Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c06ace7a authored by Patrick Baumann's avatar Patrick Baumann
Browse files

Add visibility special casing for sdk sandbox 

This change adds special visibility enforcement to the apps filter for
SDK sandbox uids. If we encounter an SDK sandbox UID, we'll bypass
traditional visibility checks and instead just enforce that the target
is forceQueryable. All else besides the client app will be blocked.

Test: atest AppsFilterImplTest
Bug: 234129698
Change-Id: Ic42d46232841294a0fd148e5f29d1ff5ec4261c8
parent d7df1b28

services/core/java/com/android/server/pm/AppsFilterBase.java

+3 −0
Original line number Diff line number Diff line
@@ -321,6 +321,9 @@ public abstract class AppsFilterBase implements AppsFilterSnapshot { 
                    || targetPkgSetting.getAppId() < Process.FIRST_APPLICATION_UID

                    || callingAppId == targetPkgSetting.getAppId()) {

                return false;

            } else if (Process.isSdkSandboxUid(callingAppId)) {

                // we only allow sdk sandbox processes access to forcequeryable packages

                return !isForceQueryable(targetPkgSetting.getAppId());

            }

            if (mCacheReady) { // use cache

                if (!shouldFilterApplicationUsingCache(callingUid,

services/tests/servicestests/src/com/android/server/pm/AppsFilterImplTest.java

+40 −0
Original line number Diff line number Diff line
@@ -1336,6 +1336,46 @@ public class AppsFilterImplTest { 


    }



    @Test

    public void testSdkSandbox_canSeeForceQueryable() throws Exception {

        final AppsFilterImpl appsFilter =

                new AppsFilterImpl(mFeatureConfigMock, new String[]{}, false, null,

                        mMockHandler);

        simulateAddBasicAndroid(appsFilter);

        appsFilter.onSystemReady(mPmInternal);



        PackageSetting target = simulateAddPackage(appsFilter,

                pkg("com.some.package").setForceQueryable(true), DUMMY_TARGET_APPID,

                setting -> setting.setPkgFlags(ApplicationInfo.FLAG_SYSTEM));



        int callingUid = 20123;

        assertTrue(Process.isSdkSandboxUid(callingUid));



        assertFalse(

                appsFilter.shouldFilterApplication(mSnapshot, callingUid,

                        null /* callingSetting */, target, SYSTEM_USER));

    }



    @Test

    public void testSdkSandbox_cannotSeeNonForceQueryable() throws Exception {

        final AppsFilterImpl appsFilter =

                new AppsFilterImpl(mFeatureConfigMock, new String[]{}, false, null,

                        mMockHandler);

        simulateAddBasicAndroid(appsFilter);

        appsFilter.onSystemReady(mPmInternal);



        PackageSetting target = simulateAddPackage(appsFilter,

                pkg("com.some.package"), DUMMY_TARGET_APPID,

                setting -> setting.setPkgFlags(ApplicationInfo.FLAG_SYSTEM));



        int callingUid = 20123;

        assertTrue(Process.isSdkSandboxUid(callingUid));



        assertTrue(

                appsFilter.shouldFilterApplication(mSnapshot, callingUid,

                        null /* callingSetting */, target, SYSTEM_USER));

    }



    private List<Integer> toList(int[] array) {

        ArrayList<Integer> ret = new ArrayList<>(array.length);

        for (int i = 0; i < array.length; i++) {