Binder.getCallingUid() always reports the proximate caller.
Suppose that A makes a remote call into B, and B immediately makes a remote call into C; and none of these ever call Binder.clearCallingIdentity().
B sees getCallingUid() == A's uid.
C sees getCallingUid() == B's uid.
Caller identity is not transitive. For example, this means that if the system process calls into your app process, and then you turn around and call back into the system, it still properly recognizes your app as being the caller.
In your example, while running function() in the LMN process, Binder.getCallingUid() reports XYZ's uid.
--
christopher tate
android framework engineer