Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 885fbe5c authored by Dianne Hackborn's avatar Dianne Hackborn
Browse files

Fix issue #16366571: UIDs for work and normal Chrome processes are the same 

Use uid as main key for determining which app tasks a caller has
access to.

Change-Id: Ibbe3f0f64197671d279c3fc519edfc720d442938
parent 491cb3f5

core/java/android/app/ActivityManager.java

+1 −1
Original line number Diff line number Diff line
@@ -985,7 +985,7 @@ public class ActivityManager { 
        ArrayList<AppTask> tasks = new ArrayList<AppTask>();

        List<IAppTask> appTasks;

        try {

            appTasks = ActivityManagerNative.getDefault().getAppTasks();

            appTasks = ActivityManagerNative.getDefault().getAppTasks(mContext.getPackageName());

        } catch (RemoteException e) {

            // System dead, we will be dead too soon!

            return null;

core/java/android/app/ActivityManagerNative.java

+4 −2
Original line number Diff line number Diff line
@@ -554,7 +554,8 @@ public abstract class ActivityManagerNative extends Binder implements IActivityM 


        case GET_APP_TASKS_TRANSACTION: {

            data.enforceInterface(IActivityManager.descriptor);

            List<IAppTask> list = getAppTasks();

            String callingPackage = data.readString();

            List<IAppTask> list = getAppTasks(callingPackage);

            reply.writeNoException();

            int N = list != null ? list.size() : -1;

            reply.writeInt(N);
@@ -2880,10 +2881,11 @@ class ActivityManagerProxy implements IActivityManager 
        reply.recycle();

        return res;

    }

    public List<IAppTask> getAppTasks() throws RemoteException {

    public List<IAppTask> getAppTasks(String callingPackage) throws RemoteException {

        Parcel data = Parcel.obtain();

        Parcel reply = Parcel.obtain();

        data.writeInterfaceToken(IActivityManager.descriptor);

        data.writeString(callingPackage);

        mRemote.transact(GET_APP_TASKS_TRANSACTION, data, reply, 0);

        reply.readException();

        ArrayList<IAppTask> list = null;

core/java/android/app/IActivityManager.java

+1 −1
Original line number Diff line number Diff line
@@ -119,7 +119,7 @@ public interface IActivityManager extends IInterface { 
    public void activityDestroyed(IBinder token) throws RemoteException;

    public String getCallingPackage(IBinder token) throws RemoteException;

    public ComponentName getCallingActivity(IBinder token) throws RemoteException;

    public List<IAppTask> getAppTasks() throws RemoteException;

    public List<IAppTask> getAppTasks(String callingPackage) throws RemoteException;

    public int addAppTask(IBinder activityToken, Intent intent,

            ActivityManager.TaskDescription description, Bitmap thumbnail) throws RemoteException;

    public Point getAppTaskThumbnailSize() throws RemoteException;

services/core/java/com/android/server/am/ActivityManagerService.java

+16 −16
Original line number Diff line number Diff line
@@ -7509,18 +7509,10 @@ public final class ActivityManagerService extends ActivityManagerNative 
    // =========================================================















    @Override













    public List<IAppTask> getAppTasks() {













        final PackageManager pm = mContext.getPackageManager();













    public List<IAppTask> getAppTasks(String callingPackage) {















        int callingUid = Binder.getCallingUid();















        long ident = Binder.clearCallingIdentity();



























        // Compose the list of packages for this id to test against













        HashSet<String> packages = new HashSet<String>();













        String[] uidPackages = pm.getPackagesForUid(callingUid);













        for (int i = 0; i < uidPackages.length; i++) {













            packages.add(uidPackages[i]);













        }



























        synchronized(this) {















            ArrayList<IAppTask> list = new ArrayList<IAppTask>();















            try {









@@ -7529,14 +7521,22 @@ public final class ActivityManagerService extends ActivityManagerNative













                final int N = mRecentTasks.size();















                for (int i = 0; i < N; i++) {















                    TaskRecord tr = mRecentTasks.get(i);













                    // Skip tasks that do not match the package name













                    if (packages.contains(tr.getBaseIntent().getComponent().getPackageName())) {













                    // Skip tasks that do not match the caller.  We don't need to verify













                    // callingPackage, because we are also limiting to callingUid and know













                    // that will limit to the correct security sandbox.













                    if (tr.effectiveUid != callingUid) {













                        continue;













                    }













                    Intent intent = tr.getBaseIntent();













                    if (intent == null ||













                            !callingPackage.equals(intent.getComponent().getPackageName())) {













                        continue;













                    }















                    ActivityManager.RecentTaskInfo taskInfo =















                            createRecentTaskInfoFromTaskRecord(tr);















                    AppTaskImpl taskImpl = new AppTaskImpl(taskInfo.persistentId, callingUid);















                    list.add(taskImpl);















                }













                }















            } finally {















                Binder.restoreCallingIdentity(ident);















            }










@@ -7699,7 +7699,7 @@ public final class ActivityManagerService extends ActivityManagerNative













                    if (!allowed) {















                        // If the caller doesn't have the GET_TASKS permission, then only















                        // allow them to see a small subset of tasks -- their own and home.













                        if (!tr.isHomeTask() && tr.creatorUid != callingUid) {













                        if (!tr.isHomeTask() && tr.effectiveUid != callingUid) {















                            if (DEBUG_RECENTS) Slog.d(TAG, "Skipping, not allowed: " + tr);















                            continue;















                        }

































services/core/java/com/android/server/am/ActivityStack.java



+1
−1




























Original line number
Diff line number
Diff line








@@ -3763,7 +3763,7 @@ final class ActivityStack {













            if (activities.isEmpty()) {















                continue;















            }













            if (!allowed && !task.isHomeTask() && task.creatorUid != callingUid) {













            if (!allowed && !task.isHomeTask() && task.effectiveUid != callingUid) {















                continue;















            }















            for (int activityNdx = activities.size() - 1; activityNdx >= 0; --activityNdx) {