Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0564ec25 authored by Taran Singh's avatar Taran Singh
Browse files

DO NOT MERGE: Prevent non-system IME from becoming device admin 

Currently selected IME can inject KeyEvent on DeviceAdminAdd screen to
activate itself as device admin and cause various DoS attacks.

This CL ensures KeyEvent on "Activate" button can only come from system
apps.

Bug: 280793427
Test: atest DeviceAdminActivationTest
Change-Id: I6470d1684d707f4b1e86f8b456be0b4e0af5f188
(cherry picked from commit 70a501d0)
parent 8befc274

src/com/android/settings/applications/specialaccess/deviceadmin/DeviceAdminAdd.java

+64 −56
Original line number Diff line number Diff line
@@ -50,6 +50,8 @@ import android.text.method.ScrollingMovementMethod; 
import android.util.EventLog;

import android.util.Log;

import android.view.Display;

import android.view.KeyEvent;

import android.view.LayoutInflater;

import android.view.View;

import android.view.ViewGroup;

import android.view.ViewTreeObserver;
@@ -401,8 +403,8 @@ public class DeviceAdminAdd extends Activity { 


        final View restrictedAction = findViewById(R.id.restricted_action);

        restrictedAction.setFilterTouchesWhenObscured(true);

        restrictedAction.setOnClickListener(new View.OnClickListener() {

            public void onClick(View v) {



        final View.OnClickListener restrictedActionClickListener = v -> {

            if (!mActionButton.isEnabled()) {

                showPolicyTransparencyDialogIfRequired();

                return;
@@ -445,14 +447,20 @@ public class DeviceAdminAdd extends Activity { 
                            }

                        }, mHandler));

                // Don't want to wait too long.

                    getWindow().getDecorView().getHandler().postDelayed(new Runnable() {

                        @Override public void run() {

                            continueRemoveAction(null);

                        }

                    }, 2*1000);

                }

                getWindow().getDecorView().getHandler().postDelayed(

                        () -> continueRemoveAction(null), 2 * 1000);

            }

        };

        restrictedAction.setOnKeyListener((view, keyCode, keyEvent) -> {

            if ((keyEvent.getFlags() & KeyEvent.FLAG_FROM_SYSTEM) == 0) {

                Log.e(TAG, "Can not activate device-admin with KeyEvent from non-system app.");

                // Consume event to suppress click.

                return true;

            }

            // Fallback to view click handler.

            return false;

        });

        restrictedAction.setOnClickListener(restrictedActionClickListener);

    }



    /**