Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 18535a0d authored by Nan Wu's avatar Nan Wu
Browse files

Add creator token optimization 

if the creator package is the same as the target package of the
top level intent that is being started, skip adding creator token
for its embedded intents. This is a case where extra intents were
passed around within one app.

Bug: 368559550
Test: regression tests like ActivityManagerServiceTest and manual test
Flag: android.security.prevent_intent_redirect
Change-Id: I10c032d227b130c2a89b9961fe48f116d88bb4e3
parent 15c3305a

core/java/android/content/Intent.java

+0 −2
Original line number Diff line number Diff line
@@ -87,7 +87,6 @@ import android.util.AttributeSet; 
import android.util.Log;

import android.util.proto.ProtoOutputStream;













import com.android.internal.annotations.VisibleForTesting;















import com.android.internal.util.XmlUtils;















import com.android.modules.expresslog.Counter;
























@@ -12304,7 +12303,6 @@ public class Intent implements Parcelable, Cloneable {













    }





























    /** @hide */













    @VisibleForTesting















    public Set<NestedIntentKey> getExtraIntentKeys() {















        return mCreatorTokenInfo == null ? null : mCreatorTokenInfo.mNestedIntentKeys;















    }

































services/core/java/com/android/server/am/ActivityManagerService.java



+21
−5




























Original line number
Diff line number
Diff line








@@ -668,6 +668,8 @@ public class ActivityManagerService extends IActivityManager.Stub













     */















    private static final boolean ENABLE_PROC_LOCK = true;



























    private static final int DEFAULT_INTENT_CREATOR_UID = -1;



























    /**















     * The lock for process management.















     *










@@ -19308,22 +19310,36 @@ public class ActivityManagerService extends IActivityManager.Stub













        if (!preventIntentRedirect()) return;





























        if (intent == null) return;

























        String targetPackage = intent.getComponent() != null













                ? intent.getComponent().getPackageName()













                : intent.getPackage();













        final boolean isCreatorSameAsTarget = creatorPackage != null && creatorPackage.equals(













                targetPackage);













        final boolean noExtraIntentKeys =













                intent.getExtraIntentKeys() == null || intent.getExtraIntentKeys().isEmpty();













        final int creatorUid = noExtraIntentKeys ? DEFAULT_INTENT_CREATOR_UID : Binder.getCallingUid();



























        intent.forEachNestedCreatorToken(extraIntent -> {













            IntentCreatorToken creatorToken = createIntentCreatorToken(extraIntent, creatorPackage);













            if (isCreatorSameAsTarget) {













                FrameworkStatsLog.write(INTENT_CREATOR_TOKEN_ADDED, creatorUid, true);













                return;













            }













            IntentCreatorToken creatorToken = createIntentCreatorToken(extraIntent, creatorUid,













                    creatorPackage);















            if (creatorToken != null) {















                extraIntent.setCreatorToken(creatorToken);















                // TODO remove Slog.wtf once proven FrameworkStatsLog works. b/375396329















                Slog.wtf(TAG, "A creator token is added to an intent. creatorPackage: "















                        + creatorPackage + "; intent: " + extraIntent);













                FrameworkStatsLog.write(INTENT_CREATOR_TOKEN_ADDED,













                        creatorToken.getCreatorUid());













                FrameworkStatsLog.write(INTENT_CREATOR_TOKEN_ADDED, creatorUid, false);















            }















        });















    }



























    private IntentCreatorToken createIntentCreatorToken(Intent intent, String creatorPackage) {













    private IntentCreatorToken createIntentCreatorToken(Intent intent, int creatorUid,













            String creatorPackage) {















        if (IntentCreatorToken.isValid(intent)) return null;













        int creatorUid = getCallingUid();















        IntentCreatorToken.Key key = new IntentCreatorToken.Key(creatorUid, creatorPackage, intent);















        IntentCreatorToken token;















        synchronized (sIntentCreatorTokenCache) {