clear caller identify before sending system update notification

Because DeviceAdminReceiver is protected by BIND_DEVICE_ADMIN permission,
in order to send broadcast to it, we need to clear the caller's identity
and call sendBroadcastAsUser() as system.

Bug: 20213644
Change-Id: Icc7b239b9005e286012ade6580ec92a0a57198e0

1 files changed, 10 insertions, 4 deletions

diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 67c198f..3ac09d2 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -6296,10 +6296,16 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
                 return;
             }
 
+            ActivityInfo[] receivers = null;
             try {
-                ActivityInfo[] receivers  = mContext.getPackageManager().getPackageInfo(
+                receivers  = mContext.getPackageManager().getPackageInfo(
                         deviceOwnerPackage, PackageManager.GET_RECEIVERS).receivers;
-                if (receivers != null) {
+            } catch (NameNotFoundException e) {
+                Log.e(LOG_TAG, "Cannot find device owner package", e);
+            }
+            if (receivers != null) {
+                long ident = Binder.clearCallingIdentity();
+                try {
                     for (int i = 0; i < receivers.length; i++) {
                         if (permission.BIND_DEVICE_ADMIN.equals(receivers[i].permission)) {
                             intent.setComponent(new ComponentName(deviceOwnerPackage,
@@ -6307,9 +6313,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
                             mContext.sendBroadcastAsUser(intent, UserHandle.OWNER);
                         }
                     }
+                } finally {
+                    Binder.restoreCallingIdentity(ident);
                 }
-            } catch (NameNotFoundException e) {
-                Log.e(LOG_TAG, "Cannot find device owner package", e);
             }
         }
     }