Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit d2150153 authored by Kevin F. Haggerty's avatar Kevin F. Haggerty
Browse files

Merge tag 'android-security-11.0.0_r54' into staging/lineage-18.1_merge_android-security-11.0.0_r54 

Android security 11.0.0 release 54

* tag 'android-security-11.0.0_r54':
  [RESTRICT AUTOMERGE] Add hide-non-system-overlay flag for HarmfulAppWarningActivity
  BG-FGS-start while-in-use permission restriction improvement.
  Restrict AdbManager broadcasts to apps with MANAGE_DEBUGGING permission.
  Prevent apps from creating blocked channel groups

Change-Id: I8b6370cb873a42f9c41ca24f24a69a18d3b1e0fc
parents f2aeff22 c01b2689

core/java/android/debug/AdbManager.java

+3 −0
Original line number Diff line number Diff line
@@ -38,6 +38,7 @@ public class AdbManager { 
     *

     * @hide

     */

    @RequiresPermission(android.Manifest.permission.MANAGE_DEBUGGING)

    public static final String WIRELESS_DEBUG_STATE_CHANGED_ACTION =

            "com.android.server.adb.WIRELESS_DEBUG_STATUS";
@@ -46,6 +47,7 @@ public class AdbManager { 
     *

     * @hide

     */

    @RequiresPermission(android.Manifest.permission.MANAGE_DEBUGGING)

    public static final String WIRELESS_DEBUG_PAIRED_DEVICES_ACTION =

            "com.android.server.adb.WIRELESS_DEBUG_PAIRED_DEVICES";
@@ -59,6 +61,7 @@ public class AdbManager { 
     *

     * @hide

     */

    @RequiresPermission(android.Manifest.permission.MANAGE_DEBUGGING)

    public static final String WIRELESS_DEBUG_PAIRING_RESULT_ACTION =

            "com.android.server.adb.WIRELESS_DEBUG_PAIRING_RESULT";

core/java/com/android/internal/app/HarmfulAppWarningActivity.java

+4 −0
Original line number Diff line number Diff line
@@ -16,6 +16,8 @@ 


package com.android.internal.app;



import static android.view.WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS;



import android.content.Context;

import android.content.DialogInterface;

import android.content.Intent;
@@ -27,6 +29,7 @@ import android.os.Bundle; 
import android.util.Log;

import android.view.View;

import android.widget.TextView;



import com.android.internal.R;



/**
@@ -48,6 +51,7 @@ public class HarmfulAppWarningActivity extends AlertActivity implements 
    protected void onCreate(Bundle savedInstanceState) {

        super.onCreate(savedInstanceState);



        getWindow().addSystemFlags(SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS);

        final Intent intent = getIntent();

        mPackageName = intent.getStringExtra(Intent.EXTRA_PACKAGE_NAME);

        mTarget = intent.getParcelableExtra(Intent.EXTRA_INTENT);

services/core/java/com/android/server/adb/AdbDebuggingManager.java

+15 −6
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ package com.android.server.adb; 


import static com.android.internal.util.dump.DumpUtils.writeStringIfNotNull;



import android.annotation.NonNull;

import android.annotation.TestApi;

import android.app.ActivityManager;

import android.app.Notification;
@@ -171,6 +172,12 @@ public class AdbDebuggingManager { 
        mAdbConnectionInfo = new AdbConnectionInfo();

    }



    static void sendBroadcastWithDebugPermission(@NonNull Context context, @NonNull Intent intent,

            @NonNull UserHandle userHandle) {

        context.sendBroadcastAsUser(intent, userHandle,

                android.Manifest.permission.MANAGE_DEBUGGING);

    }



    class PairingThread extends Thread implements NsdManager.RegistrationListener {

        private NsdManager mNsdManager;

        private String mPublicKey;
@@ -1279,7 +1286,7 @@ public class AdbDebuggingManager { 
                    ? AdbManager.WIRELESS_STATUS_CONNECTED

                    : AdbManager.WIRELESS_STATUS_DISCONNECTED);

            intent.putExtra(AdbManager.WIRELESS_DEBUG_PORT_EXTRA, port);

            mContext.sendBroadcastAsUser(intent, UserHandle.ALL);

            AdbDebuggingManager.sendBroadcastWithDebugPermission(mContext, intent, UserHandle.ALL);

        }



        private void onAdbdWifiServerConnected(int port) {
@@ -1351,7 +1358,8 @@ public class AdbDebuggingManager { 
            if (publicKey == null) {

                Intent intent = new Intent(AdbManager.WIRELESS_DEBUG_PAIRING_RESULT_ACTION);

                intent.putExtra(AdbManager.WIRELESS_STATUS_EXTRA, AdbManager.WIRELESS_STATUS_FAIL);

                mContext.sendBroadcastAsUser(intent, UserHandle.ALL);

                AdbDebuggingManager.sendBroadcastWithDebugPermission(mContext, intent,

                        UserHandle.ALL);

            } else {

                Intent intent = new Intent(AdbManager.WIRELESS_DEBUG_PAIRING_RESULT_ACTION);

                intent.putExtra(AdbManager.WIRELESS_STATUS_EXTRA,
@@ -1364,7 +1372,8 @@ public class AdbDebuggingManager { 
                }

                PairDevice device = new PairDevice(fingerprints, hostname, false);

                intent.putExtra(AdbManager.WIRELESS_PAIR_DEVICE_EXTRA, device);

                mContext.sendBroadcastAsUser(intent, UserHandle.ALL);

                AdbDebuggingManager.sendBroadcastWithDebugPermission(mContext, intent,

                        UserHandle.ALL);

                // Add the key into the keystore

                mAdbKeyStore.setLastConnectionTime(publicKey,

                        System.currentTimeMillis());
@@ -1378,14 +1387,14 @@ public class AdbDebuggingManager { 
            intent.putExtra(AdbManager.WIRELESS_STATUS_EXTRA,

                    AdbManager.WIRELESS_STATUS_CONNECTED);

            intent.putExtra(AdbManager.WIRELESS_DEBUG_PORT_EXTRA, port);

            mContext.sendBroadcastAsUser(intent, UserHandle.ALL);

            AdbDebuggingManager.sendBroadcastWithDebugPermission(mContext, intent, UserHandle.ALL);

        }



        private void sendPairedDevicesToUI(Map<String, PairDevice> devices) {

            Intent intent = new Intent(AdbManager.WIRELESS_DEBUG_PAIRED_DEVICES_ACTION);

            // Map is not serializable, so need to downcast

            intent.putExtra(AdbManager.WIRELESS_DEVICES_EXTRA, (HashMap) devices);

            mContext.sendBroadcastAsUser(intent, UserHandle.ALL);

            AdbDebuggingManager.sendBroadcastWithDebugPermission(mContext, intent, UserHandle.ALL);

        }



        private void updateUIPairCode(String code) {
@@ -1395,7 +1404,7 @@ public class AdbDebuggingManager { 
            intent.putExtra(AdbManager.WIRELESS_PAIRING_CODE_EXTRA, code);

            intent.putExtra(AdbManager.WIRELESS_STATUS_EXTRA,

                    AdbManager.WIRELESS_STATUS_PAIRING_CODE);

            mContext.sendBroadcastAsUser(intent, UserHandle.ALL);

            AdbDebuggingManager.sendBroadcastWithDebugPermission(mContext, intent, UserHandle.ALL);

        }

    }

services/core/java/com/android/server/adb/AdbService.java

+1 −1
Original line number Diff line number Diff line
@@ -431,7 +431,7 @@ public class AdbService extends IAdbManager.Stub { 
                ? AdbManager.WIRELESS_STATUS_CONNECTED

                : AdbManager.WIRELESS_STATUS_DISCONNECTED);

        intent.putExtra(AdbManager.WIRELESS_DEBUG_PORT_EXTRA, port);

        mContext.sendBroadcastAsUser(intent, UserHandle.ALL);

        AdbDebuggingManager.sendBroadcastWithDebugPermission(mContext, intent, UserHandle.ALL);

        Slog.i(TAG, "sent port broadcast port=" + port);

    }

services/core/java/com/android/server/am/ActiveServices.java

+86 −21
Original line number Diff line number Diff line
@@ -734,11 +734,8 @@ public final class ActiveServices { 
        }

        ComponentName cmp = startServiceInnerLocked(smap, service, r, callerFg, addToStarting);



        if (!r.mAllowWhileInUsePermissionInFgs) {

            r.mAllowWhileInUsePermissionInFgs =

                    shouldAllowWhileInUsePermissionInFgsLocked(callingPackage, callingPid,

                            callingUid, service, r, allowBackgroundActivityStarts);

        }

        setFgsRestrictionLocked(callingPackage, callingPid, callingUid, r,

                allowBackgroundActivityStarts);



        return cmp;

    }
@@ -1411,14 +1408,6 @@ public final class ActiveServices { 
                        +  String.format("0x%08X", manifestType)

                        + " in service element of manifest file");

                }

                // If the foreground service is not started from TOP process, do not allow it to

                // have while-in-use location/camera/microphone access.

                if (!r.mAllowWhileInUsePermissionInFgs) {

                    Slog.w(TAG,

                            "Foreground service started from background can not have "

                                    + "location/camera/microphone access: service "

                                    + r.shortInstanceName);

                }

            }

            boolean alreadyStartedOp = false;

            boolean stopProcStatsOp = false;
@@ -1466,6 +1455,56 @@ public final class ActiveServices { 
                    ignoreForeground = true;

                }



                if (!ignoreForeground) {

                    if (r.mStartForegroundCount == 0) {

                        /*

                        If the service was started with startService(), not

                        startForegroundService(), and if startForeground() isn't called within

                        mFgsStartForegroundTimeoutMs, then we check the state of the app

                        (who owns the service, which is the app that called startForeground())

                        again. If the app is in the foreground, or in any other cases where

                        FGS-starts are allowed, then we still allow the FGS to be started.

                        Otherwise, startForeground() would fail.



                        If the service was started with startForegroundService(), then the service

                        must call startForeground() within a timeout anyway, so we don't need this

                        check.

                        */

                        if (!r.fgRequired) {

                            final long delayMs = SystemClock.elapsedRealtime() - r.createRealTime;

                            if (delayMs > mAm.mConstants.mFgsStartForegroundTimeoutMs) {

                                resetFgsRestrictionLocked(r);

                                setFgsRestrictionLocked(r.serviceInfo.packageName, r.app.pid,

                                        r.appInfo.uid, r, false);

                                EventLog.writeEvent(0x534e4554, "183147114",

                                        r.appInfo.uid,

                                        "call setFgsRestrictionLocked again due to "

                                                + "startForegroundTimeout");

                            }

                        }

                    } else if (r.mStartForegroundCount >= 1) {

                        // The second or later time startForeground() is called after service is

                        // started. Check for app state again.

                        final long delayMs = SystemClock.elapsedRealtime() -

                                r.mLastSetFgsRestrictionTime;

                        if (delayMs > mAm.mConstants.mFgsStartForegroundTimeoutMs) {

                            setFgsRestrictionLocked(r.serviceInfo.packageName, r.app.pid,

                                    r.appInfo.uid, r, false);

                            EventLog.writeEvent(0x534e4554, "183147114", r.appInfo.uid,

                                    "call setFgsRestrictionLocked for "

                                            + (r.mStartForegroundCount + 1) + "th startForeground");

                        }

                    }

                    // If the foreground service is not started from TOP process, do not allow it to

                    // have while-in-use location/camera/microphone access.

                    if (!r.mAllowWhileInUsePermissionInFgs) {

                        Slog.w(TAG,

                                "Foreground service started from background can not have "

                                        + "location/camera/microphone access: service "

                                        + r.shortInstanceName);

                    }

                }



                // Apps under strict background restrictions simply don't get to have foreground

                // services, so now that we've enforced the startForegroundService() contract

                // we only do the machinery of making the service foreground when the app
@@ -1501,6 +1540,7 @@ public final class ActiveServices { 
                            active.mNumActive++;

                        }

                        r.isForeground = true;

                        r.mStartForegroundCount++;

                        if (!stopProcStatsOp) {

                            ServiceState stracker = r.getTracker();

                            if (stracker != null) {
@@ -1559,6 +1599,7 @@ public final class ActiveServices { 
                    decActiveForegroundAppLocked(smap, r);

                }

                r.isForeground = false;

                resetFgsRestrictionLocked(r);

                ServiceState stracker = r.getTracker();

                if (stracker != null) {

                    stracker.setForeground(false, mAm.mProcessStats.getMemFactorLocked(),
@@ -2118,12 +2159,7 @@ public final class ActiveServices { 
                }

            }



            if (!s.mAllowWhileInUsePermissionInFgs) {

                s.mAllowWhileInUsePermissionInFgs =

                        shouldAllowWhileInUsePermissionInFgsLocked(callingPackage,

                                callingPid, callingUid,

                                service, s, false);

            }

            setFgsRestrictionLocked(callingPackage, callingPid, callingUid, s, false);



            if (s.app != null) {

                if ((flags&Context.BIND_TREAT_LIKE_ACTIVITY) != 0) {
@@ -3419,7 +3455,7 @@ public final class ActiveServices { 
        r.isForeground = false;

        r.foregroundId = 0;

        r.foregroundNoti = null;

        r.mAllowWhileInUsePermissionInFgs = false;

        resetFgsRestrictionLocked(r);



        // Clear start entries.

        r.clearDeliveredStartsLocked();
@@ -4900,7 +4936,7 @@ public final class ActiveServices { 
     * @return true if allow, false otherwise.

     */

    private boolean shouldAllowWhileInUsePermissionInFgsLocked(String callingPackage,

            int callingPid, int callingUid, Intent intent, ServiceRecord r,

            int callingPid, int callingUid, ServiceRecord r,

            boolean allowBackgroundActivityStarts) {

        // Is the background FGS start restriction turned on?

        if (!mAm.mConstants.mFlagBackgroundFgsStartRestrictionEnabled) {
@@ -4982,4 +5018,33 @@ public final class ActiveServices { 
        }

        return false;

    }



    boolean canAllowWhileInUsePermissionInFgsLocked(int callingPid, int callingUid,

            String callingPackage) {

        return shouldAllowWhileInUsePermissionInFgsLocked(

                callingPackage, callingPid, callingUid, null, false);

    }



    /**

     * In R, mAllowWhileInUsePermissionInFgs is to allow while-in-use permissions in foreground

     *  service or not. while-in-use permissions in FGS started from background might be restricted.

     * @param callingPackage caller app's package name.

     * @param callingUid caller app's uid.

     * @param r the service to start.

     * @return true if allow, false otherwise.

     */

    private void setFgsRestrictionLocked(String callingPackage,

            int callingPid, int callingUid, ServiceRecord r,

            boolean allowBackgroundActivityStarts) {

        r.mLastSetFgsRestrictionTime = SystemClock.elapsedRealtime();

        if (!r.mAllowWhileInUsePermissionInFgs) {

            r.mAllowWhileInUsePermissionInFgs = shouldAllowWhileInUsePermissionInFgsLocked(

                    callingPackage, callingPid, callingUid, r, allowBackgroundActivityStarts);

        }

    }



    private void resetFgsRestrictionLocked(ServiceRecord r) {

        r.mAllowWhileInUsePermissionInFgs = false;

        r.mLastSetFgsRestrictionTime = 0;

    }

}