Fix: always allow getProviderMimeType within the same user.

Even if the ContentProvider is locked down.

BUG: 17428869
Change-Id: Id54edcd2589677973b7db538356943d23b250660

diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java
index a9a4732..e9e3fea 100755 (executable)
--- a/services/core/java/com/android/server/am/ActivityManagerService.java
+++ b/services/core/java/com/android/server/am/ActivityManagerService.java
@@ -9665,14 +9665,9 @@ public final class ActivityManagerService extends ActivityManagerNative
         long ident = 0;
         boolean clearedIdentity = false;
         userId = unsafeConvertIncomingUser(userId);
-        if (UserHandle.getUserId(callingUid) != userId) {
-            if (checkComponentPermission(INTERACT_ACROSS_USERS, callingPid,
-                    callingUid, -1, true) == PackageManager.PERMISSION_GRANTED
-                    || checkComponentPermission(INTERACT_ACROSS_USERS_FULL, callingPid,
-                    callingUid, -1, true) == PackageManager.PERMISSION_GRANTED) {
-                clearedIdentity = true;
-                ident = Binder.clearCallingIdentity();
-            }
+        if (canClearIdentity(callingPid, callingUid, userId)) {
+            clearedIdentity = true;
+            ident = Binder.clearCallingIdentity();
         }
         ContentProviderHolder holder = null;
         try {
@@ -9700,6 +9695,19 @@ public final class ActivityManagerService extends ActivityManagerNative
         return null;
     }
 
+    private boolean canClearIdentity(int callingPid, int callingUid, int userId) {
+        if (UserHandle.getUserId(callingUid) == userId) {
+            return true;
+        }
+        if (checkComponentPermission(INTERACT_ACROSS_USERS, callingPid,
+                callingUid, -1, true) == PackageManager.PERMISSION_GRANTED
+                || checkComponentPermission(INTERACT_ACROSS_USERS_FULL, callingPid,
+                callingUid, -1, true) == PackageManager.PERMISSION_GRANTED) {
+                return true;
+        }
+        return false;
+    }
+
     // =========================================================
     // GLOBAL MANAGEMENT
     // =========================================================