Android Framework: system service does not receive permission (s)

Question

I added a system service ( not an application) to the Android framework (therefore, it works in system_process). Via Binder.getCallingUid () I can determine the calling process / application. So far, so good. But if my service tries to use other system services (for example, LocationManager), a SecurityException is thrown because the LocationManager considers it to be caused by the original application that called my service.

From what I understood, system services have all permissions by default, so this should not be the case if?

From program4.us/Mobile/1304.aspx: Binder services can be used to make binding calls for free, but these calls always occur with the property (UID and PID), not the identity of the caller.

Here is some code to illustrate the problem:

public class MyService implements IInterface { public IBinder asBinder() { return mBinder; } private final IMyService.Stub mBinder = new IMyService.Stub() { public void doSomething() { int uid = Binder.getCallingUid(); // uid of the calling app int myUid = Process.myUid(); // my uid == 1000 ... try { ILocationManager lm = ILocationManager.Stub.asInterface(ServiceManager.getService("location")); Location myLocation = lm.getLastKnownLocation(LocationManager.GPS_PROVIDER); } catch (Exception e) { SecurityException is thrown. Requires ACCESS_FINE_LOCATION } } }; } 

Thanks in advance for any help or comments!

Answer 1

I have not tried this myself (but, nevertheless, I will come on Monday since I am now faced with the specific situation that you are describing): Binder has two methods: clearCallingIdentity and restoreCallingIdentity, which may be useful to us. If I interpret the documentation correctly, this is how I think they work.

The first method clears the identifier of the incoming IPC, so when you access the LocationManager, you do this using your identity and not the caller. It returns a long value, which then proceeds to the second method to restore the caller ID. This should allow you to go through the LM permissions check because you will effectively call it from system_process (i.e. the same process that LM is in).