Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 36ebe84c authored by Daniel Norman's avatar Daniel Norman
Browse files

fix: Unbind an A11yService from onNullBinding 

With this fix, a service which returns null in onBind() will no longer
stay bound by system_server and will no longer be able to launch
activities from the background.

Bug: 386950836
Test: Follow steps in the bug to reproduce the issue; observe that BAL
      is no longer allowed.
Test: atest android.security.cts.Bug_386950836
Flag: EXEMPT security bugfix
Merged-In: Id04111b061881d23346aa90a0b5d08a28bed2c6f
Change-Id: Id04111b061881d23346aa90a0b5d08a28bed2c6f
parent e8a38ef4

services/accessibility/java/com/android/server/accessibility/AccessibilityServiceConnection.java

+10 −0
Original line number Diff line number Diff line
@@ -252,6 +252,16 @@ class AccessibilityServiceConnection extends AbstractAccessibilityServiceConnect 
        }

    }



    @Override

    public void onNullBinding(ComponentName componentName) {

        // Per guidance from ServiceConnection we must call Context#unbindService here to

        // release the tracking resources associated with the ServiceConnection, to prevent

        // Background Activity Launches (BAL).

        synchronized (mLock) {

            unbindLocked();

        }

    }



    @Override

    protected boolean hasRightsToCurrentUserLocked() {

        // We treat calls from a profile as if made by its parent as profiles