From 5fbeff59df3ea1441c3843aa1834616876ef1985 Mon Sep 17 00:00:00 2001
From: Bernardo Rufino <brufino@google.com>
Date: Wed, 26 May 2021 16:25:39 +0100
Subject: [PATCH] Fix background bypass via notifications

Apps were able to bypass BAL and BG-FGS restrictions by retrieving their
own notifications and firing their PI since those were allowlisted for
those operations.

Now we strip the token that granted them that ability
from notifications returned via NM.getActiveNotifications(), which
returns the notifications of the caller.

Notifications returned via notification listener APIs still contain such
token, as they should.

Bug: 185388103
Bug: 169821287
Test: atest -d android.app.cts.NotificationManagerTest#testActivityStartFromRetrievedNotification_isBlocked
Change-Id: I2ede0d639a560f6acacec3864a0a7d23af152ba5
---
 core/java/android/app/Notification.java             | 13 +++++++++++++
 .../notification/NotificationManagerService.java    |  8 +++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/core/java/android/app/Notification.java b/core/java/android/app/Notification.java
index 18651411cf132..6c68d97d5d15b 100644
--- a/core/java/android/app/Notification.java
+++ b/core/java/android/app/Notification.java
@@ -3313,6 +3313,19 @@ public class Notification implements Parcelable
         builder.build(); // callers expect this notification to be ready to use
     }
 
+    /**
+     * Sets the token used for background operations for the pending intents associated with this
+     * notification.
+     *
+     * This token is automatically set during deserialization for you, you usually won't need to
+     * call this unless you want to change the existing token, if any.
+     *
+     * @hide
+     */
+    public void setAllowlistToken(@Nullable IBinder token) {
+        mAllowlistToken = token;
+    }
+
     /**
      * @hide
      */
diff --git a/services/core/java/com/android/server/notification/NotificationManagerService.java b/services/core/java/com/android/server/notification/NotificationManagerService.java
index 0bc28405eab3d..6fe78537740c9 100755
--- a/services/core/java/com/android/server/notification/NotificationManagerService.java
+++ b/services/core/java/com/android/server/notification/NotificationManagerService.java
@@ -4221,6 +4221,7 @@ public class NotificationManagerService extends SystemService {
             }
         }
 
+        /** Notifications returned here will have allowlistToken stripped from them. */
         private StatusBarNotification sanitizeSbn(String pkg, int userId,
                 StatusBarNotification sbn) {
             if (sbn.getUserId() == userId) {
@@ -4228,11 +4229,16 @@ public class NotificationManagerService extends SystemService {
                     // We could pass back a cloneLight() but clients might get confused and
                     // try to send this thing back to notify() again, which would not work
                     // very well.
+                    Notification notification = sbn.getNotification().clone();
+                    // Remove background token before returning notification to untrusted app, this
+                    // ensures the app isn't able to perform background operations that are
+                    // associated with notification interactions.
+                    notification.setAllowlistToken(null);
                     return new StatusBarNotification(
                             sbn.getPackageName(),
                             sbn.getOpPkg(),
                             sbn.getId(), sbn.getTag(), sbn.getUid(), sbn.getInitialPid(),
-                            sbn.getNotification().clone(),
+                            notification,
                             sbn.getUser(), sbn.getOverrideGroupKey(), sbn.getPostTime());
                 }
             }