I'm facing an issue with permissions to write system properties in a multi-user scenario, specifically the fact that they are only available to the primary user ("owner").
In the check_perms method @ property_service.c the prefix of the property is mapped to a UID which is compared to that of the caller, but the userid bits are not masked out. This means that an app running as e.g. AID_SYSTEM will not be able to access system permissions granted for this UID when it's running as a secondary user.
I'm curious as to what is the reason for this limitation? Is this deliberate? Is there a security concern here that I am missing? If an app is allowed to run as system, doesn’t it make sense to grant it the same rights regardless of the current user of the device?
What makes me even more curious is that there is a previous patch that solves this issue for the AID_BLUETOOTH user specifically:
static int check_perms(const char *name, unsigned int uid, unsigned int gid, char *sctx){ [...]
app_id = multiuser_get_app_id(uid); if (app_id == AID_BLUETOOTH) { uid = app_id; }
Is there a reason for not *always* using the app id rather than the full uid including user id bits when checking system property permissions?
I'm considering uploading a patch that either adds (app_id == AID_BLUETOOTH || app_id == AID_SYSTEM), or simply removes the check altogether (meaning always using the app id). Would that have any chance of being accepted?
