title: Exploiting checkCallingOrSelfPermission() for privilege escalation attack
body: <p>I was going through checkCallingOrSelfPermission() in the Context class and wondering how it can be exploited; i.e. if some application triggers a method of the callee/your application which in turn calls checkCallingOrSelfPermission(), finally giving access to that permission to the other application, or releasing sensitive information that would otherwise require that permission.</p>
  
  <p>This is what i understood after going through the Java Doc:</p>
  
  <p>This method can be only exploited by any calling application which is in the same process of callee application. To get into the same process both the apps need to have the same shareuserid and process in the manifest file, in addition to also being signed by the same certificate.</p>
  
  <p>So the calling application needs to do following.</p>
  
  <ol>
  <li><p>Has to know under which process and shareuser id the callee application is running. (I'm not sure how feasible this is?)</p></li>
  <li><p>Has to be signed with the same certificate that the callee application was signed with (unlikely assuming the certificate is kept safe).</p></li>
  </ol>
  
  <p>Is this the method of exploitation that the checkCallingOrSelfPermission() documentation is warning against, or are there other (more realistic) ways that it could be exploited.</p>
  
  <p>I also checked <a href="https://stackoverflow.com/questions/18434972/on-checking-for-permissions-dynamically-in-android-apps">this post</a>, but the answer was not satisfactory.</p>