Merge "Clear calling identity to grant CDM permission when checking device config." (49e775f2) · Commits · e / os / android_frameworks_base

core/java/android/companion/CompanionDeviceManager.java

+0 −14

Original line number	Original line	Diff line number	Diff line
	@@ -36,7 +36,6 @@ import android.app.NotificationManager;
	import android.app.PendingIntent;		import android.app.PendingIntent;
	import android.bluetooth.BluetoothAdapter;		import android.bluetooth.BluetoothAdapter;
	import android.bluetooth.BluetoothDevice;		import android.bluetooth.BluetoothDevice;
	import android.companion.utils.FeatureUtils;
	import android.content.ComponentName;		import android.content.ComponentName;
	import android.content.Context;		import android.content.Context;
	import android.content.Intent;		import android.content.Intent;
	@@ -1227,11 +1226,6 @@ public final class CompanionDeviceManager {
	@Nullable		@Nullable
	public IntentSender buildPermissionTransferUserConsentIntent(int associationId)		public IntentSender buildPermissionTransferUserConsentIntent(int associationId)
	throws DeviceNotAssociatedException {		throws DeviceNotAssociatedException {
	if (!FeatureUtils.isPermSyncEnabled()) {
	throw new UnsupportedOperationException("Calling"
	+ " buildPermissionTransferUserConsentIntent, but this API is disabled by the"
	+ " system.");
	}
	try {		try {
	PendingIntent pendingIntent = mService.buildPermissionTransferUserConsentIntent(		PendingIntent pendingIntent = mService.buildPermissionTransferUserConsentIntent(
	mContext.getOpPackageName(),		mContext.getOpPackageName(),
	@@ -1264,10 +1258,6 @@ public final class CompanionDeviceManager {
	@Deprecated		@Deprecated
	@UserHandleAware		@UserHandleAware
	public void startSystemDataTransfer(int associationId) throws DeviceNotAssociatedException {		public void startSystemDataTransfer(int associationId) throws DeviceNotAssociatedException {
	if (!FeatureUtils.isPermSyncEnabled()) {
	throw new UnsupportedOperationException("Calling startSystemDataTransfer, but this API"
	+ " is disabled by the system.");
	}
	try {		try {
	mService.startSystemDataTransfer(mContext.getOpPackageName(), mContext.getUserId(),		mService.startSystemDataTransfer(mContext.getOpPackageName(), mContext.getUserId(),
	associationId, null);		associationId, null);
	@@ -1300,10 +1290,6 @@ public final class CompanionDeviceManager {
	@NonNull Executor executor,		@NonNull Executor executor,
	@NonNull OutcomeReceiver<Void, CompanionException> result)		@NonNull OutcomeReceiver<Void, CompanionException> result)
	throws DeviceNotAssociatedException {		throws DeviceNotAssociatedException {
	if (!FeatureUtils.isPermSyncEnabled()) {
	throw new UnsupportedOperationException("Calling startSystemDataTransfer, but this API"
	+ " is disabled by the system.");
	}
	try {		try {
	mService.startSystemDataTransfer(mContext.getOpPackageName(), mContext.getUserId(),		mService.startSystemDataTransfer(mContext.getOpPackageName(), mContext.getUserId(),
	associationId, new SystemDataTransferCallbackProxy(executor, result));		associationId, new SystemDataTransferCallbackProxy(executor, result));

core/java/android/companion/utils/FeatureUtils.java

+14 −2

Original line number	Original line	Diff line number	Diff line
	@@ -16,6 +16,7 @@

	package android.companion.utils;		package android.companion.utils;

			import android.os.Binder;
	import android.os.Build;		import android.os.Build;
	import android.provider.DeviceConfig;		import android.provider.DeviceConfig;

	@@ -31,8 +32,19 @@ public final class FeatureUtils {
	private static final String PROPERTY_PERM_SYNC_ENABLED = "perm_sync_enabled";		private static final String PROPERTY_PERM_SYNC_ENABLED = "perm_sync_enabled";

	public static boolean isPermSyncEnabled() {		public static boolean isPermSyncEnabled() {
	return Build.isDebuggable() \|\| DeviceConfig.getBoolean(NAMESPACE_COMPANION,		// Permissions sync is always enabled in debuggable mode.
			if (Build.isDebuggable()) {
			return true;
			}

			// Clear app identity to read the device config for feature flag.
			final long identity = Binder.clearCallingIdentity();
			try {
			return DeviceConfig.getBoolean(NAMESPACE_COMPANION,
	PROPERTY_PERM_SYNC_ENABLED, false);		PROPERTY_PERM_SYNC_ENABLED, false);
			} finally {
			Binder.restoreCallingIdentity(identity);
			}
	}		}

	private FeatureUtils() {		private FeatureUtils() {

services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java

+10 −0

Original line number	Original line	Diff line number	Diff line
	@@ -67,6 +67,7 @@ import android.companion.IOnAssociationsChangedListener;
	import android.companion.IOnMessageReceivedListener;		import android.companion.IOnMessageReceivedListener;
	import android.companion.IOnTransportsChangedListener;		import android.companion.IOnTransportsChangedListener;
	import android.companion.ISystemDataTransferCallback;		import android.companion.ISystemDataTransferCallback;
			import android.companion.utils.FeatureUtils;
	import android.content.ComponentName;		import android.content.ComponentName;
	import android.content.Context;		import android.content.Context;
	import android.content.SharedPreferences;		import android.content.SharedPreferences;
	@@ -761,6 +762,11 @@ public class CompanionDeviceManagerService extends SystemService {
	@Override		@Override
	public PendingIntent buildPermissionTransferUserConsentIntent(String packageName,		public PendingIntent buildPermissionTransferUserConsentIntent(String packageName,
	int userId, int associationId) {		int userId, int associationId) {
			if (!FeatureUtils.isPermSyncEnabled()) {
			throw new UnsupportedOperationException("Calling"
			+ " buildPermissionTransferUserConsentIntent, but this API is disabled by"
			+ " the system.");
			}
	return mSystemDataTransferProcessor.buildPermissionTransferUserConsentIntent(		return mSystemDataTransferProcessor.buildPermissionTransferUserConsentIntent(
	packageName, userId, associationId);		packageName, userId, associationId);
	}		}
	@@ -768,6 +774,10 @@ public class CompanionDeviceManagerService extends SystemService {
	@Override		@Override
	public void startSystemDataTransfer(String packageName, int userId, int associationId,		public void startSystemDataTransfer(String packageName, int userId, int associationId,
	ISystemDataTransferCallback callback) {		ISystemDataTransferCallback callback) {
			if (!FeatureUtils.isPermSyncEnabled()) {
			throw new UnsupportedOperationException("Calling startSystemDataTransfer, but this"
			+ " API is disabled by the system.");
			}
	mSystemDataTransferProcessor.startSystemDataTransfer(packageName, userId,		mSystemDataTransferProcessor.startSystemDataTransfer(packageName, userId,
	associationId, callback);		associationId, callback);
	}		}

services/companion/java/com/android/server/companion/transport/CompanionTransportManager.java

+0 −28

Original line number	Original line	Diff line number	Diff line
	@@ -20,14 +20,10 @@ import static com.android.server.companion.transport.Transport.MESSAGE_REQUEST_P

	import android.annotation.NonNull;		import android.annotation.NonNull;
	import android.annotation.SuppressLint;		import android.annotation.SuppressLint;
	import android.app.ActivityManagerInternal;
	import android.companion.AssociationInfo;		import android.companion.AssociationInfo;
	import android.companion.IOnMessageReceivedListener;		import android.companion.IOnMessageReceivedListener;
	import android.companion.IOnTransportsChangedListener;		import android.companion.IOnTransportsChangedListener;
	import android.content.Context;		import android.content.Context;
	import android.content.pm.ApplicationInfo;
	import android.content.pm.PackageManager.NameNotFoundException;
	import android.os.Binder;
	import android.os.Build;		import android.os.Build;
	import android.os.ParcelFileDescriptor;		import android.os.ParcelFileDescriptor;
	import android.os.RemoteCallbackList;		import android.os.RemoteCallbackList;
	@@ -36,7 +32,6 @@ import android.util.Slog;
	import android.util.SparseArray;		import android.util.SparseArray;

	import com.android.internal.annotations.GuardedBy;		import com.android.internal.annotations.GuardedBy;
	import com.android.server.LocalServices;
	import com.android.server.companion.AssociationStore;		import com.android.server.companion.AssociationStore;

	import java.io.FileDescriptor;		import java.io.FileDescriptor;
	@@ -147,30 +142,8 @@ public class CompanionTransportManager {
	}		}
	}		}

	/**
	* For the moment, we only offer transporting of system data to built-in
	* companion apps; future work will improve the security model to support
	* third-party companion apps.
	*/
	private void enforceCallerCanTransportSystemData(String packageName, int userId) {
	try {
	final ApplicationInfo info = mContext.getPackageManager().getApplicationInfoAsUser(
	packageName, 0, userId);
	final int instrumentationUid = LocalServices.getService(ActivityManagerInternal.class)
	.getInstrumentationSourceUid(Binder.getCallingUid());
	if (!Build.isDebuggable() && !info.isSystemApp()
	&& instrumentationUid == android.os.Process.INVALID_UID) {
	throw new SecurityException("Transporting of system data currently only available "
	+ "to built-in companion apps or tests");
	}
	} catch (NameNotFoundException e) {
	throw new IllegalArgumentException(e);
	}
	}

	public void attachSystemDataTransport(String packageName, int userId, int associationId,		public void attachSystemDataTransport(String packageName, int userId, int associationId,
	ParcelFileDescriptor fd) {		ParcelFileDescriptor fd) {
	enforceCallerCanTransportSystemData(packageName, userId);
	synchronized (mTransports) {		synchronized (mTransports) {
	if (mTransports.contains(associationId)) {		if (mTransports.contains(associationId)) {
	detachSystemDataTransport(packageName, userId, associationId);		detachSystemDataTransport(packageName, userId, associationId);
	@@ -184,7 +157,6 @@ public class CompanionTransportManager {
	}		}

	public void detachSystemDataTransport(String packageName, int userId, int associationId) {		public void detachSystemDataTransport(String packageName, int userId, int associationId) {
	enforceCallerCanTransportSystemData(packageName, userId);
	synchronized (mTransports) {		synchronized (mTransports) {
	final Transport transport = mTransports.get(associationId);		final Transport transport = mTransports.get(associationId);
	if (transport != null) {		if (transport != null) {

services/companion/java/com/android/server/companion/transport/Transport.java

+0 −7

Original line number	Original line	Diff line number	Diff line
	@@ -19,7 +19,6 @@ package com.android.server.companion.transport;
	import android.annotation.NonNull;		import android.annotation.NonNull;
	import android.companion.IOnMessageReceivedListener;		import android.companion.IOnMessageReceivedListener;
	import android.content.Context;		import android.content.Context;
	import android.content.pm.PackageManager;
	import android.os.Build;		import android.os.Build;
	import android.os.ParcelFileDescriptor;		import android.os.ParcelFileDescriptor;
	import android.os.RemoteException;		import android.os.RemoteException;
	@@ -188,12 +187,6 @@ public abstract class Transport {
	break;		break;
	}		}
	case MESSAGE_REQUEST_PERMISSION_RESTORE: {		case MESSAGE_REQUEST_PERMISSION_RESTORE: {
	if (!mContext.getPackageManager().hasSystemFeature(PackageManager.FEATURE_WATCH)
	&& !Build.isDebuggable()) {
	Slog.w(TAG, "Restoring permissions only supported on watches");
	sendMessage(MESSAGE_RESPONSE_FAILURE, sequence, EmptyArray.BYTE);
	break;
	}
	try {		try {
	callback(message, data);		callback(message, data);
	sendMessage(MESSAGE_RESPONSE_SUCCESS, sequence, EmptyArray.BYTE);		sendMessage(MESSAGE_RESPONSE_SUCCESS, sequence, EmptyArray.BYTE);