Merge "Enforce INTERACT_ACROSS_USERS_FULL for cross-user event reports." into main

1 files changed, 8 insertions, 1 deletions

diff --git a/services/usage/java/com/android/server/usage/UsageStatsService.java b/services/usage/java/com/android/server/usage/UsageStatsService.java
index 3d2340cca378..72db7fecb8ac 100644
--- a/services/usage/java/com/android/server/usage/UsageStatsService.java
+++ b/services/usage/java/com/android/server/usage/UsageStatsService.java
@@ -2278,6 +2278,12 @@ public class UsageStatsService extends SystemService implements
                         "Only the system or holders of the REPORT_USAGE_STATS"
                             + " permission are allowed to call reportUserInteraction");
                 }
+                if (userId != UserHandle.getCallingUserId()) {
+                    // Cross-user event reporting.
+                    getContext().enforceCallingPermission(
+                            Manifest.permission.INTERACT_ACROSS_USERS_FULL,
+                            "Caller doesn't have INTERACT_ACROSS_USERS_FULL permission");
+                }
             } else {
                 if (!isCallingUidSystem()) {
                     throw new SecurityException("Only system is allowed to call"
@@ -2287,7 +2293,8 @@ public class UsageStatsService extends SystemService implements
 
             // Verify if this package exists before reporting an event for it.
             if (mPackageManagerInternal.getPackageUid(packageName, 0, userId) < 0) {
-                throw new IllegalArgumentException("Package " + packageName + "not exist!");
+                throw new IllegalArgumentException("Package " + packageName
+                        + " does not exist!");
             }
 
             final Event event = new Event(USER_INTERACTION, SystemClock.elapsedRealtime());