Merge "Make sure only the system uses BIND_ALMOST_PERCEPTIBLE." into tm-dev am: d336b9ba57

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/17355723

Change-Id: Id70e33c414dc1011112160f914fa28d84b969363

services/core/java/com/android/server/am/ActiveServices.java

@@ -2789,6 +2789,11 @@ public final class ActiveServices {
                             + ") set BIND_ALLOW_INSTANT when binding service " + service);
         }
 
+        if ((flags & Context.BIND_ALMOST_PERCEPTIBLE) != 0 && !isCallerSystem) {
+            throw new SecurityException("Non-system caller (pid=" + callingPid
+                    + ") set BIND_ALMOST_PERCEPTIBLE when binding service " + service);
+        }
+
         if ((flags & Context.BIND_ALLOW_BACKGROUND_ACTIVITY_STARTS) != 0) {
             mAm.enforceCallingPermission(
                     android.Manifest.permission.START_ACTIVITIES_FROM_BACKGROUND,