From e32a6f4083bca93ff74dca01a300deb1624dd0c9 Mon Sep 17 00:00:00 2001 From: Eric Laurent Date: Mon, 4 May 2020 11:35:55 -0700 Subject: audioservice: add missing permission checks AudioManager getAudioVolumeGroups() and getAudioProductStrategies() Are @SystemApi and should be protected by MODIFY_AUDIO_ROUTING permission but no check was done on server side. Bug: 154934920 Test: atest AudioManagerTest Change-Id: I8f48eb83d8c2f55248f90a47240fd1547a1c2297 --- services/core/java/com/android/server/audio/AudioService.java | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/services/core/java/com/android/server/audio/AudioService.java b/services/core/java/com/android/server/audio/AudioService.java index 7cac376ea7ae..17baead84f9d 100755 --- a/services/core/java/com/android/server/audio/AudioService.java +++ b/services/core/java/com/android/server/audio/AudioService.java @@ -1217,6 +1217,8 @@ public class AudioService extends IAudioService.Stub */ @NonNull public List getAudioProductStrategies() { + // verify permissions + enforceModifyAudioRoutingPermission(); return AudioProductStrategy.getAudioProductStrategies(); } @@ -1226,6 +1228,8 @@ public class AudioService extends IAudioService.Stub */ @NonNull public List getAudioVolumeGroups() { + // verify permissions + enforceModifyAudioRoutingPermission(); return AudioVolumeGroup.getAudioVolumeGroups(); } -- cgit v1.2.3-59-g8ed1b