Merge cherrypicks of [16624024, 16612525, 16804648, 16743363] into security-aosp-rvc-release. (c01b2689) · Commits · e / os / android_frameworks_base

core/java/android/debug/AdbManager.java

+3 −0

Original line number	Diff line number	Diff line
		@@ -38,6 +38,7 @@ public class AdbManager {
		*
		* @hide
		*/
		@RequiresPermission(android.Manifest.permission.MANAGE_DEBUGGING)
		public static final String WIRELESS_DEBUG_STATE_CHANGED_ACTION =
		"com.android.server.adb.WIRELESS_DEBUG_STATUS";

		@@ -46,6 +47,7 @@ public class AdbManager {
		*
		* @hide
		*/
		@RequiresPermission(android.Manifest.permission.MANAGE_DEBUGGING)
		public static final String WIRELESS_DEBUG_PAIRED_DEVICES_ACTION =
		"com.android.server.adb.WIRELESS_DEBUG_PAIRED_DEVICES";

		@@ -59,6 +61,7 @@ public class AdbManager {
		*
		* @hide
		*/
		@RequiresPermission(android.Manifest.permission.MANAGE_DEBUGGING)
		public static final String WIRELESS_DEBUG_PAIRING_RESULT_ACTION =
		"com.android.server.adb.WIRELESS_DEBUG_PAIRING_RESULT";

core/java/com/android/internal/app/HarmfulAppWarningActivity.java

+4 −0

Original line number	Diff line number	Diff line
		@@ -16,6 +16,8 @@

		package com.android.internal.app;

		import static android.view.WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS;

		import android.content.Context;
		import android.content.DialogInterface;
		import android.content.Intent;
		@@ -27,6 +29,7 @@ import android.os.Bundle;
		import android.util.Log;
		import android.view.View;
		import android.widget.TextView;

		import com.android.internal.R;

		/**
		@@ -48,6 +51,7 @@ public class HarmfulAppWarningActivity extends AlertActivity implements
		protected void onCreate(Bundle savedInstanceState) {
		super.onCreate(savedInstanceState);

		getWindow().addSystemFlags(SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS);
		final Intent intent = getIntent();
		mPackageName = intent.getStringExtra(Intent.EXTRA_PACKAGE_NAME);
		mTarget = intent.getParcelableExtra(Intent.EXTRA_INTENT);

services/core/java/com/android/server/adb/AdbDebuggingManager.java

+15 −6

Original line number	Diff line number	Diff line
		@@ -18,6 +18,7 @@ package com.android.server.adb;

		import static com.android.internal.util.dump.DumpUtils.writeStringIfNotNull;

		import android.annotation.NonNull;
		import android.annotation.TestApi;
		import android.app.ActivityManager;
		import android.app.Notification;
		@@ -171,6 +172,12 @@ public class AdbDebuggingManager {
		mAdbConnectionInfo = new AdbConnectionInfo();
		}

		static void sendBroadcastWithDebugPermission(@NonNull Context context, @NonNull Intent intent,
		@NonNull UserHandle userHandle) {
		context.sendBroadcastAsUser(intent, userHandle,
		android.Manifest.permission.MANAGE_DEBUGGING);
		}

		class PairingThread extends Thread implements NsdManager.RegistrationListener {
		private NsdManager mNsdManager;
		private String mPublicKey;
		@@ -1279,7 +1286,7 @@ public class AdbDebuggingManager {
		? AdbManager.WIRELESS_STATUS_CONNECTED
		: AdbManager.WIRELESS_STATUS_DISCONNECTED);
		intent.putExtra(AdbManager.WIRELESS_DEBUG_PORT_EXTRA, port);
		mContext.sendBroadcastAsUser(intent, UserHandle.ALL);
		AdbDebuggingManager.sendBroadcastWithDebugPermission(mContext, intent, UserHandle.ALL);
		}

		private void onAdbdWifiServerConnected(int port) {
		@@ -1351,7 +1358,8 @@ public class AdbDebuggingManager {
		if (publicKey == null) {
		Intent intent = new Intent(AdbManager.WIRELESS_DEBUG_PAIRING_RESULT_ACTION);
		intent.putExtra(AdbManager.WIRELESS_STATUS_EXTRA, AdbManager.WIRELESS_STATUS_FAIL);
		mContext.sendBroadcastAsUser(intent, UserHandle.ALL);
		AdbDebuggingManager.sendBroadcastWithDebugPermission(mContext, intent,
		UserHandle.ALL);
		} else {
		Intent intent = new Intent(AdbManager.WIRELESS_DEBUG_PAIRING_RESULT_ACTION);
		intent.putExtra(AdbManager.WIRELESS_STATUS_EXTRA,
		@@ -1364,7 +1372,8 @@ public class AdbDebuggingManager {
		}
		PairDevice device = new PairDevice(fingerprints, hostname, false);
		intent.putExtra(AdbManager.WIRELESS_PAIR_DEVICE_EXTRA, device);
		mContext.sendBroadcastAsUser(intent, UserHandle.ALL);
		AdbDebuggingManager.sendBroadcastWithDebugPermission(mContext, intent,
		UserHandle.ALL);
		// Add the key into the keystore
		mAdbKeyStore.setLastConnectionTime(publicKey,
		System.currentTimeMillis());
		@@ -1378,14 +1387,14 @@ public class AdbDebuggingManager {
		intent.putExtra(AdbManager.WIRELESS_STATUS_EXTRA,
		AdbManager.WIRELESS_STATUS_CONNECTED);
		intent.putExtra(AdbManager.WIRELESS_DEBUG_PORT_EXTRA, port);
		mContext.sendBroadcastAsUser(intent, UserHandle.ALL);
		AdbDebuggingManager.sendBroadcastWithDebugPermission(mContext, intent, UserHandle.ALL);
		}

		private void sendPairedDevicesToUI(Map<String, PairDevice> devices) {
		Intent intent = new Intent(AdbManager.WIRELESS_DEBUG_PAIRED_DEVICES_ACTION);
		// Map is not serializable, so need to downcast
		intent.putExtra(AdbManager.WIRELESS_DEVICES_EXTRA, (HashMap) devices);
		mContext.sendBroadcastAsUser(intent, UserHandle.ALL);
		AdbDebuggingManager.sendBroadcastWithDebugPermission(mContext, intent, UserHandle.ALL);
		}

		private void updateUIPairCode(String code) {
		@@ -1395,7 +1404,7 @@ public class AdbDebuggingManager {
		intent.putExtra(AdbManager.WIRELESS_PAIRING_CODE_EXTRA, code);
		intent.putExtra(AdbManager.WIRELESS_STATUS_EXTRA,
		AdbManager.WIRELESS_STATUS_PAIRING_CODE);
		mContext.sendBroadcastAsUser(intent, UserHandle.ALL);
		AdbDebuggingManager.sendBroadcastWithDebugPermission(mContext, intent, UserHandle.ALL);
		}
		}

services/core/java/com/android/server/adb/AdbService.java

+1 −1

Original line number	Diff line number	Diff line
		@@ -431,7 +431,7 @@ public class AdbService extends IAdbManager.Stub {
		? AdbManager.WIRELESS_STATUS_CONNECTED
		: AdbManager.WIRELESS_STATUS_DISCONNECTED);
		intent.putExtra(AdbManager.WIRELESS_DEBUG_PORT_EXTRA, port);
		mContext.sendBroadcastAsUser(intent, UserHandle.ALL);
		AdbDebuggingManager.sendBroadcastWithDebugPermission(mContext, intent, UserHandle.ALL);
		Slog.i(TAG, "sent port broadcast port=" + port);
		}

services/core/java/com/android/server/am/ActiveServices.java

+86 −21

Original line number	Diff line number	Diff line
		@@ -734,11 +734,8 @@ public final class ActiveServices {
		}
		ComponentName cmp = startServiceInnerLocked(smap, service, r, callerFg, addToStarting);

		if (!r.mAllowWhileInUsePermissionInFgs) {
		r.mAllowWhileInUsePermissionInFgs =
		shouldAllowWhileInUsePermissionInFgsLocked(callingPackage, callingPid,
		callingUid, service, r, allowBackgroundActivityStarts);
		}
		setFgsRestrictionLocked(callingPackage, callingPid, callingUid, r,
		allowBackgroundActivityStarts);

		return cmp;
		}
		@@ -1400,14 +1397,6 @@ public final class ActiveServices {
		+ String.format("0x%08X", manifestType)
		+ " in service element of manifest file");
		}
		// If the foreground service is not started from TOP process, do not allow it to
		// have while-in-use location/camera/microphone access.
		if (!r.mAllowWhileInUsePermissionInFgs) {
		Slog.w(TAG,
		"Foreground service started from background can not have "
		+ "location/camera/microphone access: service "
		+ r.shortInstanceName);
		}
		}
		boolean alreadyStartedOp = false;
		boolean stopProcStatsOp = false;
		@@ -1455,6 +1444,56 @@ public final class ActiveServices {
		ignoreForeground = true;
		}

		if (!ignoreForeground) {
		if (r.mStartForegroundCount == 0) {
		/*
		If the service was started with startService(), not
		startForegroundService(), and if startForeground() isn't called within
		mFgsStartForegroundTimeoutMs, then we check the state of the app
		(who owns the service, which is the app that called startForeground())
		again. If the app is in the foreground, or in any other cases where
		FGS-starts are allowed, then we still allow the FGS to be started.
		Otherwise, startForeground() would fail.

		If the service was started with startForegroundService(), then the service
		must call startForeground() within a timeout anyway, so we don't need this
		check.
		*/
		if (!r.fgRequired) {
		final long delayMs = SystemClock.elapsedRealtime() - r.createRealTime;
		if (delayMs > mAm.mConstants.mFgsStartForegroundTimeoutMs) {
		resetFgsRestrictionLocked(r);
		setFgsRestrictionLocked(r.serviceInfo.packageName, r.app.pid,
		r.appInfo.uid, r, false);
		EventLog.writeEvent(0x534e4554, "183147114",
		r.appInfo.uid,
		"call setFgsRestrictionLocked again due to "
		+ "startForegroundTimeout");
		}
		}
		} else if (r.mStartForegroundCount >= 1) {
		// The second or later time startForeground() is called after service is
		// started. Check for app state again.
		final long delayMs = SystemClock.elapsedRealtime() -
		r.mLastSetFgsRestrictionTime;
		if (delayMs > mAm.mConstants.mFgsStartForegroundTimeoutMs) {
		setFgsRestrictionLocked(r.serviceInfo.packageName, r.app.pid,
		r.appInfo.uid, r, false);
		EventLog.writeEvent(0x534e4554, "183147114", r.appInfo.uid,
		"call setFgsRestrictionLocked for "
		+ (r.mStartForegroundCount + 1) + "th startForeground");
		}
		}
		// If the foreground service is not started from TOP process, do not allow it to
		// have while-in-use location/camera/microphone access.
		if (!r.mAllowWhileInUsePermissionInFgs) {
		Slog.w(TAG,
		"Foreground service started from background can not have "
		+ "location/camera/microphone access: service "
		+ r.shortInstanceName);
		}
		}

		// Apps under strict background restrictions simply don't get to have foreground
		// services, so now that we've enforced the startForegroundService() contract
		// we only do the machinery of making the service foreground when the app
		@@ -1490,6 +1529,7 @@ public final class ActiveServices {
		active.mNumActive++;
		}
		r.isForeground = true;
		r.mStartForegroundCount++;
		if (!stopProcStatsOp) {
		ServiceState stracker = r.getTracker();
		if (stracker != null) {
		@@ -1548,6 +1588,7 @@ public final class ActiveServices {
		decActiveForegroundAppLocked(smap, r);
		}
		r.isForeground = false;
		resetFgsRestrictionLocked(r);
		ServiceState stracker = r.getTracker();
		if (stracker != null) {
		stracker.setForeground(false, mAm.mProcessStats.getMemFactorLocked(),
		@@ -2107,12 +2148,7 @@ public final class ActiveServices {
		}
		}

		if (!s.mAllowWhileInUsePermissionInFgs) {
		s.mAllowWhileInUsePermissionInFgs =
		shouldAllowWhileInUsePermissionInFgsLocked(callingPackage,
		callingPid, callingUid,
		service, s, false);
		}
		setFgsRestrictionLocked(callingPackage, callingPid, callingUid, s, false);

		if (s.app != null) {
		if ((flags&Context.BIND_TREAT_LIKE_ACTIVITY) != 0) {
		@@ -3408,7 +3444,7 @@ public final class ActiveServices {
		r.isForeground = false;
		r.foregroundId = 0;
		r.foregroundNoti = null;
		r.mAllowWhileInUsePermissionInFgs = false;
		resetFgsRestrictionLocked(r);

		// Clear start entries.
		r.clearDeliveredStartsLocked();
		@@ -4889,7 +4925,7 @@ public final class ActiveServices {
		* @return true if allow, false otherwise.
		*/
		private boolean shouldAllowWhileInUsePermissionInFgsLocked(String callingPackage,
		int callingPid, int callingUid, Intent intent, ServiceRecord r,
		int callingPid, int callingUid, ServiceRecord r,
		boolean allowBackgroundActivityStarts) {
		// Is the background FGS start restriction turned on?
		if (!mAm.mConstants.mFlagBackgroundFgsStartRestrictionEnabled) {
		@@ -4960,4 +4996,33 @@ public final class ActiveServices {
		}
		return false;
		}

		boolean canAllowWhileInUsePermissionInFgsLocked(int callingPid, int callingUid,
		String callingPackage) {
		return shouldAllowWhileInUsePermissionInFgsLocked(
		callingPackage, callingPid, callingUid, null, false);
		}

		/**
		* In R, mAllowWhileInUsePermissionInFgs is to allow while-in-use permissions in foreground
		* service or not. while-in-use permissions in FGS started from background might be restricted.
		* @param callingPackage caller app's package name.
		* @param callingUid caller app's uid.
		* @param r the service to start.
		* @return true if allow, false otherwise.
		*/
		private void setFgsRestrictionLocked(String callingPackage,
		int callingPid, int callingUid, ServiceRecord r,
		boolean allowBackgroundActivityStarts) {
		r.mLastSetFgsRestrictionTime = SystemClock.elapsedRealtime();
		if (!r.mAllowWhileInUsePermissionInFgs) {
		r.mAllowWhileInUsePermissionInFgs = shouldAllowWhileInUsePermissionInFgsLocked(
		callingPackage, callingPid, callingUid, r, allowBackgroundActivityStarts);
		}
		}

		private void resetFgsRestrictionLocked(ServiceRecord r) {
		r.mAllowWhileInUsePermissionInFgs = false;
		r.mLastSetFgsRestrictionTime = 0;
		}
		}