows LPA to select ISD-R.
+            mAppOps.checkPackage(Binder.getCallingUid(), callingPackage);
+            ComponentInfo bestComponent =
+                    EuiccConnector.findBestComponent(mPhone.getContext().getPackageManager());
+            if (bestComponent == null
+                    || !TextUtils.equals(callingPackage, bestComponent.packageName)) {
+                loge("The calling package is not allowed to select ISD-R.");
+                throw new SecurityException("The calling package is not allowed to select ISD-R.");
+            }
+        }
+
         if (DBG) {
             log("iccTransmitApduBasicChannel: subId=" + subId + " cla=" + cla + " cmd=" + command
                     + " p1=" + p1 + " p2=" + p2 + " p3=" + p3 + " data=" + data);