Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 13ce4693 authored by Phil Weaver's avatar Phil Weaver
Browse files

Clear calling identity when binding a11y services 

When a UiAutomation is destroyed, accessibility services may get
enabled as a side effect. That was causing these services to be
enabled in a binder thread, which threw a SecurityException.

Bug: 28268310
Bug: 28163652
Change-Id: Ie25ab05569b5b21b5f30e7d7eed24ef73b7ba159
parent b1dea03f

services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java

+10 −5
Original line number Diff line number Diff line
@@ -2298,12 +2298,17 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub { 
        public boolean bindLocked() {

            UserState userState = getUserStateLocked(mUserId);

            if (!mIsAutomation) {

                final long identity = Binder.clearCallingIdentity();

                try {

                    if (mService == null && mContext.bindServiceAsUser(

                            mIntent, this,

                            Context.BIND_AUTO_CREATE | Context.BIND_FOREGROUND_SERVICE_WHILE_AWAKE,

                            new UserHandle(mUserId))) {

                        userState.mBindingServices.add(mComponentName);

                    }

                } finally {

                    Binder.restoreCallingIdentity(identity);

                }

            } else {

                userState.mBindingServices.add(mComponentName);

                mService = userState.mUiAutomationServiceClient.asBinder();