Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 9e7021ec authored by Kevin F. Haggerty's avatar Kevin F. Haggerty
Browse files

Merge tag 'android-security-9.0.0_r65' of... 

Merge tag 'android-security-9.0.0_r65' of https://android.googlesource.com/platform/frameworks/base into staging/lineage-16.0_merge_android-security-9.0.0_r65

Android security 9.0.0 release 65

* tag 'android-security-9.0.0_r65' of https://android.googlesource.com/platform/frameworks/base:
  RESTRICT AUTOMERGE Ensure caller identity is restored in CP quick-path.
  Remove updateIntentVerificationStatusAsUser from ResolverActivity
  Revoke the uri permission when the file is deleted
  [RESTRICT AUTOMERGE] Add import of MAX_APP_TRANSITION_DURATION
  [RESTRICT AUTOMERGE] Restrict app transition maximum duration

Change-Id: Ieecd268f45205f6c1e91e8eca03b53a84044676d
parents 75ed0a20 11314107

core/java/com/android/internal/app/ResolverActivity.java

+0 −19
Original line number Diff line number Diff line
@@ -780,25 +780,6 @@ public class ResolverActivity extends Activity { 
                        if (TextUtils.isEmpty(packageName)) {

                            pm.setDefaultBrowserPackageNameAsUser(ri.activityInfo.packageName, userId);

                        }

                    } else {

                        // Update Domain Verification status

                        ComponentName cn = intent.getComponent();

                        String packageName = cn.getPackageName();

                        String dataScheme = (data != null) ? data.getScheme() : null;



                        boolean isHttpOrHttps = (dataScheme != null) &&

                                (dataScheme.equals(IntentFilter.SCHEME_HTTP) ||

                                        dataScheme.equals(IntentFilter.SCHEME_HTTPS));



                        boolean isViewAction = (action != null) && action.equals(Intent.ACTION_VIEW);

                        boolean hasCategoryBrowsable = (categories != null) &&

                                categories.contains(Intent.CATEGORY_BROWSABLE);



                        if (isHttpOrHttps && isViewAction && hasCategoryBrowsable) {

                            pm.updateIntentVerificationStatusAsUser(packageName,

                                    PackageManager.INTENT_FILTER_DOMAIN_VERIFICATION_STATUS_ALWAYS,

                                    userId);

                        }

                    }

                } else {

                    try {

core/java/com/android/internal/content/FileSystemProvider.java

+11 −0
Original line number Diff line number Diff line
@@ -93,6 +93,14 @@ public abstract class FileSystemProvider extends DocumentsProvider { 
        // Default is no-op

    }



    /**

     * Callback indicating that the given document has been deleted or moved. This gives

     * the provider a hook to revoke the uri permissions.

     */

    protected void onDocIdDeleted(String docId) {

        // Default is no-op

    }



    @Override

    public boolean onCreate() {

        throw new UnsupportedOperationException(
@@ -244,6 +252,7 @@ public abstract class FileSystemProvider extends DocumentsProvider { 


        final String afterDocId = getDocIdForFile(after);

        onDocIdChanged(docId);

        onDocIdDeleted(docId);

        onDocIdChanged(afterDocId);



        final File afterVisibleFile = getFileForDocId(afterDocId, true);
@@ -274,6 +283,7 @@ public abstract class FileSystemProvider extends DocumentsProvider { 


        final String docId = getDocIdForFile(after);

        onDocIdChanged(sourceDocumentId);

        onDocIdDeleted(sourceDocumentId);

        onDocIdChanged(docId);

        moveInMediaStore(visibleFileBefore, getFileForDocId(docId, true));
@@ -325,6 +335,7 @@ public abstract class FileSystemProvider extends DocumentsProvider { 
        }



        onDocIdChanged(docId);

        onDocIdDeleted(docId);

        removeFromMediaStore(visibleFile, isDirectory);

    }

packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java

+6 −0
Original line number Diff line number Diff line
@@ -430,6 +430,12 @@ public class ExternalStorageProvider extends FileSystemProvider { 
        }

    }



    @Override

    protected void onDocIdDeleted(String docId) {

        Uri uri = DocumentsContract.buildDocumentUri(AUTHORITY, docId);

        getContext().revokeUriPermission(uri, ~0);

    }



    @Override

    public Cursor queryRoots(String[] projection) throws FileNotFoundException {

        final MatrixCursor result = new MatrixCursor(resolveRootProjection(projection));

services/core/java/com/android/server/am/ActivityManagerService.java

+57 −56
Original line number Diff line number Diff line
@@ -12393,11 +12393,10 @@ public class ActivityManagerService extends IActivityManager.Stub 
                }















                final long origId = Binder.clearCallingIdentity();

























                try {















                    checkTime(startTime, "getContentProviderImpl: incProviderCountLocked");



























                // In this case the provider instance already exists, so we can













                // return it right away.













                    // Return the provider instance right away since it already exists.















                    conn = incProviderCountLocked(r, cpr, token, stable);















                    if (conn != null && (conn.stableCount+conn.unstableCount) == 1) {















                        if (cpr.proc != null && r.setAdj <= ProcessList.PERCEPTIBLE_APP_ADJ) {









@@ -12419,7 +12418,8 @@ public class ActivityManagerService extends IActivityManager.Stub













                    // it, we will check whether the process still exists.  Note that this doesn't















                    // completely get rid of races with LMK killing the process, but should make















                    // them much smaller.













                if (success && verifiedAdj != cpr.proc.setAdj && !isProcessAliveLocked(cpr.proc)) {













                    if (success && verifiedAdj != cpr.proc.setAdj













                            && !isProcessAliveLocked(cpr.proc)) {















                        success = false;















                    }















                    maybeUpdateProviderUsageStatsLocked(r, cpr.info.packageName, name);










@@ -12450,9 +12450,10 @@ public class ActivityManagerService extends IActivityManager.Stub













                    } else {















                        cpr.proc.verifiedAdj = cpr.proc.setAdj;















                    }

























                } finally {















                    Binder.restoreCallingIdentity(origId);















                }













            }





























            if (!providerRunning) {















                try {

























services/core/java/com/android/server/wm/AppTransition.java



+1
−0




























Original line number
Diff line number
Diff line








@@ -161,6 +161,7 @@ public class AppTransition implements Dump {













    private static final int MAX_CLIP_REVEAL_TRANSITION_DURATION = 420;















    private static final int THUMBNAIL_APP_TRANSITION_DURATION = 336;















    private static final long APP_TRANSITION_TIMEOUT_MS = 5000;













    static final int MAX_APP_TRANSITION_DURATION = 3 * 1000; // 3 secs.































    private final Context mContext;















    private final WindowManagerService mService;