commit 4368fdbae18dbf504642c70c265d4b239d1d1d28
author Max Bires <jbires@google.com> Thu Dec 07 03:51:50 2017 +0000
committer android-build-merger <android-build-merger@google.com> Thu Dec 07 03:51:50 2017 +0000
tree 8a3b7c5742ba2987dda6f3dfa39f0fa5c9cdc17b
parent a18ca90b029359c77e8e72b7df73790e13b949e7
parent 05fbbe5f3d47454a85da374cad9b54e4978c2c70

Fixing security vuln by tightening race condition window.
am: 05fbbe5f3d

Change-Id: I478f16ab9a29ca9a2b23a654474302a3c52f0433

keystore/key_store_service.cpp

diff --git a/keystore/key_store_service.cpp b/keystore/key_store_service.cpp
index eb5fe86..be13a7b 100644
--- a/keystore/key_store_service.cpp
+++ b/keystore/key_store_service.cpp
@@ -693,6 +693,8 @@
                                                        const hidl_vec<uint8_t>& entropy, int uid,
                                                        int flags,
                                                        KeyCharacteristics* outCharacteristics) {
+    // TODO(jbires): remove this getCallingUid call upon implementation of b/25646100
+    uid_t originalUid = IPCThreadState::self()->getCallingUid();
     uid = getEffectiveUid(uid);
     KeyStoreServiceReturnCode rc =
         checkBinderPermissionAndKeystoreState(P_INSERT, uid, flags & KEYSTORE_FLAG_ENCRYPTED);
@@ -705,7 +707,10 @@
     }
 
     if (containsTag(params, Tag::INCLUDE_UNIQUE_ID)) {
-        if (!checkBinderPermission(P_GEN_UNIQUE_ID)) return ResponseCode::PERMISSION_DENIED;
+        if (!checkBinderPermission(P_GEN_UNIQUE_ID) &&
+              originalUid != IPCThreadState::self()->getCallingUid()) {
+            return ResponseCode::PERMISSION_DENIED;
+        }
     }
 
     bool usingFallback = false;