Merge "Switch media fw permissions checks to AttributionSource" into sc-dev (1028eb2f) · Commits · e / os / android_frameworks_base

core/api/test-current.txt

+11 −2

Original line number	Diff line number	Diff line
		@@ -201,6 +201,11 @@ package android.app {
		method @RequiresPermission("android.permission.MANAGE_APPOPS") public void setHistoryParameters(int, long, int);
		method @RequiresPermission("android.permission.MANAGE_APP_OPS_MODES") public void setMode(int, int, String, int);
		method public static int strOpToOp(@NonNull String);
		field public static final int ATTRIBUTION_CHAIN_ID_NONE = -1; // 0xffffffff
		field public static final int ATTRIBUTION_FLAGS_NONE = 0; // 0x0
		field public static final int ATTRIBUTION_FLAG_ACCESSOR = 1; // 0x1
		field public static final int ATTRIBUTION_FLAG_INTERMEDIARY = 2; // 0x2
		field public static final int ATTRIBUTION_FLAG_RECEIVER = 4; // 0x4
		field public static final int HISTORICAL_MODE_DISABLED = 0; // 0x0
		field public static final int HISTORICAL_MODE_ENABLED_ACTIVE = 1; // 0x1
		field public static final int HISTORICAL_MODE_ENABLED_PASSIVE = 2; // 0x2
		@@ -230,6 +235,10 @@ package android.app {
		method public void offsetBeginAndEndTime(long);
		}

		public static interface AppOpsManager.OnOpActiveChangedListener {
		method public default void onOpActiveChanged(@NonNull String, int, @NonNull String, @Nullable String, boolean, int, int);
		}

		public class BroadcastOptions {
		ctor public BroadcastOptions(@NonNull android.os.Bundle);
		method public int getMaxManifestReceiverApiLevel();
		@@ -669,7 +678,7 @@ package android.content {

		public final class AttributionSource implements android.os.Parcelable {
		ctor public AttributionSource(int, @Nullable String, @Nullable String);
		ctor public AttributionSource(int, @Nullable String, @Nullable String, @Nullable android.content.AttributionSource);
		ctor public AttributionSource(int, @Nullable String, @Nullable String, @NonNull android.os.IBinder);
		ctor public AttributionSource(int, @Nullable String, @Nullable String, @Nullable java.util.Set<java.lang.String>, @Nullable android.content.AttributionSource);
		}

		@@ -2041,7 +2050,7 @@ package android.permission {
		public final class PermissionManager {
		method @NonNull @RequiresPermission(android.Manifest.permission.GET_APP_OPS_STATS) public java.util.List<android.permission.PermGroupUsage> getIndicatorAppOpUsageData();
		method @NonNull @RequiresPermission(android.Manifest.permission.GET_APP_OPS_STATS) public java.util.List<android.permission.PermGroupUsage> getIndicatorAppOpUsageData(boolean);
		method @NonNull public android.content.AttributionSource registerAttributionSource(@NonNull android.content.AttributionSource);
		method public void registerAttributionSource(@NonNull android.content.AttributionSource);
		}

		}

core/java/android/app/AppOpsManager.java

+156 −21

Original line number	Diff line number	Diff line
		@@ -708,6 +708,62 @@ public class AppOpsManager {
		}
		}

		/**
		* Attribution chain flag: specifies that this is the accessor. When
		* an app A accesses the data that is then passed to app B that is then
		* passed to C, we call app A accessor, app B intermediary, and app C
		* receiver. If A accesses the data for itself, then it is the accessor
		* and the receiver.
		* @hide
		*/
		@TestApi
		public static final int ATTRIBUTION_FLAG_ACCESSOR = 0x1;

		/**
		* Attribution chain flag: specifies that this is the intermediary. When
		* an app A accesses the data that is then passed to app B that is then
		* passed to C, we call app A accessor, app B intermediary, and app C
		* receiver. If A accesses the data for itself, then it is the accessor
		* and the receiver.
		* @hide
		*/
		@TestApi
		public static final int ATTRIBUTION_FLAG_INTERMEDIARY = 0x2;

		/**
		* Attribution chain flag: specifies that this is the receiver. When
		* an app A accesses the data that is then passed to app B that is then
		* passed to C, we call app A accessor, app B intermediary, and app C
		* receiver. If A accesses the data for itself, then it is the accessor
		* and the receiver.
		* @hide
		*/
		@TestApi
		public static final int ATTRIBUTION_FLAG_RECEIVER = 0x4;

		/**
		* No attribution flags.
		* @hide
		*/
		@TestApi
		public static final int ATTRIBUTION_FLAGS_NONE = 0x0;

		/**
		* No attribution chain id.
		* @hide
		*/
		@TestApi
		public static final int ATTRIBUTION_CHAIN_ID_NONE = -1;

		/** @hide */
		@Retention(RetentionPolicy.SOURCE)
		@IntDef(flag = true, prefix = { "FLAG_" }, value = {
		ATTRIBUTION_FLAG_ACCESSOR,
		ATTRIBUTION_FLAG_INTERMEDIARY,
		ATTRIBUTION_FLAG_RECEIVER
		})
		public @interface AttributionFlags {}

		// These constants are redefined here to work around a metalava limitation/bug where
		// @IntDef is not able to see @hide symbols when they are hidden via package hiding:
		// frameworks/base/core/java/com/android/internal/package.html
		@@ -7063,6 +7119,25 @@ public class AppOpsManager {
		*/
		void onOpActiveChanged(@NonNull String op, int uid, @NonNull String packageName,
		boolean active);

		/**
		* Called when the active state of an app-op changes.
		*
		* @param op The operation that changed.
		* @param uid The UID performing the operation.
		* @param packageName The package performing the operation.
		* @param attributionTag The operation's attribution tag.
		* @param active Whether the operation became active or inactive.
		* @param attributionFlags the attribution flags for this operation.
		* @param attributionChainId the unique id of the attribution chain this op is a part of.
		* @hide
		*/
		@TestApi
		default void onOpActiveChanged(@NonNull String op, int uid, @NonNull String packageName,
		@Nullable String attributionTag, boolean active, @AttributionFlags
		int attributionFlags, int attributionChainId) {
		onOpActiveChanged(op, uid, packageName, active);
		}
		}

		/**
		@@ -7684,14 +7759,17 @@ public class AppOpsManager {
		}
		cb = new IAppOpsActiveCallback.Stub() {
		@Override
		public void opActiveChanged(int op, int uid, String packageName, boolean active) {
		public void opActiveChanged(int op, int uid, String packageName,
		String attributionTag, boolean active, @AttributionFlags
		int attributionFlags, int attributionChainId) {
		executor.execute(() -> {
		if (callback instanceof OnOpActiveChangedInternalListener) {
		((OnOpActiveChangedInternalListener) callback).onOpActiveChanged(op,
		uid, packageName, active);
		}
		if (sOpToString[op] != null) {
		callback.onOpActiveChanged(sOpToString[op], uid, packageName, active);
		callback.onOpActiveChanged(sOpToString[op], uid, packageName,
		attributionTag, active, attributionFlags, attributionChainId);
		}
		});
		}
		@@ -8169,8 +8247,9 @@ public class AppOpsManager {
		public int noteProxyOp(int op, @Nullable String proxiedPackageName, int proxiedUid,
		@Nullable String proxiedAttributionTag, @Nullable String message) {
		return noteProxyOp(op, new AttributionSource(mContext.getAttributionSource(),
		new AttributionSource(proxiedUid, proxiedPackageName, proxiedAttributionTag)),
		message, /skipProxyOperation/ false);
		new AttributionSource(proxiedUid, proxiedPackageName, proxiedAttributionTag,
		mContext.getAttributionSource().getToken())), message,
		/skipProxyOperation/ false);
		}

		/**
		@@ -8255,8 +8334,8 @@ public class AppOpsManager {
		int proxiedUid, @Nullable String proxiedAttributionTag, @Nullable String message) {
		return noteProxyOpNoThrow(strOpToOp(op), new AttributionSource(
		mContext.getAttributionSource(), new AttributionSource(proxiedUid,
		proxiedPackageName, proxiedAttributionTag)), message,
		/skipProxyOperation/ false);
		proxiedPackageName, proxiedAttributionTag, mContext.getAttributionSource()
		.getToken())), message,/skipProxyOperation/ false);
		}

		/**
		@@ -8592,6 +8671,29 @@ public class AppOpsManager {
		*/
		public int startOpNoThrow(int op, int uid, @NonNull String packageName,
		boolean startIfModeDefault, @Nullable String attributionTag, @Nullable String message) {
		return startOpNoThrow(mContext.getAttributionSource().getToken(), op, uid, packageName,
		startIfModeDefault, attributionTag, message);
		}

		/**
		* @see #startOpNoThrow(String, int, String, String, String)
		*
		* @hide
		*/
		public int startOpNoThrow(@NonNull IBinder token, int op, int uid, @NonNull String packageName,
		boolean startIfModeDefault, @Nullable String attributionTag, @Nullable String message) {
		return startOpNoThrow(token, op, uid, packageName, startIfModeDefault, attributionTag,
		message, ATTRIBUTION_FLAGS_NONE, ATTRIBUTION_CHAIN_ID_NONE);
		}

		/**
		* @see #startOpNoThrow(String, int, String, String, String)
		*
		* @hide
		*/
		public int startOpNoThrow(@NonNull IBinder token, int op, int uid, @NonNull String packageName,
		boolean startIfModeDefault, @Nullable String attributionTag, @Nullable String message,
		@AttributionFlags int attributionFlags, int attributionChainId) {
		try {
		collectNoteOpCallsForValidation(op);
		int collectionMode = getNotedOpCollectionMode(uid, packageName, op);
		@@ -8604,9 +8706,9 @@ public class AppOpsManager {
		}
		}

		SyncNotedAppOp syncOp = mService.startOperation(getClientId(), op, uid, packageName,
		SyncNotedAppOp syncOp = mService.startOperation(token, op, uid, packageName,
		attributionTag, startIfModeDefault, collectionMode == COLLECT_ASYNC, message,
		shouldCollectMessage);
		shouldCollectMessage, attributionFlags, attributionChainId);

		if (syncOp.getOpMode() == MODE_ALLOWED) {
		if (collectionMode == COLLECT_SELF) {
		@@ -8643,8 +8745,9 @@ public class AppOpsManager {
		public int startProxyOp(@NonNull String op, int proxiedUid, @NonNull String proxiedPackageName,
		@Nullable String proxiedAttributionTag, @Nullable String message) {
		return startProxyOp(op, new AttributionSource(mContext.getAttributionSource(),
		new AttributionSource(proxiedUid, proxiedPackageName, proxiedAttributionTag)),
		message, /skipProxyOperation/ false);
		new AttributionSource(proxiedUid, proxiedPackageName, proxiedAttributionTag,
		mContext.getAttributionSource().getToken())), message,
		/skipProxyOperation/ false);
		}

		/**
		@@ -8690,7 +8793,8 @@ public class AppOpsManager {
		@Nullable String message) {
		return startProxyOpNoThrow(AppOpsManager.strOpToOp(op), new AttributionSource(
		mContext.getAttributionSource(), new AttributionSource(proxiedUid,
		proxiedPackageName, proxiedAttributionTag)), message,
		proxiedPackageName, proxiedAttributionTag,
		mContext.getAttributionSource().getToken())), message,
		/skipProxyOperation/ false);
		}

		@@ -8705,6 +8809,23 @@ public class AppOpsManager {
		*/
		public int startProxyOpNoThrow(int op, @NonNull AttributionSource attributionSource,
		@Nullable String message, boolean skipProxyOperation) {
		return startProxyOpNoThrow(op, attributionSource, message, skipProxyOperation,
		ATTRIBUTION_FLAGS_NONE, ATTRIBUTION_FLAGS_NONE, ATTRIBUTION_CHAIN_ID_NONE);
		}

		/**
		* Like {@link #startProxyOp(String, AttributionSource, String)} but instead
		* of throwing a {@link SecurityException} it returns {@link #MODE_ERRORED} and
		* the checks is for the attribution chain specified by the {@link AttributionSource}.
		*
		* @see #startProxyOp(String, AttributionSource, String)
		*
		* @hide
		*/
		public int startProxyOpNoThrow(int op, @NonNull AttributionSource attributionSource,
		@Nullable String message, boolean skipProxyOperation, @AttributionFlags
		int proxyAttributionFlags, @AttributionFlags int proxiedAttributionFlags,
		int attributionChainId) {
		try {
		collectNoteOpCallsForValidation(op);
		int collectionMode = getNotedOpCollectionMode(
		@@ -8719,9 +8840,10 @@ public class AppOpsManager {
		}
		}

		SyncNotedAppOp syncOp = mService.startProxyOperation(getClientId(), op,
		SyncNotedAppOp syncOp = mService.startProxyOperation(op,
		attributionSource, false, collectionMode == COLLECT_ASYNC, message,
		shouldCollectMessage, skipProxyOperation);
		shouldCollectMessage, skipProxyOperation, proxyAttributionFlags,
		proxiedAttributionFlags, attributionChainId);

		if (syncOp.getOpMode() == MODE_ALLOWED) {
		if (collectionMode == COLLECT_SELF) {
		@@ -8785,8 +8907,18 @@ public class AppOpsManager {
		*/
		public void finishOp(int op, int uid, @NonNull String packageName,
		@Nullable String attributionTag) {
		finishOp(mContext.getAttributionSource().getToken(), op, uid, packageName, attributionTag);
		}

		/**
		* @see #finishOp(String, int, String, String)
		*
		* @hide
		*/
		public void finishOp(IBinder token, int op, int uid, @NonNull String packageName,
		@Nullable String attributionTag) {
		try {
		mService.finishOperation(getClientId(), op, uid, packageName, attributionTag);
		mService.finishOperation(token, op, uid, packageName, attributionTag);
		} catch (RemoteException e) {
		throw e.rethrowFromSystemServer();
		}
		@@ -8807,23 +8939,26 @@ public class AppOpsManager {
		public void finishProxyOp(@NonNull String op, int proxiedUid,
		@NonNull String proxiedPackageName, @Nullable String proxiedAttributionTag) {
		finishProxyOp(op, new AttributionSource(mContext.getAttributionSource(),
		new AttributionSource(proxiedUid, proxiedPackageName, proxiedAttributionTag)));
		new AttributionSource(proxiedUid, proxiedPackageName, proxiedAttributionTag,
		mContext.getAttributionSource().getToken())), /skipProxyOperation/ false);
		}

		/**
		* Report that an application is no longer performing an operation that had previously
		* been started with {@link #startProxyOp(String, AttributionSource, String)}. There is no
		* validation of input or result; the parameters supplied here must be the exact same ones
		* previously passed in when starting the operation.
		* been started with {@link #startProxyOp(String, AttributionSource, String, boolean)}. There
		* is no validation of input or result; the parameters supplied here must be the exact same
		* ones previously passed in when starting the operation.
		*
		* @param op The operation which was started
		* @param attributionSource The permission identity for which to finish
		* @param skipProxyOperation Whether to skip the proxy finish.
		*
		* @hide
		*/
		public void finishProxyOp(@NonNull String op, @NonNull AttributionSource attributionSource) {
		public void finishProxyOp(@NonNull String op, @NonNull AttributionSource attributionSource,
		boolean skipProxyOperation) {
		try {
		mService.finishProxyOperation(getClientId(), strOpToOp(op), attributionSource);
		mService.finishProxyOperation(strOpToOp(op), attributionSource, skipProxyOperation);
		} catch (RemoteException e) {
		throw e.rethrowFromSystemServer();
		}

core/java/android/app/AppOpsManagerInternal.java

+23 −17

Original line number	Diff line number	Diff line
		@@ -16,6 +16,7 @@

		package android.app;

		import android.app.AppOpsManager.AttributionFlags;
		import android.annotation.NonNull;
		import android.annotation.Nullable;
		import android.content.AttributionSource;
		@@ -24,13 +25,13 @@ import android.util.SparseArray;
		import android.util.SparseIntArray;

		import com.android.internal.app.IAppOpsCallback;
		import com.android.internal.util.function.DecFunction;
		import com.android.internal.util.function.HeptFunction;
		import com.android.internal.util.function.HexFunction;
		import com.android.internal.util.function.NonaFunction;
		import com.android.internal.util.function.OctFunction;
		import com.android.internal.util.function.QuadFunction;
		import com.android.internal.util.function.QuintFunction;
		import com.android.internal.util.function.TriFunction;
		import com.android.internal.util.function.UndecFunction;

		/**
		* App ops service local interface.
		@@ -52,8 +53,8 @@ public abstract class AppOpsManagerInternal {
		* @return The app op check result.
		*/
		int checkOperation(int code, int uid, String packageName, @Nullable String attributionTag,
		boolean raw,
		QuintFunction<Integer, Integer, String, String, Boolean, Integer> superImpl);
		boolean raw, QuintFunction<Integer, Integer, String, String, Boolean, Integer>
		superImpl);

		/**
		* Allows overriding check audio operation behavior.
		@@ -116,20 +117,22 @@ public abstract class AppOpsManagerInternal {
		* @param shouldCollectAsyncNotedOp If an {@link AsyncNotedAppOp} should be collected
		* @param message The message in the async noted op
		* @param shouldCollectMessage whether to collect messages
		* @param attributionFlags the attribution flags for this operation.
		* @param attributionChainId the unique id of the attribution chain this op is a part of.
		* @param superImpl The super implementation.
		* @return The app op note result.
		*/
		SyncNotedAppOp startOperation(IBinder token, int code, int uid,
		@Nullable String packageName, @Nullable String attributionTag,
		boolean startIfModeDefault, boolean shouldCollectAsyncNotedOp,
		@Nullable String message, boolean shouldCollectMessage, @NonNull NonaFunction<
		IBinder, Integer, Integer, String, String, Boolean, Boolean, String,
		Boolean, SyncNotedAppOp> superImpl);
		@Nullable String message, boolean shouldCollectMessage,
		@AttributionFlags int attributionFlags, int attributionChainId,
		@NonNull UndecFunction<IBinder, Integer, Integer, String, String, Boolean,
		Boolean, String, Boolean, Integer, Integer, SyncNotedAppOp> superImpl);

		/**
		* Allows overriding start proxy operation behavior.
		*
		* @param token The client state.
		* @param code The op code to start.
		* @param attributionSource The permission identity of the caller.
		* @param startIfModeDefault Whether to start the op of the mode is default.
		@@ -137,26 +140,29 @@ public abstract class AppOpsManagerInternal {
		* @param message The message in the async noted op
		* @param shouldCollectMessage whether to collect messages
		* @param skipProxyOperation Whether to skip the proxy portion of the operation
		* @param proxyAttributionFlags The attribution flags for the proxy.
		* @param proxiedAttributionFlags The attribution flags for the proxied.
		* @oaram attributionChainId The id of the attribution chain this operation is a part of.
		* @param superImpl The super implementation.
		* @return The app op note result.
		*/
		SyncNotedAppOp startProxyOperation(IBinder token, int code,
		@NonNull AttributionSource attributionSource, boolean startIfModeDefault,
		boolean shouldCollectAsyncNotedOp, String message, boolean shouldCollectMessage,
		boolean skipProxyOperation, @NonNull OctFunction<IBinder, Integer,
		AttributionSource, Boolean, Boolean, String, Boolean, Boolean,
		SyncNotedAppOp startProxyOperation(int code, @NonNull AttributionSource attributionSource,
		boolean startIfModeDefault, boolean shouldCollectAsyncNotedOp, String message,
		boolean shouldCollectMessage, boolean skipProxyOperation, @AttributionFlags
		int proxyAttributionFlags, @AttributionFlags int proxiedAttributionFlags,
		int attributionChainId, @NonNull DecFunction<Integer, AttributionSource, Boolean,
		Boolean, String, Boolean, Boolean, Integer, Integer, Integer,
		SyncNotedAppOp> superImpl);

		/**
		* Allows overriding finish proxy op.
		*
		* @param clientId Client state token.
		* @param code The op code to finish.
		* @param attributionSource The permission identity of the caller.
		*/
		void finishProxyOperation(IBinder clientId, int code,
		@NonNull AttributionSource attributionSource,
		@NonNull TriFunction<IBinder, Integer, AttributionSource, Void> superImpl);
		void finishProxyOperation(int code, @NonNull AttributionSource attributionSource,
		boolean skipProxyOperation,
		@NonNull TriFunction<Integer, AttributionSource, Boolean, Void> superImpl);
		}

		/**

core/java/android/app/ContextImpl.java

+1 −7

Original line number	Diff line number	Diff line
		@@ -3157,13 +3157,7 @@ class ContextImpl extends Context {
		// If we want to access protected data on behalf of another app we need to
		// tell the OS that we opt in to participate in the attribution chain.
		if (nextAttributionSource != null) {
		// If an app happened to stub the internal OS for testing the registration method
		// can return null. In this case we keep the current untrusted attribution source.
		final AttributionSource registeredAttributionSource = getSystemService(
		PermissionManager.class).registerAttributionSource(attributionSource);
		if (registeredAttributionSource != null) {
		return registeredAttributionSource;
		}
		getSystemService(PermissionManager.class).registerAttributionSource(attributionSource);
		}
		return attributionSource;
		}

core/java/android/app/SystemServiceRegistry.java

+9 −0

Original line number	Diff line number	Diff line
		@@ -186,6 +186,7 @@ import android.os.incremental.IIncrementalService;
		import android.os.incremental.IncrementalManager;
		import android.os.storage.StorageManager;
		import android.permission.LegacyPermissionManager;
		import android.permission.PermissionCheckerManager;
		import android.permission.PermissionControllerManager;
		import android.permission.PermissionManager;
		import android.print.IPrintManager;
		@@ -1334,6 +1335,14 @@ public final class SystemServiceRegistry {
		ctx.getMainThreadHandler());
		}});

		registerService(Context.PERMISSION_CHECKER_SERVICE, PermissionCheckerManager.class,
		new CachedServiceFetcher<PermissionCheckerManager>() {
		@Override
		public PermissionCheckerManager createService(ContextImpl ctx)
		throws ServiceNotFoundException {
		return new PermissionCheckerManager(ctx.getOuterContext());
		}});

		registerService(Context.DYNAMIC_SYSTEM_SERVICE, DynamicSystemManager.class,
		new CachedServiceFetcher<DynamicSystemManager>() {
		@Override