Merge "Package checks for resloving recovery tokens should be user sensitive." into klp-dev

1 files changed, 13 insertions, 8 deletions

diff --git a/services/java/com/android/server/accounts/AccountManagerService.java b/services/java/com/android/server/accounts/AccountManagerService.java
index cc43a9c..f972f70 100644
--- a/services/java/com/android/server/accounts/AccountManagerService.java
+++ b/services/java/com/android/server/accounts/AccountManagerService.java
@@ -2167,15 +2167,20 @@ public class AccountManagerService
                  * this can be very bad when those apps are in the system like
                  * the System Settings.
                  */
-                PackageManager pm = mContext.getPackageManager();
-                ResolveInfo resolveInfo = pm.resolveActivity(intent, 0);
-                int targetUid = resolveInfo.activityInfo.applicationInfo.uid;
                 int authenticatorUid = Binder.getCallingUid();
-                if (PackageManager.SIGNATURE_MATCH !=
-                        pm.checkSignatures(authenticatorUid, targetUid)) {
-                    throw new SecurityException(
-                            "Activity to be started with KEY_INTENT must " +
-                            "share Authenticator's signatures");
+                long bid = Binder.clearCallingIdentity();
+                try {
+                    PackageManager pm = mContext.getPackageManager();
+                    ResolveInfo resolveInfo = pm.resolveActivityAsUser(intent, 0, mAccounts.userId);
+                    int targetUid = resolveInfo.activityInfo.applicationInfo.uid;
+                    if (PackageManager.SIGNATURE_MATCH !=
+                            pm.checkSignatures(authenticatorUid, targetUid)) {
+                        throw new SecurityException(
+                                "Activity to be started with KEY_INTENT must " +
+                               "share Authenticator's signatures");
+                    }
+                } finally {
+                    Binder.restoreCallingIdentity(bid);
                 }
             }
             if (result != null