diff --git a/services/camera/libcameraservice/CameraService.cpp b/services/camera/libcameraservice/CameraService.cpp index 9af1c36147..f92d6732d3 100644 --- a/services/camera/libcameraservice/CameraService.cpp +++ b/services/camera/libcameraservice/CameraService.cpp @@ -2742,7 +2742,7 @@ CameraService::BasicClient::BasicClient(const sp& cameraService, mClientPackageName(clientPackageName), mClientPid(clientPid), mClientUid(clientUid), mServicePid(servicePid), - mDisconnected(false), + mDisconnected(false), mUidIsTrusted(false), mAudioRestriction(hardware::camera2::ICameraDeviceUser::AUDIO_RESTRICTION_NONE), mRemoteBinder(remoteCallback) { @@ -2791,6 +2791,8 @@ CameraService::BasicClient::BasicClient(const sp& cameraService, if (getCurrentServingCall() != BinderCallType::HWBINDER) { mAppOpsManager = std::make_unique(); } + + mUidIsTrusted = isTrustedCallingUid(mClientUid); } CameraService::BasicClient::~BasicClient() { @@ -2905,7 +2907,9 @@ status_t CameraService::BasicClient::startCameraOps() { return PERMISSION_DENIED; } - if (res == AppOpsManager::MODE_IGNORED) { + // If the calling Uid is trusted (a native service), the AppOpsManager could + // return MODE_IGNORED. Do not treat such case as error. + if (!mUidIsTrusted && res == AppOpsManager::MODE_IGNORED) { ALOGI("Camera %s: Access for \"%s\" has been restricted", mCameraIdStr.string(), String8(mClientPackageName).string()); // Return the same error as for device policy manager rejection diff --git a/services/camera/libcameraservice/CameraService.h b/services/camera/libcameraservice/CameraService.h index 1adf15a712..18cf77a3d6 100644 --- a/services/camera/libcameraservice/CameraService.h +++ b/services/camera/libcameraservice/CameraService.h @@ -323,6 +323,7 @@ public: const uid_t mClientUid; const pid_t mServicePid; bool mDisconnected; + bool mUidIsTrusted; mutable Mutex mAudioRestrictionLock; int32_t mAudioRestriction; diff --git a/services/camera/libcameraservice/api2/CameraOfflineSessionClient.cpp b/services/camera/libcameraservice/api2/CameraOfflineSessionClient.cpp index 8f20685c59..237c24bb00 100644 --- a/services/camera/libcameraservice/api2/CameraOfflineSessionClient.cpp +++ b/services/camera/libcameraservice/api2/CameraOfflineSessionClient.cpp @@ -197,7 +197,9 @@ status_t CameraOfflineSessionClient::startCameraOps() { return PERMISSION_DENIED; } - if (res == AppOpsManager::MODE_IGNORED) { + // If the calling Uid is trusted (a native service), the AppOpsManager could + // return MODE_IGNORED. Do not treat such case as error. + if (!mUidIsTrusted && res == AppOpsManager::MODE_IGNORED) { ALOGI("Offline Camera %s: Access for \"%s\" has been restricted", mCameraIdStr.string(), String8(mClientPackageName).string()); // Return the same error as for device policy manager rejection