Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4d8dfca9 authored by Android Build Coastguard Worker's avatar Android Build Coastguard Worker
Browse files

Merge cherrypicks of [16961349, 17874414, 18356706, 18279994, 18670434,...

Merge cherrypicks of [16961349, 17874414, 18356706, 18279994, 18670434, 18629266, 18715266, 18701369] into security-aosp-rvc-release.

Change-Id: Icdaacc26d0bbeca8189a5adb3798eb9af5b7cc02
parents 066e147f 7bfdb190
Loading
Loading
Loading
Loading
+20 −0
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ import static com.android.internal.util.function.pooled.PooledLambda.obtainMessa
import android.accounts.Account;
import android.annotation.MainThread;
import android.annotation.NonNull;
import android.os.Binder;
import android.os.Build;
import android.os.Bundle;
import android.os.Handler;
@@ -171,8 +172,20 @@ public abstract class AbstractThreadedSyncAdapter {
    }

    private class ISyncAdapterImpl extends ISyncAdapter.Stub {
        private boolean isCallerSystem() {
            final long callingUid = Binder.getCallingUid();
            if (callingUid != Process.SYSTEM_UID) {
                android.util.EventLog.writeEvent(0x534e4554, "203229608", -1, "");
                return false;
            }
            return true;
        }

        @Override
        public void onUnsyncableAccount(ISyncAdapterUnsyncableAccountCallback cb) {
            if (!isCallerSystem()) {
                return;
            }
            Handler.getMain().sendMessage(obtainMessage(
                    AbstractThreadedSyncAdapter::handleOnUnsyncableAccount,
                    AbstractThreadedSyncAdapter.this, cb));
@@ -181,12 +194,16 @@ public abstract class AbstractThreadedSyncAdapter {
        @Override
        public void startSync(ISyncContext syncContext, String authority, Account account,
                Bundle extras) {
            if (!isCallerSystem()) {
                return;
            }
            if (ENABLE_LOG) {
                if (extras != null) {
                    extras.size(); // Unparcel so its toString() will show the contents.
                }
                Log.d(TAG, "startSync() start " + authority + " " + account + " " + extras);
            }

            try {
                final SyncContext syncContextClient = new SyncContext(syncContext);

@@ -242,6 +259,9 @@ public abstract class AbstractThreadedSyncAdapter {

        @Override
        public void cancelSync(ISyncContext syncContext) {
            if (!isCallerSystem()) {
                return;
            }
            try {
                // synchronize to make sure that mSyncThreads doesn't change between when we
                // check it and when we use it
+6 −4
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@
package com.android.internal.notification;

import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;

public final class NotificationAccessConfirmationActivityContract {
@@ -25,13 +26,14 @@ public final class NotificationAccessConfirmationActivityContract {
            "com.android.settings.notification.NotificationAccessConfirmationActivity");
    public static final String EXTRA_USER_ID = "user_id";
    public static final String EXTRA_COMPONENT_NAME = "component_name";
    public static final String EXTRA_PACKAGE_TITLE = "package_title";

    public static Intent launcherIntent(int userId, ComponentName component, String packageTitle) {
    /**
     * Creates a launcher intent for NotificationAccessConfirmationActivity.
     */
    public static Intent launcherIntent(Context context, int userId, ComponentName component) {
        return new Intent()
                .setComponent(COMPONENT_NAME)
                .putExtra(EXTRA_USER_ID, userId)
                .putExtra(EXTRA_COMPONENT_NAME, component)
                .putExtra(EXTRA_PACKAGE_TITLE, packageTitle);
                .putExtra(EXTRA_COMPONENT_NAME, component);
    }
}
+2 −11
Original line number Diff line number Diff line
@@ -43,7 +43,6 @@ import android.content.Intent;
import android.content.SharedPreferences;
import android.content.pm.FeatureInfo;
import android.content.pm.PackageInfo;
import android.content.pm.PackageItemInfo;
import android.content.pm.PackageManager;
import android.net.NetworkPolicyManager;
import android.os.Binder;
@@ -384,20 +383,12 @@ public class CompanionDeviceManagerService extends SystemService implements Bind
            String callingPackage = component.getPackageName();
            checkCanCallNotificationApi(callingPackage);
            int userId = getCallingUserId();
            String packageTitle = BidiFormatter.getInstance().unicodeWrap(
                    getPackageInfo(callingPackage, userId)
                            .applicationInfo
                            .loadSafeLabel(getContext().getPackageManager(),
                                    PackageItemInfo.DEFAULT_MAX_LABEL_SIZE_PX,
                                    PackageItemInfo.SAFE_LABEL_FLAG_TRIM
                                            | PackageItemInfo.SAFE_LABEL_FLAG_FIRST_LINE)
                            .toString());
            long identity = Binder.clearCallingIdentity();
            final long identity = Binder.clearCallingIdentity();
            try {
                return PendingIntent.getActivity(getContext(),
                        0 /* request code */,
                        NotificationAccessConfirmationActivityContract.launcherIntent(
                                userId, component, packageTitle),
                                getContext(), userId, component),
                        PendingIntent.FLAG_IMMUTABLE | PendingIntent.FLAG_ONE_SHOT
                                | PendingIntent.FLAG_CANCEL_CURRENT);
            } finally {
+28 −4
Original line number Diff line number Diff line
@@ -4983,11 +4983,18 @@ public final class ActiveServices {
            return true;
        }


        if (verifyPackage(callingPackage, callingUid)) { 
            final boolean isWhiteListedPackage = 
                    mWhiteListAllowWhileInUsePermissionInFgs.contains(callingPackage);
            if (isWhiteListedPackage) {
                return true;
            }
        } else {
            EventLog.writeEvent(0x534e4554, "215003903", callingUid,
                    "callingPackage:" + callingPackage + " does not belong to callingUid:"
                    + callingUid);
        }

        // Is the calling UID a device owner app?
        final boolean isDeviceOwner = mAm.mInternal.isDeviceOwner(callingUid);
@@ -5025,4 +5032,21 @@ public final class ActiveServices {
        r.mAllowWhileInUsePermissionInFgs = false;
        r.mLastSetFgsRestrictionTime = 0;
    }

    /**
     * Checks if a given packageName belongs to a given uid.
     * @param packageName the package of the caller
     * @param uid the uid of the caller
     * @return true or false
     */
    private boolean verifyPackage(String packageName, int uid) {
        if (uid == ROOT_UID || uid == SYSTEM_UID) {
            //System and Root are always allowed
            return true;
        }
        final int userId = UserHandle.getUserId(uid);
        final int packageUid = mAm.getPackageManagerInternalLocked()
                .getPackageUid(packageName, PackageManager.MATCH_DEBUG_TRIAGED_MISSING, userId);
        return UserHandle.isSameApp(uid, packageUid);
    }
}
+17 −2
Original line number Diff line number Diff line
@@ -37,6 +37,7 @@ import android.os.SystemClock;
import android.os.SystemProperties;
import android.provider.Settings;
import android.util.Log;
import android.webkit.URLUtil;

import com.android.internal.annotations.GuardedBy;
import com.android.internal.util.TrafficStatsConstants;
@@ -215,8 +216,22 @@ public class PacManager {
     * @throws IOException if the URL is malformed, or the PAC file is too big.
     */
    private static String get(Uri pacUri) throws IOException {
        URL url = new URL(pacUri.toString());
        URLConnection urlConnection = url.openConnection(java.net.Proxy.NO_PROXY);
        if (!URLUtil.isValidUrl(pacUri.toString()))  {
            throw new IOException("Malformed URL:" + pacUri);
        }

        final URL url = new URL(pacUri.toString());
        URLConnection urlConnection;
        try {
            urlConnection = url.openConnection(java.net.Proxy.NO_PROXY);
            // Catch the possible exceptions and rethrow as IOException to not to crash the system
            // for illegal input.
        } catch (IllegalArgumentException e) {
            throw new IOException("Incorrect proxy type for " + pacUri);
        } catch (UnsupportedOperationException e) {
            throw new IOException("Unsupported URL connection type for " + pacUri);
        }

        long contentLength = -1;
        try {
            contentLength = Long.parseLong(urlConnection.getHeaderField("Content-Length"));
Loading