Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit c56b8301 authored by Kevin F. Haggerty's avatar Kevin F. Haggerty
Browse files

Merge tag 'android-security-11.0.0_r53' into staging/lineage-18.1_merge-android-security-11.0.0_r53 

Android security 11.0.0 release 53

* tag 'android-security-11.0.0_r53':
  Add ALLOW_SLIPPERY_TOUCHES permission
  Handle onNullBinding
  Only allow trusted overlays to specify FLAG_SLIPPERY
  Check group channels for FGSes
  [RESTRICT AUTOMERGE] Fix the inconsistency of protection level
  Don't abandon child sessions (1/n)

Conflicts:
	packages/SystemUI/AndroidManifest.xml

Change-Id: I26dee5bb2d2973ae350e6a2960424a322e9cfeed
parents 3aa91ba5 4bfdbbb4

core/res/AndroidManifest.xml

+4 −0
Original line number Diff line number Diff line
@@ -5025,6 +5025,10 @@ 
    <!-- Allows input events to be monitored. Very dangerous!  @hide -->

    <permission android:name="android.permission.MONITOR_INPUT"

                android:protectionLevel="signature" />

    <!-- Allows the use of FLAG_SLIPPERY, which permits touch events to slip from the current

         window to the window where the touch currently is on top of.  @hide -->

    <permission android:name="android.permission.ALLOW_SLIPPERY_TOUCHES"

                android:protectionLevel="signature" />

    <!--  Allows the caller to change the associations between input devices and displays.

        Very dangerous! @hide -->

    <permission android:name="android.permission.ASSOCIATE_INPUT_DEVICE_TO_DISPLAY_BY_PORT"

packages/SystemUI/AndroidManifest.xml

+1 −0
Original line number Diff line number Diff line
@@ -114,6 +114,7 @@ 
    <uses-permission android:name="android.permission.DISABLE_KEYGUARD" />

    <uses-permission android:name="android.permission.MONITOR_INPUT" />

    <uses-permission android:name="android.permission.INPUT_CONSUMER" />

    <uses-permission android:name="android.permission.ALLOW_SLIPPERY_TOUCHES" />



    <!-- DreamManager -->

    <uses-permission android:name="android.permission.READ_DREAM_STATE" />

packages/SystemUI/src/com/android/systemui/controls/controller/ControlsProviderLifecycleManager.kt

+6 −0
Original line number Diff line number Diff line
@@ -131,6 +131,12 @@ class ControlsProviderLifecycleManager( 
            wrapper = null

            bindService(false)

        }



        override fun onNullBinding(name: ComponentName?) {

            if (DEBUG) Log.d(TAG, "onNullBinding $name")

            wrapper = null

            context.unbindService(this)

        }

    }



    private fun handlePendingServiceMethods() {

packages/SystemUI/tests/src/com/android/systemui/controls/controller/ControlsProviderLifecycleManagerTest.kt

+41 −9
Original line number Diff line number Diff line
@@ -17,6 +17,9 @@ 
package com.android.systemui.controls.controller



import android.content.ComponentName

import android.content.Context

import android.content.Intent

import android.content.ServiceConnection

import android.os.UserHandle

import android.service.controls.IControlsActionCallback

import android.service.controls.IControlsProvider
@@ -43,6 +46,8 @@ import org.mockito.ArgumentMatchers.eq 
import org.mockito.Captor

import org.mockito.Mock

import org.mockito.Mockito.`when`

import org.mockito.Mockito.anyInt

import org.mockito.Mockito.mock

import org.mockito.Mockito.never

import org.mockito.Mockito.verify

import org.mockito.MockitoAnnotations
@@ -57,8 +62,6 @@ class ControlsProviderLifecycleManagerTest : SysuiTestCase() { 
    private lateinit var subscriberService: IControlsSubscriber.Stub

    @Mock

    private lateinit var service: IControlsProvider.Stub

    @Mock

    private lateinit var loadCallback: ControlsBindingController.LoadCallback



    @Captor

    private lateinit var wrapperCaptor: ArgumentCaptor<ControlActionWrapper>
@@ -75,7 +78,7 @@ class ControlsProviderLifecycleManagerTest : SysuiTestCase() { 
    fun setUp() {

        MockitoAnnotations.initMocks(this)



        mContext.addMockService(componentName, service)

        context.addMockService(componentName, service)

        executor = FakeExecutor(FakeSystemClock())

        `when`(service.asBinder()).thenCallRealMethod()

        `when`(service.queryLocalInterface(ArgumentMatchers.anyString())).thenReturn(service)
@@ -98,7 +101,36 @@ class ControlsProviderLifecycleManagerTest : SysuiTestCase() { 
    fun testBindService() {

        manager.bindService()

        executor.runAllReady()

        assertTrue(mContext.isBound(componentName))

        assertTrue(context.isBound(componentName))

    }



    @Test

    fun testNullBinding() {

        val mockContext = mock(Context::class.java)

        lateinit var serviceConnection: ServiceConnection

        `when`(mockContext.bindServiceAsUser(any(), any(), anyInt(), any())).thenAnswer {

            val component = (it.arguments[0] as Intent).component

            if (component == componentName) {

                serviceConnection = it.arguments[1] as ServiceConnection

                serviceConnection.onNullBinding(component)

                true

            } else {

                false

            }

        }



        val nullManager = ControlsProviderLifecycleManager(

                mockContext,

                executor,

                actionCallbackService,

                UserHandle.of(0),

                componentName

        )



        nullManager.bindService()

        executor.runAllReady()



        verify(mockContext).unbindService(serviceConnection)

    }



    @Test
@@ -109,7 +141,7 @@ class ControlsProviderLifecycleManagerTest : SysuiTestCase() { 
        manager.unbindService()

        executor.runAllReady()



        assertFalse(mContext.isBound(componentName))

        assertFalse(context.isBound(componentName))

    }



    @Test
@@ -119,7 +151,7 @@ class ControlsProviderLifecycleManagerTest : SysuiTestCase() { 


        verify(service).load(subscriberService)



        assertTrue(mContext.isBound(componentName))

        assertTrue(context.isBound(componentName))

    }



    @Test
@@ -129,7 +161,7 @@ class ControlsProviderLifecycleManagerTest : SysuiTestCase() { 


        manager.unbindService()

        executor.runAllReady()

        assertFalse(mContext.isBound(componentName))

        assertFalse(context.isBound(componentName))

    }



    @Test
@@ -162,7 +194,7 @@ class ControlsProviderLifecycleManagerTest : SysuiTestCase() { 
        manager.maybeBindAndSubscribe(list, subscriberService)

        executor.runAllReady()



        assertTrue(mContext.isBound(componentName))

        assertTrue(context.isBound(componentName))

        verify(service).subscribe(list, subscriberService)

    }
@@ -173,7 +205,7 @@ class ControlsProviderLifecycleManagerTest : SysuiTestCase() { 
        manager.maybeBindAndSendAction(controlId, action)

        executor.runAllReady()



        assertTrue(mContext.isBound(componentName))

        assertTrue(context.isBound(componentName))

        verify(service).action(eq(controlId), capture(wrapperCaptor),

                eq(actionCallbackService))

        assertEquals(action, wrapperCaptor.getValue().getWrappedAction())

services/core/java/com/android/server/notification/NotificationManagerService.java

+3 −2
Original line number Diff line number Diff line
@@ -2504,7 +2504,7 @@ public class NotificationManagerService extends SystemService { 
        }

    }



    private void createNotificationChannelGroup(String pkg, int uid, NotificationChannelGroup group,

    void createNotificationChannelGroup(String pkg, int uid, NotificationChannelGroup group,

            boolean fromApp, boolean fromListener) {

        Objects.requireNonNull(group);

        Objects.requireNonNull(pkg);
@@ -3537,7 +3537,8 @@ public class NotificationManagerService extends SystemService { 


            final int callingUid = Binder.getCallingUid();

            NotificationChannelGroup groupToDelete =

                    mPreferencesHelper.getNotificationChannelGroup(groupId, pkg, callingUid);

                    mPreferencesHelper.getNotificationChannelGroupWithChannels(

                            pkg, callingUid, groupId, false);

            if (groupToDelete != null) {

                // Preflight for allowability

                final int userId = UserHandle.getUserId(callingUid);