diff options
| author | 2024-04-04 22:34:50 +0000 | |
|---|---|---|
| committer | 2024-04-04 22:34:50 +0000 | |
| commit | 338b474d3a4845b62f97ef45857a5a8ff84ee797 (patch) | |
| tree | fb37c338818adfc6bf7695031a6f2aa9bb689795 | |
| parent | a5a2cff6e1a5508ca501c35b6743b419b0f32471 (diff) | |
| parent | 5e13b89acf28d0c6076e2b1d772d7b93f38648f7 (diff) | |
Merge "libbinder: Disable shell commands on non-IPC builds" into main am: 068bb7a296 am: 5e13b89acf
Original change: https://android-review.googlesource.com/c/platform/frameworks/native/+/3009331
Change-Id: Id2b4a43b82b23ff527a8fafcc96d6076992e969b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
| -rw-r--r-- | libs/binder/ndk/Android.bp | 1 | ||||
| -rw-r--r-- | libs/binder/ndk/ibinder.cpp | 7 |
2 files changed, 8 insertions, 0 deletions
diff --git a/libs/binder/ndk/Android.bp b/libs/binder/ndk/Android.bp index 30dbdddc60..2a8a353518 100644 --- a/libs/binder/ndk/Android.bp +++ b/libs/binder/ndk/Android.bp @@ -50,6 +50,7 @@ cc_library { ], cflags: [ + "-DBINDER_WITH_KERNEL_IPC", "-Wall", "-Wextra", "-Werror", diff --git a/libs/binder/ndk/ibinder.cpp b/libs/binder/ndk/ibinder.cpp index e2ede3f52a..34a86f2ea8 100644 --- a/libs/binder/ndk/ibinder.cpp +++ b/libs/binder/ndk/ibinder.cpp @@ -24,6 +24,7 @@ #include <private/android_filesystem_config.h> #endif +#include "../BuildFlags.h" #include "ibinder_internal.h" #include "parcel_internal.h" #include "status_internal.h" @@ -211,6 +212,12 @@ status_t ABBinder::onTransact(transaction_code_t code, const Parcel& data, Parce binder_status_t status = getClass()->onTransact(this, code, &in, &out); return PruneStatusT(status); } else if (code == SHELL_COMMAND_TRANSACTION && getClass()->handleShellCommand != nullptr) { + if constexpr (!android::kEnableKernelIpc) { + // Non-IPC builds do not have getCallingUid(), + // so we have no way of authenticating the caller + return STATUS_PERMISSION_DENIED; + } + int in = data.readFileDescriptor(); int out = data.readFileDescriptor(); int err = data.readFileDescriptor(); |