Merge "Validate that the system ui proxy calls are from current user" (1e2d485a) · Commits · e / os / android_frameworks_base

packages/SystemUI/src/com/android/systemui/OverviewProxyService.java

+37 −0

Original line number	Diff line number	Diff line
		@@ -82,11 +82,15 @@ public class OverviewProxyService implements CallbackController<OverviewProxyLis
		private int mConnectionBackoffAttempts;
		private @InteractionType int mInteractionFlags;
		private boolean mIsEnabled;
		private int mCurrentBoundedUserId = -1;

		private ISystemUiProxy mSysUiProxy = new ISystemUiProxy.Stub() {

		public GraphicBufferCompat screenshot(Rect sourceCrop, int width, int height, int minLayer,
		int maxLayer, boolean useIdentityTransform, int rotation) {
		if (!verifyCaller("screenshot")) {
		return null;
		}
		long token = Binder.clearCallingIdentity();
		try {
		return new GraphicBufferCompat(SurfaceControl.screenshotToBuffer(sourceCrop, width,
		@@ -97,6 +101,9 @@ public class OverviewProxyService implements CallbackController<OverviewProxyLis
		}

		public void startScreenPinning(int taskId) {
		if (!verifyCaller("startScreenPinning")) {
		return;
		}
		long token = Binder.clearCallingIdentity();
		try {
		mHandler.post(() -> {
		@@ -112,6 +119,9 @@ public class OverviewProxyService implements CallbackController<OverviewProxyLis
		}

		public void onSplitScreenInvoked() {
		if (!verifyCaller("onSplitScreenInvoked")) {
		return;
		}
		long token = Binder.clearCallingIdentity();
		try {
		EventBus.getDefault().post(new DockedFirstAnimationFrameEvent());
		@@ -121,6 +131,9 @@ public class OverviewProxyService implements CallbackController<OverviewProxyLis
		}

		public void onOverviewShown(boolean fromHome) {
		if (!verifyCaller("onOverviewShown")) {
		return;
		}
		long token = Binder.clearCallingIdentity();
		try {
		mHandler.post(() -> {
		@@ -134,6 +147,9 @@ public class OverviewProxyService implements CallbackController<OverviewProxyLis
		}

		public void setInteractionState(@InteractionType int flags) {
		if (!verifyCaller("setInteractionState")) {
		return;
		}
		long token = Binder.clearCallingIdentity();
		try {
		if (mInteractionFlags != flags) {
		@@ -151,6 +167,9 @@ public class OverviewProxyService implements CallbackController<OverviewProxyLis
		}

		public Rect getNonMinimizedSplitScreenSecondaryBounds() {
		if (!verifyCaller("getNonMinimizedSplitScreenSecondaryBounds")) {
		return null;
		}
		long token = Binder.clearCallingIdentity();
		try {
		Divider divider = SysUiServiceProvider.getComponent(mContext, Divider.class);
		@@ -164,6 +183,9 @@ public class OverviewProxyService implements CallbackController<OverviewProxyLis
		}

		public void setBackButtonAlpha(float alpha, boolean animate) {
		if (!verifyCaller("setBackButtonAlpha")) {
		return;
		}
		long token = Binder.clearCallingIdentity();
		try {
		mHandler.post(() -> {
		@@ -173,6 +195,16 @@ public class OverviewProxyService implements CallbackController<OverviewProxyLis
		Binder.restoreCallingIdentity(token);
		}
		}

		private boolean verifyCaller(String reason) {
		final int callerId = Binder.getCallingUserHandle().getIdentifier();
		if (callerId != mCurrentBoundedUserId) {
		Log.w(TAG_OPS, "Launcher called sysui with invalid user: " + callerId + ", reason: "
		+ reason);
		return false;
		}
		return true;
		}
		};

		private final Runnable mDeferredConnectionCallback = () -> {
		@@ -211,7 +243,9 @@ public class OverviewProxyService implements CallbackController<OverviewProxyLis
		}
		try {
		mOverviewProxy.onBind(mSysUiProxy);
		mCurrentBoundedUserId = mDeviceProvisionedController.getCurrentUser();
		} catch (RemoteException e) {
		mCurrentBoundedUserId = -1;
		Log.e(TAG_OPS, "Failed to call onBind()", e);
		}
		notifyConnectionChanged();
		@@ -220,18 +254,21 @@ public class OverviewProxyService implements CallbackController<OverviewProxyLis
		@Override
		public void onNullBinding(ComponentName name) {
		Log.w(TAG_OPS, "Null binding of '" + name + "', try reconnecting");
		mCurrentBoundedUserId = -1;
		internalConnectToCurrentUser();
		}

		@Override
		public void onBindingDied(ComponentName name) {
		Log.w(TAG_OPS, "Binding died of '" + name + "', try reconnecting");
		mCurrentBoundedUserId = -1;
		internalConnectToCurrentUser();
		}

		@Override
		public void onServiceDisconnected(ComponentName name) {
		// Do nothing
		mCurrentBoundedUserId = -1;
		}
		};