Code: static int svc_can_register(const uint16_t *name, size_t name_len, pid_t spid, uid_t uid)

 {
     const char *perm = "add";
 
    if (uid >= AID_APP) {
         return 0; /* Don't allow apps to register services */
     }
 
 return check_mac_perms_from_lookup(spid, uid, perm, str8(name, name_len)) ? 1 : 0;
}

Vulnerability Type: +Priv 
CWE ID: CWE-264
Summary: cmds/servicemanager/service_manager.c in ServiceManager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not properly restrict service registration, which allows attackers to gain privileges via a crafted application, aka internal bug 29431260.
Commit Message: ServiceManager: Allow system services running as secondary users to add services

This should be reverted when all system services have been cleaned up to not
do this. A process looking up a service while running in the background will
see the service registered by the active user (assuming the service is
registered on every user switch), not the service registered by the user that
the process itself belongs to.

BUG: 30795333
Change-Id: I1b74d58be38ed358f43c163692f9e704f8f31dbe
(cherry picked from commit e6bbe69ba739c8a08837134437aaccfea5f1d943)
