[RELEASE] Sprint Lockdown

See merge request !65

Oreo new user icons

See merge request !62

Change-Id: I560753b0bade38785987e43abdaf7b2cb35ccb74

Merge tag 'android-8.1.0_r76' of https://android.googlesource.com/platform/frameworks/base into staging/lineage-15.1_merge-android-8.1.0_r76

Android 8.1.0 release 76

* tag 'android-8.1.0_r76' of https://android.googlesource.com/platform/frameworks/base:
  Verify all possible hosts that match web nav
  RESTRICT AUTOMERGE Prevent accessing companion records from arbitrary uids
  Revert "DO NOT MERGE - Kill apps outright for API contract violations"
  RESTRICT AUTOMERGE Create separated tasks for different apps from startActivities
  RESTRICT AUTOMERGE Use consistent calling uid and package in navigateUpTo
  DO NOT MERGE - Kill apps outright for API contract violations

Change-Id: Ifd6c66f2bfe7847ab073ea3eca1ba4c4947e3d58

Even if an <intent-filter> matches non-web schemes in addition to http
or https, make sure to include its cited hosts in the autoVerify
evaluation.

Bug: 150038428
Test: atest OsHostTests#testIntentFilterHostValidation
Change-Id: If9ef0fc53d96e6581c56d86f89fe63bc9a5fb89a
Merged-In: If9ef0fc53d96e6581c56d86f89fe63bc9a5fb89a
(cherry picked from commit 1fba0f897f276d5d47962534867e764da8061105)
(cherry picked from commit a481c86cd3742c7792f8607c004e0eeb4016b894)

Prevent accessing companion records from arbitrary uids

Test: manual
Fixes: 129476618
Change-Id: I7b18cfcdf58e62a445cbb508116c6ce7c1cea8d7
(cherry picked from commit 98f45443e1cf397ab92b4cecd9200c2dcccf099b)

This reverts commit c6fd63a7.

Grant Storage and Contacts permission to eDrive

See merge request !57

grant esmssync permission

See merge request !55

This reverts commit c2411e48.

This reverts commit 06a1f933.

Merge tag 'android-8.1.0_r75' of https://android.googlesource.com/platform/frameworks/base into staging/lineage-15.1_merge-android-8.1.0_r75

Android 8.1.0 Release 75 (6197208)

* tag 'android-8.1.0_r75' of https://android.googlesource.com/platform/frameworks/base:
  Fix potential double destroy of AssetManager
  Revoke 'always' web handler status when not autoverifying
  Add STATUS_BAR permission to dialer in oc-rm1

Change-Id: I7173663a4ebaaa71ac5e5fccfff7acdbcabd4eda

[RELEASE] Sprint Istanbul

See merge request !48

[RELEASE] Sprint Istanbul grant esms permissions for v1-oreo

See merge request !53

Assume there are 2 applications A, B with different uids.
There are 4 activities A1, A2, B1, B2 with default task
affinity and launch mode.

After A1 called startActivities(B1, A2, B2):
 Original   : Task(A1, B1, A2, B2)
 This Change: Task(A1, B1), Task(A2, B2)
In other words, the source caller cannot launch its activity
above the activity of other application in the same task, and
it can still launch activity of other application in its task.

Bug: 145669109
Test: run cts --test android.server.cts.StartActivityTests \
      -m CtsServicesHostTestCases
Change-Id: I97bd875146a52f62b8fe82235487ccefb2955e8e
(cherry picked from commit 973ecc619c0bb87a03481774ea9e86d2924601e4)

Originally, if the caller of navigateUpTo is alive, even the calling
uid is set to the caller who launched the existing destination activity,
the uid from caller process has higher priority to replace the given
calling uid. So this change doesn't modify the existing behavior if
the caller process is valid. Besides, the case of delivering new intent
uses the source record as calling identity too, so the case of starting
new activity should be consistent.

Also forbid attaching null application thread to avoid unexpected state
in process record.

Bug: 144285917
Test: bit FrameworksServicesTests:com.android.server.am.ActivityStackTests
Change-Id: I60732f430256d37cb926d08d093581f051c4afed
(cherry picked from commit 0d7e27af30e39fbb6dcafedc854daa639074e5cc)

...rather than relying on in-app code to perform the shutdown.

Backport of security fix.

Bug: 128649910
Bug: 140108616
Test: manual
Test: atest OsHostTests#testForegroundServiceBadNotification
Change-Id: I94d9de50bb03c33666471e3dbd9c721e9278f7cb
Merged-In: I94d9de50bb03c33666471e3dbd9c721e9278f7cb
(cherry picked from commit 874c974f73839da761177a4e0a53b7f4a7d29288)

Android 8.1.0 release 74

* tag 'android-8.1.0_r74':
  Fixes NPE when preparing app data during init
  Use KNOWN_PACKAGES when shared lib consumers
  Handles null outInfo in deleteSystemPackageLI
  Fix security problem on PermissionMonitor#hasPermission

Change-Id: I578a27915317b36ecb04ac87751200125f96d294

Based on https://github.com/lineageos4microg/docker-lineage-cicd/blob/master/src/signature_spoofing_patches/android_frameworks_base-O.patch

[RELEASE] Sprint Freetown (oreo)

See merge request !42

Assume there is a XmlBlock [X] created by a AssetManager [A]
([A] will have mNumRefs = 2). After [A].close is called
(mNumRefs = 1) and then both [X] and [A] are going to be GCed,
if [A].finalize is called first (nativeDestroy), the later
[X].finalize will invoke [A].xmlBlockGone that triggers the
second nativeDestroy of [A] and leads to crash.

By clearing the mObject in AssetManager.finalize, the
decRefsLocked from other paths won't call nativeDestroy again.

Bug: 144028297
Test: atest android.security.cts.AssetManagerTest

Change-Id: Ia938502d2443f5a6de6a3cabdb7ce1d41d3ff6d1
Merged-In: Ia938502d2443f5a6de6a3cabdb7ce1d41d3ff6d1
(cherry picked from commit 93320661ca9a23c7b38b3f166d0facf048f2a8a3)

If an app has previously used autoVerify to make claims about its status
re handling web navigation intents, but is updated such that it no
longer makes those claims, step down its "official handler" status as
though it had never invoked autoVerify in the first place.

Bug: 146204120
Test: manual: as described in bug; observe policy before/after via
      'adb shell dumpsys package d'
Test: atest CtsOsHostTestCases
Change-Id: I58502d1b32d793aba9aa772fa2ad5ac38acca48a
Merged-In: I58502d1b32d793aba9aa772fa2ad5ac38acca48a
(cherry picked from commit ef5220e5b2a4b90d4260eb058475fdcdf30d861d)

Android 8.1.0 Release 73 (6107733)

* tag 'android-8.1.0_r73':
  RESTRICT AUTOMERGE Make toasts non-clickable
  DO NOT MERGE back porting for fixing sysui direct reply
  DO NOT MERGE: Disable SpellChecker in secondary user's direct reply

Change-Id: Ifd3d2376f08e26e5a23e6c77d1069a873e02ffed

NTP End point (oreo)

See merge request !39

Similar to pie-dev

Change-Id: Iaab5f82ba008603ba5996ec012d38352e86c2f1b
Merged-In: If88aa90f4dcab51b6e11562cadbe003948b6c149
Fixes: 147301827

When deleting an unused static shared library on Q, the user manager was
fetched via mContext.getSystemService. At this time during boot, the
service wasn't registered and so null was returned. This has already
been addressed in R with a move to injecting dependencies in the
PackageManagerService constructor.

Bug: 142083996
Bug: 141413692
Test: manual; remove static dependency on eng Q build and reboot
Change-Id: I8ae4e331d09b4734c54cdc6887b273705dce88b1
Merged-In: I8ae4e331d09b4734c54cdc6887b273705dce88b1
(cherry picked from commit 5d3fc339)

This change ensures we find ALL known packages that could be consuming a
shared library, not only currently installed ones. Without this check,
the system may get into a state in which we have currently uninstalled
but on-device apps that depend on a shared library that does not exist
on device.

This change also leaves static shared library packages on device even if
it's not installed for any of the remaining users as it could still be
used, but marked uninstalled for users in which it is consumed.

Bug: 141413692
Bug: 142083996
Test: Manual; attempt to remove shared lib after marking its consumer uninstalled.
Test: atest StaticSharedLibsHostTests
Change-Id: Id4e37c3e4d3ea3ad5fddae5d2c7305e56f50eeea
Merged-In: Id4e37c3e4d3ea3ad5fddae5d2c7305e56f50eeea
(cherry picked from commit 08315953)