Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 096fce8b authored by Louis Chang's avatar Louis Chang
Browse files

Only allow sysui or system to set a Task to always-on-top 

Set task always-on-top was introduced in commit 8a168906 and
no permission check was added. Luckily, the attribute only
works if the Task is in multi-window mode.

Bug: 379791774
Test: SafeActivityOptionsTest
Flag: EXEMPT bugfix
Change-Id: I0ca7a3a2e9100c0eae781cac483594dbdf090987
parent 662f37ea

services/core/java/com/android/server/wm/SafeActivityOptions.java

+5 −2
Original line number Diff line number Diff line
@@ -361,10 +361,13 @@ public class SafeActivityOptions { 
        }



        // If launched from bubble is specified, then ensure that the caller is system or sysui.

        if (options.getLaunchedFromBubble() && !isSystemOrSystemUI(callingPid, callingUid)) {

        if ((options.getLaunchedFromBubble() || options.getTaskAlwaysOnTop())

                && !isSystemOrSystemUI(callingPid, callingUid)) {

            final String msg = "Permission Denial: starting " + getIntentString(intent)

                    + " from " + callerApp + " (pid=" + callingPid

                    + ", uid=" + callingUid + ") with launchedFromBubble=true";

                    + ", uid=" + callingUid + ") with"

                    + (options.getLaunchedFromBubble() ? " launchedFromBubble=true" : "")

                    + (options.getTaskAlwaysOnTop() ? " taskAlwaysOnTop=true" : "");

            Slog.w(TAG, msg);

            throw new SecurityException(msg);

        }

services/tests/wmtests/src/com/android/server/wm/SafeActivityOptionsTest.java

+4 −0
Original line number Diff line number Diff line
@@ -161,6 +161,10 @@ public class SafeActivityOptionsTest { 
            activityOptions.setLaunchedFromBubble(true);

            verifySecureExceptionThrown(activityOptions, taskSupervisor);



            activityOptions = ActivityOptions.makeBasic();

            activityOptions.setTaskAlwaysOnTop(true);

            verifySecureExceptionThrown(activityOptions, taskSupervisor);



            activityOptions = ActivityOptions.makeBasic();

            activityOptions.setLaunchDisplayId(DEFAULT_DISPLAY);

            verifySecureExceptionThrown(activityOptions, taskSupervisor);