Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 59db899f authored by Jeff Chang's avatar Jeff Chang
Browse files

Update taskAffinity with application uid. 

f365d3a8, Limit Activity taskAffinity to application uid for
security vulnerability issue. It modifies the taskAffinity during
ActivityRecord created, but the format of taskAffinity is also
compared in shouldUpRecreateTaskLocked. AppCompactActivity uses
this function to judge if it should recreate the task when
navigating up or not.

The CL update taskAffinity format with application uid to align
above changed.

Bug: 153390756
Fixes: 153570741

Test: atest ActivityStackTests ActivityTaskAffinityTests
Change-Id: I6a5c062d4869fbda46ae70096ee1d2be7140efe5
parent 32729dac

services/core/java/com/android/server/wm/ActivityRecord.java

+18 −6
Original line number Original line Diff line number Diff line
@@ -1609,13 +1609,9 @@ final class ActivityRecord extends WindowToken implements WindowManagerService.A 
        hasBeenLaunched = false;

        hasBeenLaunched = false;

        mStackSupervisor = supervisor;

        mStackSupervisor = supervisor;





        // b/35954083: Limit task affinity to uid to avoid various issues associated with sharing

        info.taskAffinity = getTaskAffinityWithUid(info.taskAffinity, info.applicationInfo.uid);

        // affinity across uids.

        final String uid = Integer.toString(info.applicationInfo.uid);

        if (info.taskAffinity != null && !info.taskAffinity.startsWith(uid)) {

            info.taskAffinity = uid + ":" + info.taskAffinity;

        }

        taskAffinity = info.taskAffinity;

        taskAffinity = info.taskAffinity;

        final String uid = Integer.toString(info.applicationInfo.uid);

        if (info.windowLayout != null && info.windowLayout.windowLayoutAffinity != null

        if (info.windowLayout != null && info.windowLayout.windowLayoutAffinity != null

                && !info.windowLayout.windowLayoutAffinity.startsWith(uid)) {

                && !info.windowLayout.windowLayoutAffinity.startsWith(uid)) {

            info.windowLayout.windowLayoutAffinity =

            info.windowLayout.windowLayoutAffinity =
@@ -1673,6 +1669,22 @@ final class ActivityRecord extends WindowToken implements WindowManagerService.A 
        }

        }

    }

    }





    /**

     * Generate the task affinity with uid. For b/35954083, Limit task affinity to uid to avoid

     * issues associated with sharing affinity across uids.

     *

     * @param affinity The affinity of the activity.

     * @param uid The user-ID that has been assigned to this application.

     * @return The task affinity with uid.

     */

    static String getTaskAffinityWithUid(String affinity, int uid) {

        final String uidStr = Integer.toString(uid);

        if (affinity != null && !affinity.startsWith(uidStr)) {

            affinity = uidStr + ":" + affinity;

        }

        return affinity;

    }



    static int getLockTaskLaunchMode(ActivityInfo aInfo, @Nullable ActivityOptions options) {

    static int getLockTaskLaunchMode(ActivityInfo aInfo, @Nullable ActivityOptions options) {

        int lockTaskLaunchMode = aInfo.lockTaskLaunchMode;

        int lockTaskLaunchMode = aInfo.lockTaskLaunchMode;

        if (aInfo.applicationInfo.isPrivilegedApp()

        if (aInfo.applicationInfo.isPrivilegedApp()

services/core/java/com/android/server/wm/ActivityStack.java

+3 −1
Original line number Original line Diff line number Diff line
@@ -2373,8 +2373,10 @@ class ActivityStack extends Task { 
    boolean shouldUpRecreateTaskLocked(ActivityRecord srec, String destAffinity) {

    boolean shouldUpRecreateTaskLocked(ActivityRecord srec, String destAffinity) {

        // Basic case: for simple app-centric recents, we need to recreate

        // Basic case: for simple app-centric recents, we need to recreate

        // the task if the affinity has changed.

        // the task if the affinity has changed.



        final String affinity = ActivityRecord.getTaskAffinityWithUid(destAffinity, srec.getUid());

        if (srec == null || srec.getTask().affinity == null

        if (srec == null || srec.getTask().affinity == null

                || !srec.getTask().affinity.equals(destAffinity)) {

                || !srec.getTask().affinity.equals(affinity)) {

            return true;

            return true;

        }

        }

        // Document-centric case: an app may be split in to multiple documents;

        // Document-centric case: an app may be split in to multiple documents;

services/tests/wmtests/src/com/android/server/wm/ActivityStackTests.java

+22 −0
Original line number Original line Diff line number Diff line
@@ -66,6 +66,7 @@ import android.app.ActivityManager; 
import android.app.IApplicationThread;

import android.app.IApplicationThread;

import android.content.ComponentName;

import android.content.ComponentName;

import android.content.pm.ActivityInfo;

import android.content.pm.ActivityInfo;

import android.os.Binder;

import android.os.UserHandle;

import android.os.UserHandle;

import android.platform.test.annotations.Presubmit;

import android.platform.test.annotations.Presubmit;
@@ -1290,6 +1291,27 @@ public class ActivityStackTests extends ActivityTestsBase { 
        assertEquals(starter.mRequest.callingUid, secondActivity.getUid());

        assertEquals(starter.mRequest.callingUid, secondActivity.getUid());

    }

    }





    @Test

    public void testShouldUpRecreateTaskLockedWithCorrectAffinityFormat() {

        final String affinity = "affinity";

        final ActivityRecord activity = new ActivityBuilder(mService).setAffinity(affinity)

                .setUid(Binder.getCallingUid()).setCreateTask(true).build();

        activity.getTask().affinity = activity.taskAffinity;



        assertFalse(mStack.shouldUpRecreateTaskLocked(activity, affinity));

    }



    @Test

    public void testShouldUpRecreateTaskLockedWithWrongAffinityFormat() {

        final String affinity = "affinity";

        final ActivityRecord activity = new ActivityBuilder(mService).setAffinity(affinity)

                .setUid(Binder.getCallingUid()).setCreateTask(true).build();

        activity.getTask().affinity = activity.taskAffinity;

        final String fakeAffinity = activity.getUid() + activity.taskAffinity;



        assertTrue(mStack.shouldUpRecreateTaskLocked(activity, fakeAffinity));

    }



    @Test

    @Test

    public void testResetTaskWithFinishingActivities() {

    public void testResetTaskWithFinishingActivities() {

        final ActivityRecord taskTop =

        final ActivityRecord taskTop =

services/tests/wmtests/src/com/android/server/wm/ActivityTestsBase.java

+7 −0
Original line number Original line Diff line number Diff line
@@ -108,6 +108,7 @@ class ActivityTestsBase extends SystemServiceTestsBase { 
        private String mTargetActivity;

        private String mTargetActivity;

        private Task mTask;

        private Task mTask;

        private String mProcessName = "name";

        private String mProcessName = "name";

        private String mAffinity;

        private int mUid = 12345;

        private int mUid = 12345;

        private boolean mCreateTask;

        private boolean mCreateTask;

        private ActivityStack mStack;

        private ActivityStack mStack;
@@ -222,6 +223,11 @@ class ActivityTestsBase extends SystemServiceTestsBase { 
            return this;

            return this;

        }

        }





        ActivityBuilder setAffinity(String affinity) {

            mAffinity = affinity;

            return this;

        }



        ActivityRecord build() {

        ActivityRecord build() {

            try {

            try {

                mService.deferWindowLayout();

                mService.deferWindowLayout();
@@ -270,6 +276,7 @@ class ActivityTestsBase extends SystemServiceTestsBase { 
            aInfo.maxAspectRatio = mMaxAspectRatio;

            aInfo.maxAspectRatio = mMaxAspectRatio;

            aInfo.screenOrientation = mScreenOrientation;

            aInfo.screenOrientation = mScreenOrientation;

            aInfo.configChanges |= mConfigChanges;

            aInfo.configChanges |= mConfigChanges;

            aInfo.taskAffinity = mAffinity;





            ActivityOptions options = null;

            ActivityOptions options = null;

            if (mLaunchTaskBehind) {

            if (mLaunchTaskBehind) {