Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5a0549cd authored by Galia Peycheva's avatar Galia Peycheva Committed by Android (Google) Code Review
Browse files

Merge changes Id6161f92,Ie0d8849a into rvc-dev 

* changes:
  Introduce security checks to startDreamActivity
  Add verification for setting ACTIVITY_TYPE_DREAM
parents d7df0c13 ed401cc1

core/java/android/service/dreams/DreamManagerInternal.java

+6 −0
Original line number Diff line number Diff line
@@ -49,6 +49,12 @@ public abstract class DreamManagerInternal { 
     * Called by the ActivityTaskManagerService to verify that the startDreamActivity

     * request comes from the current active dream component.

     *

     * This function and its call path should not acquire the DreamManagerService lock

     * to avoid deadlock with the ActivityTaskManager lock.

     *

     * TODO: Make this interaction push-based - the DreamManager should inform the

     * ActivityTaskManager whenever the active dream component changes.

     *

     * @param doze If true returns the current active doze component. Otherwise, returns the

     *             active dream component.

     */

core/java/android/service/dreams/DreamService.java

+1 −0
Original line number Diff line number Diff line
@@ -1054,6 +1054,7 @@ public class DreamService extends Service implements Window.Callback { 
        // DreamServiceWrapper.onActivityCreated.

        if (!mWindowless) {

            Intent i = new Intent(this, DreamActivity.class);

            i.setPackage(getApplicationContext().getPackageName());

            i.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);

            i.putExtra(DreamActivity.EXTRA_CALLBACK, mDreamServiceWrapper);

services/core/java/com/android/server/dreams/DreamManagerService.java

+8 −2
Original line number Diff line number Diff line
@@ -51,6 +51,7 @@ import com.android.internal.util.DumpUtils; 
import com.android.server.FgThread;

import com.android.server.LocalServices;

import com.android.server.SystemService;

import com.android.server.wm.ActivityTaskManagerInternal;



import java.io.FileDescriptor;

import java.io.PrintWriter;
@@ -75,6 +76,7 @@ public final class DreamManagerService extends SystemService { 
    private final PowerManager mPowerManager;

    private final PowerManagerInternal mPowerManagerInternal;

    private final PowerManager.WakeLock mDozeWakeLock;

    private final ActivityTaskManagerInternal mAtmInternal;



    private Binder mCurrentDreamToken;

    private ComponentName mCurrentDreamName;
@@ -97,6 +99,7 @@ public final class DreamManagerService extends SystemService { 


        mPowerManager = (PowerManager)context.getSystemService(Context.POWER_SERVICE);

        mPowerManagerInternal = getLocalService(PowerManagerInternal.class);

        mAtmInternal = getLocalService(ActivityTaskManagerInternal.class);

        mDozeWakeLock = mPowerManager.newWakeLock(PowerManager.DOZE_WAKE_LOCK, TAG);

        mDozeConfig = new AmbientDisplayConfiguration(mContext);

    }
@@ -383,8 +386,10 @@ public final class DreamManagerService extends SystemService { 


        PowerManager.WakeLock wakeLock = mPowerManager

                .newWakeLock(PowerManager.PARTIAL_WAKE_LOCK, "startDream");

        mHandler.post(wakeLock.wrap(

                () -> mController.startDream(newToken, name, isTest, canDoze, userId, wakeLock)));

        mHandler.post(wakeLock.wrap(() -> {

            mAtmInternal.notifyDreamStateChanged(true);

            mController.startDream(newToken, name, isTest, canDoze, userId, wakeLock);

        }));

    }



    private void stopDreamLocked(final boolean immediate) {
@@ -422,6 +427,7 @@ public final class DreamManagerService extends SystemService { 
        }

        mCurrentDreamDozeScreenState = Display.STATE_UNKNOWN;

        mCurrentDreamDozeScreenBrightness = PowerManager.BRIGHTNESS_DEFAULT;

        mAtmInternal.notifyDreamStateChanged(false);

    }



    private void checkPermission(String permission) {

services/core/java/com/android/server/wm/ActivityRecord.java

+27 −0
Original line number Diff line number Diff line
@@ -36,6 +36,7 @@ import static android.app.AppOpsManager.MODE_ALLOWED; 
import static android.app.AppOpsManager.OP_PICTURE_IN_PICTURE;

import static android.app.WaitResult.INVALID_DELAY;

import static android.app.WindowConfiguration.ACTIVITY_TYPE_ASSISTANT;

import static android.app.WindowConfiguration.ACTIVITY_TYPE_DREAM;

import static android.app.WindowConfiguration.ACTIVITY_TYPE_HOME;

import static android.app.WindowConfiguration.ACTIVITY_TYPE_RECENTS;

import static android.app.WindowConfiguration.ACTIVITY_TYPE_UNDEFINED;
@@ -269,6 +270,8 @@ import android.os.SystemClock; 
import android.os.Trace;

import android.os.UserHandle;

import android.os.storage.StorageManager;

import android.service.dreams.DreamActivity;

import android.service.dreams.DreamManagerInternal;

import android.service.voice.IVoiceInteractionSession;

import android.util.ArraySet;

import android.util.EventLog;
@@ -2035,6 +2038,26 @@ final class ActivityRecord extends WindowToken implements WindowManagerService.A 
        return false;

    }



    static boolean canLaunchDreamActivity(String packageName) {

        final DreamManagerInternal dreamManager =

                LocalServices.getService(DreamManagerInternal.class);



        // Verify that the package is the current active dream. The getActiveDreamComponent()

        // call path does not acquire the DreamManager lock and thus is safe to use.

        final ComponentName activeDream = dreamManager.getActiveDreamComponent(false /* doze */);

        if (activeDream == null || activeDream.getPackageName() == null

                || !activeDream.getPackageName().equals(packageName)) {

            return false;

        }



        // Verify that the device is dreaming.

        if (!LocalServices.getService(ActivityTaskManagerInternal.class).isDreaming()) {

            return false;

        }



        return true;

    }



    private void setActivityType(boolean componentSpecified, int launchedFromUid, Intent intent,

            ActivityOptions options, ActivityRecord sourceRecord) {

        int activityType = ACTIVITY_TYPE_UNDEFINED;
@@ -2054,6 +2077,10 @@ final class ActivityRecord extends WindowToken implements WindowManagerService.A 
        } else if (options != null && options.getLaunchActivityType() == ACTIVITY_TYPE_ASSISTANT

                && canLaunchAssistActivity(launchedFromPackage)) {

            activityType = ACTIVITY_TYPE_ASSISTANT;

        } else if (options != null && options.getLaunchActivityType() == ACTIVITY_TYPE_DREAM

                && canLaunchDreamActivity(launchedFromPackage)

                && DreamActivity.class.getName() == info.name) {

            activityType = ACTIVITY_TYPE_DREAM;

        }

        setActivityType(activityType);

    }

services/core/java/com/android/server/wm/ActivityStarter.java

+2 −14
Original line number Diff line number Diff line
@@ -341,7 +341,6 @@ class ActivityStarter { 
        int filterCallingUid;

        PendingIntentRecord originatingPendingIntent;

        boolean allowBackgroundActivityStart;

        boolean isDream;



        /**

         * If set to {@code true}, allows this activity start to look into
@@ -393,7 +392,6 @@ class ActivityStarter { 
            filterCallingUid = UserHandle.USER_NULL;

            originatingPendingIntent = null;

            allowBackgroundActivityStart = false;

            isDream = false;

        }



        /**
@@ -434,7 +432,6 @@ class ActivityStarter { 
            filterCallingUid = request.filterCallingUid;

            originatingPendingIntent = request.originatingPendingIntent;

            allowBackgroundActivityStart = request.allowBackgroundActivityStart;

            isDream = request.isDream;

        }



        /**
@@ -985,7 +982,7 @@ class ActivityStarter { 
                restrictedBgActivity = shouldAbortBackgroundActivityStart(callingUid,

                        callingPid, callingPackage, realCallingUid, realCallingPid, callerApp,

                        request.originatingPendingIntent, request.allowBackgroundActivityStart,

                        request.isDream, intent);

                        intent);

            } finally {

                Trace.traceEnd(Trace.TRACE_TAG_WINDOW_MANAGER);

            }
@@ -1195,7 +1192,7 @@ class ActivityStarter { 
    boolean shouldAbortBackgroundActivityStart(int callingUid, int callingPid,

            final String callingPackage, int realCallingUid, int realCallingPid,

            WindowProcessController callerApp, PendingIntentRecord originatingPendingIntent,

            boolean allowBackgroundActivityStart, boolean isDream, Intent intent) {

            boolean allowBackgroundActivityStart, Intent intent) {

        // don't abort for the most important UIDs

        final int callingAppId = UserHandle.getAppId(callingUid);

        if (callingUid == Process.ROOT_UID || callingAppId == Process.SYSTEM_UID
@@ -1203,10 +1200,6 @@ class ActivityStarter { 
            return false;

        }



        // don't abort if this is the dream activity

        if (isDream) {

            return false;

        }

        // don't abort if the callingUid has a visible window or is a persistent system process

        final int callingUidProcState = mService.getUidState(callingUid);

        final boolean callingUidHasAnyVisibleWindow =
@@ -2717,11 +2710,6 @@ class ActivityStarter { 
        return this;

    }



    ActivityStarter setIsDream(boolean isDream) {

        mRequest.isDream = isDream;

        return this;

    }



    void dump(PrintWriter pw, String prefix) {

        prefix = prefix + "  ";

        pw.print(prefix);