- Add the APIs required to register an authorization agent in order
  to allow/reject outgoing SMS messages and the core service that
  implements the sms security model.

Change-Id: Ic7c35aef6acb50fde1fc52d20cea6547bc546aab

This runtime permission should have been exposed to Instant Apps but
incorrectly was not

Bug: 67578813
Test: cts-tradefed run cts -m CtsPermission2TestCases
Change-Id: Icad01cc8e99f52c6e638f54aaf78e9cc56475fc4

Fix reliability triggering in the time zone update
feature. The reliability triggering is there to
resume an update check when things go wrong. For
example, if the device is turned off after a
time zone data app is updated but before the time
zone update process has finished pulling the data
out and installing it in /data. The reliability
trigger happens when the device is idle and will
complete the work.

The idle triggering currently doesn't work as it
was implemented incorrectly.

The code has been changed to use the
JobScheduler to trigger on idle and scheduling
has been made explicit.

Unit tests run with:

make -j30 FrameworksServicesTests
adb install -r -g \
  "out/target/product/marlin/data/app/FrameworksServicesTests/FrameworksServicesTests.apk"
adb shell am instrument -e package com.android.server.timezone -w \
  com.android.frameworks.servicestests \
  "com.android.frameworks.servicestests/android.support.test.runner.AndroidJUnitRunner"

Test: See above
Test: Manual testing: adb shell am idle-maintenance, adb logcat/adb shell dumpsys timezone
Test: PTS: run pts -m PtsTimeZoneTestCases
Bug: 65657543
Change-Id: Ibb2c537955d09a5d538c50490dae94a518522f19
Merged-In: Ibb2c537955d09a5d538c50490dae94a518522f19
(cherry picked from commit cd1a109b)

Bug: 65257065
Bug: 37357441

Test: build with ONA, check that broadcasts do not log WTF errors.
Change-Id: I623da59f5cc7ca3feff6cc156664c05fbeb34107

Replacing app opps fix with the flag that is used
elsewhere.

Bug: 37442941
Test: Verified that toast and system overlay still goes
away on permission and a11y service capability screens.

Merged-In: I1a3e3c5b1696a5f5b95eac187acb5a03863b4a0b

Change-Id: If9bec515105369055415d54c7fcad7a65431f8e7

Extend the ability to use VrStateListeners to applications that
have RESTRICTED_VR_ACCESS permission.  Previously, it required
ACCESS_VR_MANAGER only.

Add VrStateCallback object and methods to VrManager to access the
functionality outside of frameworks.

Bug: 64360244
Test: Manual. Tested ability from VrCore.

Change-Id: I01f1c75b1ccd44a09364df84218168cf6caab322

DO NOT MERGE ANYWHERE Revert "Merge "Remove gender-specific pronouns from documentation" into oc-dev"

Bug: 64864568

This reverts commit fd35d7c0, reversing
changes made to 07a21754.

OEMs can therefore arrange factory-default access to have access prior
to setup or user interaction.

Bug: 30770233
Bug: 64029450
Test: manual

Change-Id: I2cb30721f2a64ef50275b711ca10ca571248504a

It's @hidden, but CTS needs it to be out of the android.*
namespace too.

Fixes: 64613274
Test: Grab the cts binaries(android-cts.zip) from OC Release
Test: Extract and from android-cts/tools directory, launch ./cts-tradefed
Test: On the DUT with CL cherrypicked, run the below(will run this test on both abi's):
Test: run cts -m CtsPermission2TestCases -t android.permission2.cts.PermissionPolicyTest#testPlatformPermissionPolicyUnaltered --skip-connectivity-check --skip-preconditions --serial <device serial>
Test: android.permission2.cts.PermissionPolicyTest#testPlatformPermissionPolicyUnaltered doesn't fail for android namespace:android.permission.TRIGGER_TIME_ZONE_RULES_CHECK
Change-Id: I753c2cc19111f9ed39e7fc3e006aab096c733ddc
Merged-In: I2046ae17b9e89ac0a83e182b91422fd242bc7557

Move DISABLE_INPUT_DEVICE permission out of the
reserved android namespace until the next API
version. It appears to be mostly unused.

Fixes: 64615722
Test: Grab the cts binaries(android-cts.zip) from OC Release
Test: Extract and from android-cts/tools directory, launch ./cts-tradefed
Test: On the DUT with CL cherrypicked, run the below(will run this test on both abi's):
Test: run cts -m CtsPermission2TestCases -t android.permission2.cts.PermissionPolicyTest#testPlatformPermissionPolicyUnaltered --skip-connectivity-check --skip-preconditions --serial <device serial>
Test: android.permission2.cts.PermissionPolicyTest#testPlatformPermissionPolicyUnaltered doesn't fail for android namespace:android.permission.TRIGGER_TIME_ZONE_RULES_CHECK
Change-Id: If77fd9e5c0eede418fa14a37e5e895fee5667576
Merged-In: Ic98af7e3953da63c3c49bfd38d8cfd0ff0646869

This reverts commit fe6ec56c.

Fixes: 64606807
Test: Grab the cts binaries(android-cts.zip) from OC Release
Test: Extract and from android-cts/tools directory, launch ./cts-tradefed
Test: On the DUT with CL cherrypicked, run the below(will run this test on both abi's):
Test: run cts -m CtsPermission2TestCases -t android.permission2.cts.PermissionPolicyTest#testPlatformPermissionPolicyUnaltered --skip-connectivity-check --skip-preconditions --serial <device serial>
Test: android.permission2.cts.PermissionPolicyTest#testPlatformPermissionPolicyUnaltered doesn't fail for android namespace:android.permission.TRIGGER_TIME_ZONE_RULES_CHECK
Change-Id: I238e2b6fa7ce60e6a8cbfebcd13e5e4c596834af
Merged-In: I31b55e88072dd73055cb3d8cf252be6eac920322

Change-Id: If4b01e5f0728f1d1d7e6903b362dcbedc67a9b3f
Fixes: 62264194
Test: Manual. install an instant app and see that it still works

API council have requested a manifest constant be added
to the SystemApi directly in preference to an indirect
SystemApi constant here:
android.provider.TimeZoneRulesDataContract.READER_PERMISSION.

This is the first of three changes to (1) add the new constant,
(2) switch over code using the constant, (3) remove the
constant.

Bug: 64568899
Test: None, build only
Change-Id: Ib9766591979886d1db3b1d7321536dabf5cf81a8
(cherry picked from commit 8bb41405)

Test: make -j56 cts
run cts -m CtsPermission2TestCases -t android.permission2.cts.PermissionPolicyTest#testPlatformPermissionPolicyUnaltered --skip-connectivity-check --skip-preconditions --serial <device serial>

Fixes: 64560640

Change-Id: Ic807028567da9a4f3f108121d3e36358a513cf04

This reverts commit 4e0c2195.

Fixes: 64111427
Test: Grabbed OC CTS binaries
Test: Extracted android-cts.zip  and from android-cts/tools directory launched ./cts-tradefed
Test: On the DUT (running build which has this CL cherrypicked), ran the below (will run this test on both abi's):
Test: run cts -m CtsPermission2TestCases -t android.permission2.cts.PermissionPolicyTest#testPlatformPermissionPolicyUnaltered --skip-connectivity-check --skip-preconditions --serial <device serial>
Test: Note, while b/64111427 is fixed, this uncovered b/64560640

Change-Id: I1d2132678281a917f03c69d5ead1d28313d7f46d
Merged-In: Icab67ba2c40bc02968e3f8ed2da5a4a3be6cf77f

Bug: 64340162
Change-Id: Ia9370c0e80bb3a99df5008febc994846204272c1

This action "com.android.internal.action.EUICC_FACTORY_RESET" is
supposed to be set as "protected" in AndroidManifest.xml, but the
action in AndroidManifest.xml is
"com.android.server.action.WIPE_EUICC_DATA" by mistake.

Bug: 64264776
Test: E2E
Change-Id: I740af1f8062c0fd79c69398f3a2a72e1b3178860

Bug: 64337634
Test: make -j32 doc-comment-check-docs
Change-Id: I20fdd3dcddef09111d35946c41c596c7689effa6

There are intermittent issues where either the returned Bluetooth
MAC address to Java framework is uninitialized or this address update
arrives too late. This fix will do 2 things:
(1) Returns error when MAC address is unavailable in the native code.
(2) Updates the MAC address later by adding a new broadcast event.

Test: Check address for these cases: factory reset, system reboot, and
Bluetooth re-enable.
Bug: 36709382

Merged-In: I09720193e38fdf9139e1bb146f8e1847e2b65b1a
(cherry picked from commit ad4d1d8e)

Change-Id: Ifae3adf6e2aad1f0811c03d3114d1bd0452e7c23

We're not yet ready to commit to SubscriptionPlan as public API, so
relax to be @SystemApi instead.  Add a new MANAGE_SUBSCRIPTION_PLANS
permission that we require apps to hold, unless they've been
delegated access via a trusted CarrierService.

Since several apps have the ability to provide plans for a single
subId, we now remember the "owner" who set the current plan
information, and we refuse to leak plan information beyond the app
that originally set it.

Relax permissions check to not require READ_PHONE_STATE, since we're
only returning data that an app provided to us earlier.  Also fix
NPE when SubscriptionInfo is missing.

Test: bit FrameworksServicesTests:com.android.server.NetworkPolicyManagerServiceTest
Bug: 63997177, 63928277, 64156138, 63903381
Change-Id: If503378ef406dcaec438c9b41e837e0a821a3ef4

This CL fixes 1) broken IME switcher notification (Bug 63644555) and
2) a possible security bypass that any background application can
virtually call IMM#showInputMethodPicker() by sending an explicit intent
to the com.android.settings (Bug 64008672), and 3) wrong hint color for
the notification.

1) From Android-O, an implicit broadcast intent doesn't get delivered
to background apps [1]. So that the implicit broadcast intent of
action "android.settings.SHOW_INPUT_METHOD_PICKER" isn't always
delivered to Settings app, especially from the notification. So that
InputMethodManagerService should use an explicit broadcast intent for
a pending intent in the IME switcher notification. And it should also
implement broadcast receiver of the intent by itself and remove
InputMethodDialogReceiver from com.android.settings app [2].

2) In addition to the existing security check [3], the explict broadcast
intent mentioned in the above 1) must be locked down to the system by
using protected-broadcast [4].

 [1]: https://developer.android.com/preview/features/background.html#broadcasts
 [2]: Id990c66516c9b3ed7ada6891746ec0e0eecbe545 Settings app
 [3]: I4f0fc21268200c64d12b31ca54416acfbf62f37b InputMethodManagerService
 [4]: Ib58d2931cc8db3b88eab64352ba445be67eaec68 CTS permission2

Test: Modified InputMethodManagerService.updateSystemUiLocked() method
      to show IME switcher notification, and confirmed IME picker can be
      shown from notification bar.
Test: Confirmed the following command causes error.
    $ adb shell am broadcast \
          -a com.android.server.InputMethodManagerService.SHOW_INPUT_METHOD_PICKER
    java.lang.SecurityException: Permission Denial: not allowed to send
    broadcast com.android.server.InputMethodManagerService.SHOW_INPUT_METHOD_PICKER
    from pid=xxxx, uid=xxxx
Fixes: 63644555
Bug: 64008672
Change-Id: Id36c8c34159bea8b72557b40bcf024d401f580b6

This is a backwards incompatible change against System API,
but as there are no existing radio apps, nobody uses it.

Bug: b/63405337
Test: manual
Change-Id: Iaf6085914434be01e1c1e363609e5b0087ffe127

1. Added permission ACTIVITY_EMBEDDING which allows apps to launch
activities on virtual displays.
2. Allow owner of display to launch activities from same app without
permission check to owned display.
3. Added permission checks for launching on secondary displays to
more target task/stack resolution paths in ActivityStarter.

Bug: 63117330
Test: android.server.cts.ActivityManagerDisplayTests
Test: go/wm-smoke
Change-Id: If169a77fb56241e06f7de20168dc38c4b0a217f5
(cherry picked from commit 71587649)

Clean up SubscriptionPlan, add docs, and expose as public API.

Deprecate older constants in CarrierConfigManager, and point users
towards new API.  (The goal of CarrierConfigManager is to express
key/value pairs that are identical for all users on a particular
carrier, not to configure details that vary between users.)

Since a CarrierService may itself not have access to the plan
details, allow them to "delegate" the capability to configure plans
to another package name.

Factor out new RecurrenceRule class which is used by both
NetworkPolicy and SubscriptionPlan internally.  Polish it to support
arbitrary periods, and continue to test it through NPMST.

Bug: 63391323
Test: bit FrameworksCoreTests:android.util.RecurrenceRuleTest
Test: bit FrameworksServicesTests:com.android.server.NetworkPolicyManagerServiceTest
Exempt-From-Owner-Approval: Bug 63673347
Change-Id: I93fae4a43e58e9e4c32f8bf345a257dcd607f088

Bug: 62196835
Test: Created an accessibility service that displays a system
and a toast overlay, confirmed that it disappeared when we
reached the accessibility permission screen that uses this
flag.

Change-Id: Ic51ead670fc480e549512ba1d02f49d9c13bc3f0

Bug: 62196835
Test: Created an accessibility service that displays a system
and a toast overlay, confirmed that it disappeared when we
reached the accessibility permission screen that uses this
flag.

Change-Id: Ic51ead670fc480e549512ba1d02f49d9c13bc3f0

Bug: 62196835
Test: Created an accessibility service that displays a system
and a toast overlay, confirmed that it disappeared when we
reached the accessibility permission screen that uses this
flag.

Change-Id: Ic51ead670fc480e549512ba1d02f49d9c13bc3f0

The UPDATE_DEVICE_STATS permission has become the de-facto mechanism
that platform components use to shift blame for resource usage, so
it's confusing to also have a separate MODIFY_NETWORK_ACCOUNTING
permission.  So this change replaces MODIFY_NETWORK_ACCOUNTING with
UPDATE_DEVICE_STATS.

Bug: 62483389
Test: builds, boots
Exempt-From-Owner-Approval: Bug 63673347
Change-Id: I872759f02327b6d531ec2338bd876890aded60ad

The permission is preinstalled as we want to leave the PrintSpooler
unpriviledged.

Test: Checked that Settings, PrintSpooler and BuiltInPrintService still
      behave as expected.
Fixes: 62350107
Change-Id: Id33896f2899533f2d05cafa926df29cf1c6bfa77

Add new SubscriptionPlan API to describe the various types of carrier
data plans.  Internally the OS will only use the first plan for
driving policy, but it will blindly plumb through the details for
Settings to display any secondary plans.

As part of getting Settings ready to roll towards SubscriptionPlan,
reduce references to NetworkPolicy internal fields.  All usage cycle
details are now obtained from an Iterator which converts to
SubscriptionPlan under the hood.

Replace all data usage cycle calculation with new SubscriptionPlan
implementation, and retrofit large suite of existing tests to
exercise and verify the new logic.

Offer a debugging property that can be used to return "fake" plan
examples for testing.

Bug: 63391323
Test: bit FrameworksServicesTests:com.android.server.NetworkPolicyManagerServiceTest
Exempt-From-Owner-Approval: Bug 63673347
Change-Id: I889c653980eeb7887abdfa4f5b6986f35855ee6d

- Collect camera usage events (facing, client, duration)
- Create a JobService that triggers roughly daily to dump events

Test: Verify that 'adb shell cmd jobscheduler run android 13254266'
   prints out all camera usage since last run
Bug: 32449509
Change-Id: I13172e6e68f5cdb94685a112c74d270d1dda45bf

Bug: 62196835
Test: Created an accessibility service that displays a system
and a toast overlay, confirmed that it disappeared when we
reached the accessibility permission screen that uses this
flag.

Change-Id: Ic51ead670fc480e549512ba1d02f49d9c13bc3f0

Bug: 62196835
Test: Created an accessibility service that displays a system
and a toast overlay, confirmed that it disappeared when we
reached the accessibility permission screen that uses this
flag.

Change-Id: Ic51ead670fc480e549512ba1d02f49d9c13bc3f0

Bug: 62196835
Test: Created an accessibility service that displays a system
and a toast overlay, confirmed that it disappeared when we
reached the accessibility permission screen that uses this
flag.

Change-Id: Ibb4c2c6a30de6b4ce8d27c34caa02e2d8148f621

Update UCE service permissions' protection level from the old "signatureOrSystem" to "signature|privileged".
Also: update some outdated protection level documentation in AndroidManifest.xml.

Test: ...
Change-Id: I43345aeb3399aab0e6746dafa1a43f0ac477a6e1

Fixes: 63147379
Test: runtest systemui-notification, core tests
Change-Id: I2077a9fd563826d978d0dc01be89dd0bbc09eebf

Fixes: 63147379
Test: runtest systemui-notification, core tests
Change-Id: I2077a9fd563826d978d0dc01be89dd0bbc09eebf

- Implement getDownloadStatus in the manager
- Remove DownloadStatus and add constants in its place to reflect the
status of a single file
- Add ACT_AS_EMBMS_MIDDLEWARE permission

Change-Id: Ica8b8a872a8088a2aaf56d40926051225aa39e87

Test: do Nfc Bluetooth Handover and wait for the timeout
Bug: 63250718
Change-Id: Ieea8b8f7a07fe90a594ed13ecfefd01e1d60853d
(cherry picked from commit 506350b6)

Test: do Nfc Bluetooth Handover and wait for the timeout
Bug: 63250718
Change-Id: Ieea8b8f7a07fe90a594ed13ecfefd01e1d60853d