Fix check for caller being the active network scorer

Compare caller and scorer uids to decide if caller is the
active scorer instead of calling AppOps.checkPackage().

Bug: 23000690
Change-Id: I64285f965716f3aceb24f193d86ab9d6be7202c5

2 files changed, 20 insertions, 12 deletions

diff --git a/core/java/android/net/NetworkScorerAppManager.java b/core/java/android/net/NetworkScorerAppManager.java
index 46f7194..29daf35 100644
--- a/core/java/android/net/NetworkScorerAppManager.java
+++ b/core/java/android/net/NetworkScorerAppManager.java
@@ -23,6 +23,7 @@ import android.app.AppOpsManager;
 import android.content.Context;
 import android.content.Intent;
 import android.content.pm.ActivityInfo;
+import android.content.pm.ApplicationInfo;
 import android.content.pm.PackageManager;
 import android.content.pm.ResolveInfo;
 import android.os.UserHandle;
@@ -54,6 +55,9 @@ public final class NetworkScorerAppManager {
         /** Package name of this scorer app. */
         public final String mPackageName;
 
+        /** UID of the scorer app. */
+        public final int mPackageUid;
+
         /** Name of this scorer app for display. */
         public final CharSequence mScorerName;
 
@@ -64,10 +68,11 @@ public final class NetworkScorerAppManager {
          */
         public final String mConfigurationActivityClassName;
 
-        public NetworkScorerAppData(String packageName, CharSequence scorerName,
+        public NetworkScorerAppData(String packageName, int packageUid, CharSequence scorerName,
                 @Nullable String configurationActivityClassName) {
             mScorerName = scorerName;
             mPackageName = packageName;
+            mPackageUid = packageUid;
             mConfigurationActivityClassName = configurationActivityClassName;
         }
     }
@@ -125,7 +130,8 @@ public final class NetworkScorerAppManager {
             // NOTE: loadLabel will attempt to load the receiver's label and fall back to the app
             // label if none is present.
             scorers.add(new NetworkScorerAppData(receiverInfo.packageName,
-                    receiverInfo.loadLabel(pm), configurationActivityClassName));
+                    receiverInfo.applicationInfo.uid, receiverInfo.loadLabel(pm),
+                    configurationActivityClassName));
         }
 
         return scorers;
@@ -187,13 +193,9 @@ public final class NetworkScorerAppManager {
         if (defaultApp == null) {
             return false;
         }
-        AppOpsManager appOpsMgr = (AppOpsManager) context.getSystemService(Context.APP_OPS_SERVICE);
-        try {
-            appOpsMgr.checkPackage(callingUid, defaultApp.mPackageName);
-        } catch (SecurityException e) {
+        if (callingUid != defaultApp.mPackageUid) {
             return false;
         }
-
         // To be extra safe, ensure the caller holds the SCORE_NETWORKS permission. It always
         // should, since it couldn't become the active scorer otherwise, but this can't hurt.
         return context.checkCallingPermission(Manifest.permission.SCORE_NETWORKS) ==
diff --git a/core/tests/coretests/src/android/net/NetworkScorerAppManagerTest.java b/core/tests/coretests/src/android/net/NetworkScorerAppManagerTest.java
index 9bb44d0..605f067 100644
--- a/core/tests/coretests/src/android/net/NetworkScorerAppManagerTest.java
+++ b/core/tests/coretests/src/android/net/NetworkScorerAppManagerTest.java
@@ -57,16 +57,19 @@ public class NetworkScorerAppManagerTest extends InstrumentationTestCase {
 
     public void testGetAllValidScorers() throws Exception {
         // Package 1 - Valid scorer.
-        Pair<ResolveInfo, ResolveInfo> package1 = buildResolveInfo("package1", true, true, false);
+        Pair<ResolveInfo, ResolveInfo> package1 = buildResolveInfo("package1", 1, true, true,
+                false);
 
         // Package 2 - Receiver does not have BROADCAST_NETWORK_PRIVILEGED permission.
-        Pair<ResolveInfo, ResolveInfo> package2 = buildResolveInfo("package2", false, true, false);
+        Pair<ResolveInfo, ResolveInfo> package2 = buildResolveInfo("package2", 2, false, true,
+                false);
 
         // Package 3 - App does not have SCORE_NETWORKS permission.
-        Pair<ResolveInfo, ResolveInfo> package3 = buildResolveInfo("package3", true, false, false);
+        Pair<ResolveInfo, ResolveInfo> package3 = buildResolveInfo("package3", 3, true, false,
+                false);
 
         // Package 4 - Valid scorer w/ optional config activity.
-        Pair<ResolveInfo, ResolveInfo> package4 = buildResolveInfo("package4", true, true, true);
+        Pair<ResolveInfo, ResolveInfo> package4 = buildResolveInfo("package4", 4, true, true, true);
 
         List<Pair<ResolveInfo, ResolveInfo>> scorers = new ArrayList<>();
         scorers.add(package1);
@@ -81,11 +84,13 @@ public class NetworkScorerAppManagerTest extends InstrumentationTestCase {
         assertTrue(result.hasNext());
         NetworkScorerAppData next = result.next();
         assertEquals("package1", next.mPackageName);
+        assertEquals(1, next.mPackageUid);
         assertNull(next.mConfigurationActivityClassName);
 
         assertTrue(result.hasNext());
         next = result.next();
         assertEquals("package4", next.mPackageName);
+        assertEquals(4, next.mPackageUid);
         assertEquals(".ConfigActivity", next.mConfigurationActivityClassName);
 
         assertFalse(result.hasNext());
@@ -122,7 +127,7 @@ public class NetworkScorerAppManagerTest extends InstrumentationTestCase {
                 .thenReturn(receivers);
     }
 
-    private Pair<ResolveInfo, ResolveInfo> buildResolveInfo(String packageName,
+    private Pair<ResolveInfo, ResolveInfo> buildResolveInfo(String packageName, int packageUid,
             boolean hasReceiverPermission, boolean hasScorePermission, boolean hasConfigActivity)
             throws Exception {
         Mockito.when(mMockPm.checkPermission(permission.SCORE_NETWORKS, packageName))
@@ -133,6 +138,7 @@ public class NetworkScorerAppManagerTest extends InstrumentationTestCase {
         resolveInfo.activityInfo = new ActivityInfo();
         resolveInfo.activityInfo.packageName = packageName;
         resolveInfo.activityInfo.applicationInfo = new ApplicationInfo();
+        resolveInfo.activityInfo.applicationInfo.uid = packageUid;
         if (hasReceiverPermission) {
             resolveInfo.activityInfo.permission = permission.BROADCAST_NETWORK_PRIVILEGED;
         }