Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 83447688 authored by Joe Bolinger's avatar Joe Bolinger Committed by Android Build Coastguard Worker
Browse files

Add check to prevent privilege escalation from trampoline added in change... 

Add check to prevent privilege escalation from trampoline added in change Ie469c47005afb941f5646a2f790736362c23c697.

Add additional check in enrollment base class.

Flag: EXEMPT CVE_FIX
Bug: 418774489
Test: atest FaceEnrollTest FaceEnrollIntroductionTest
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c07d03e5ef9ff05f34b6358440af6770044579ae)
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:e0476f87117c1b689b96c9a37ac12162d79c6cf6
Merged-In: I49f4a980a0c9ed80cc2e370a42bd60425d018a4c
Change-Id: I49f4a980a0c9ed80cc2e370a42bd60425d018a4c
parent 596c7b99

src/com/android/settings/biometrics/BiometricEnrollBase.java

+6 −1
Original line number Diff line number Diff line
@@ -182,7 +182,12 @@ public abstract class BiometricEnrollBase extends InstrumentedActivity { 
                    EXTRA_LAUNCHED_POSTURE_GUIDANCE);

            mNextLaunched = savedInstanceState.getBoolean(EXTRA_KEY_NEXT_LAUNCHED);

        }

        final String callingPackage = getLaunchedFromPackage();

        if (callingPackage == null || !getPackageName().equals(callingPackage)) {

            mUserId = UserHandle.myUserId();

        } else {

            mUserId = getIntent().getIntExtra(Intent.EXTRA_USER_ID, UserHandle.myUserId());

        }

        mPostureGuidanceIntent = FeatureFactory.getFeatureFactory()

                .getFaceFeatureProvider().getPostureGuidanceIntent(getApplicationContext());

src/com/android/settings/biometrics/face/FaceEnroll.kt

+9 −0
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ import android.app.ComponentCaller 
import android.content.Intent

import android.os.Bundle

import android.util.Log

import androidx.annotation.VisibleForTesting

import androidx.appcompat.app.AppCompatActivity

import com.android.settings.biometrics.BiometricEnrollBase.RESULT_FINISHED

import com.android.settings.biometrics.combination.CombinedBiometricStatusUtils
@@ -38,6 +39,9 @@ class FaceEnroll: AppCompatActivity() { 
    private val enrollActivityProvider: FaceEnrollActivityClassProvider

        get() = featureFactory.faceFeatureProvider.enrollActivityClassProvider



    @VisibleForTesting

    var launchedFromProvider: () -> String? = { launchedFromPackage }



    private var isLaunched = false



    override fun onCreate(savedInstanceState: Bundle?) {
@@ -56,6 +60,11 @@ class FaceEnroll: AppCompatActivity() { 
            Log.d("FaceEnroll", "forward to $nextActivityClass")

            val nextIntent = Intent(this, nextActivityClass)

            nextIntent.putExtras(intent)



            // drop extras that are not allowed from external packages before launching

            if (launchedFromProvider() != packageName) {

                nextIntent.removeExtra(Intent.EXTRA_USER_ID)

            }

            startActivityForResult(nextIntent, 0)



            isLaunched = true

src/com/android/settings/biometrics/face/FaceEnrollIntroduction.java

+2 −3
Original line number Diff line number Diff line
@@ -239,9 +239,8 @@ public class FaceEnrollIntroduction extends BiometricEnrollIntroduction { 
        if (token != null) {

            intent.putExtra(ChooseLockSettingsHelper.EXTRA_KEY_CHALLENGE_TOKEN, token);

        }

        final int userId = getIntent().getIntExtra(Intent.EXTRA_USER_ID, UserHandle.myUserId());

        if (userId != UserHandle.USER_NULL) {

            intent.putExtra(Intent.EXTRA_USER_ID, userId);

        if (mUserId != UserHandle.USER_NULL) {

            intent.putExtra(Intent.EXTRA_USER_ID, mUserId);

        }

        BiometricUtils.copyMultiBiometricExtras(getIntent(), intent);

        intent.putExtra(EXTRA_FROM_SETTINGS_SUMMARY, true);

tests/robotests/src/com/android/settings/biometrics/MultiBiometricEnrollHelperTest.java

+8 −1
Original line number Diff line number Diff line
@@ -140,9 +140,16 @@ public class MultiBiometricEnrollHelperTest { 
        final ShadowPackageManager shadowPackageManager = shadowOf(mContext.getPackageManager());

        shadowPackageManager.setSystemFeature(PackageManager.FEATURE_FACE, true);

        ShadowUtils.setFaceManager(mFaceManager);

        ActivityController.of(new FaceEnrollIntroduction(), mFaceIntent)

        ActivityController.of(new TestFaceEnrollIntroduction(), mFaceIntent)

                .create(mFaceIntent.getExtras()).get();



        verify(mFaceManager).generateChallenge(eq(mUserId), any());

    }



    private static class TestFaceEnrollIntroduction extends FaceEnrollIntroduction {

        @Override

        public String getLaunchedFromPackage() {

            return getPackageName();

        }

    }

}

tests/robotests/src/com/android/settings/biometrics/face/FaceEnrollIntroductionTest.java

+5 −0
Original line number Diff line number Diff line
@@ -182,6 +182,11 @@ public class FaceEnrollIntroductionTest { 
        public boolean isInMultiWindowMode() {

            return mIsMultiWindowMode;

        }



        @Override

        public String getLaunchedFromPackage() {

            return getPackageName();

        }

    }



    @Before