Commit 11ac2019 authored Jan 22, 2019 by Robert Carr

SurfaceFlinger: Only allow update of InputWindowInfo with permission.

This was intended to be in the original CL, but it looks like I never added it or
lost it at some point. This is important as otherwise clients could use modality flags,
global focus, etc...to escape their constraints. The model is the WM can "bless" a surface for input
with given flags (e.g. non-modal) and then the client can manipulate the geometry if it
happens to have the surfacecontrol, but within the constraints of the hierarchy.

Bug: 111440400
Test: Builds
Change-Id: Ifea0882bb26f9791aa2736895c900a05a02ba7cb

parent 502fe80d

services/surfaceflinger/SurfaceFlinger.cpp

+6 −2

Original line number	Diff line number	Diff line
		@@ -3961,8 +3961,12 @@ uint32_t SurfaceFlinger::setClientStateLocked(const ComposerState& composerState
		if (layer->setSidebandStream(s.sidebandStream)) flags \|= eTraversalNeeded;
		}
		if (what & layer_state_t::eInputInfoChanged) {
		if (callingThreadHasUnscopedSurfaceFlingerAccess()) {
		layer->setInputInfo(s.inputInfo);
		flags \|= eTraversalNeeded;
		} else {
		ALOGE("Attempt to update InputWindowInfo without permission ACCESS_SURFACE_FLINGER");
		}
		}
		std::vector<sp<CallbackHandle>> callbackHandles;
		if ((what & layer_state_t::eListenerCallbacksChanged) && (!s.listenerCallbacks.empty())) {