From 3cf3c64037148c3327658d63d18e63837b69e253 Mon Sep 17 00:00:00 2001 From: andychou Date: Mon, 2 Dec 2019 10:21:55 +0800 Subject: [PATCH] Fix thirt party app security exception when call to AudioManager.setMicrophoneMute() In the current master code, AudioManager.ACTION_MICROPHONE_MUTE_CHANGED is broadcasted too all users inside setMicrophoneMuteNoCallerCheck(). This causes the third party application needs system permission android.permission.INTERACT_ACROSS_USERS_FULL or android.permission.INTERACT_ACROSS_USERS. Third party application just want to turn on/off microphone but not about broadcast intent. So we should move broadcast intent code to AudioService itself. Therefore, broadcast message to main thread handler to broadcast intent to avoid security exception. Bug: 145388173 Test: Write a simple test APP to call to AudioManager.AudioManager.setMicrophoneMute(). Change-Id: I44cebc9e6e21c1ee0c59125ee702b7093ad38a63 --- .../java/com/android/server/audio/AudioService.java | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/services/core/java/com/android/server/audio/AudioService.java b/services/core/java/com/android/server/audio/AudioService.java index e426c6c44a077..4bf1de66b4080 100644 --- a/services/core/java/com/android/server/audio/AudioService.java +++ b/services/core/java/com/android/server/audio/AudioService.java @@ -269,6 +269,7 @@ public class AudioService extends IAudioService.Stub private static final int MSG_OBSERVE_DEVICES_FOR_ALL_STREAMS = 27; private static final int MSG_HDMI_VOLUME_CHECK = 28; private static final int MSG_PLAYBACK_CONFIG_CHANGE = 29; + private static final int MSG_BROADCAST_MICROPHONE_MUTE = 30; // start of messages handled under wakelock // these messages can only be queued, i.e. sent with queueMsgUnderWakeLock(), // and not with sendMsg(..., ..., SENDMSG_QUEUE, ...) @@ -2925,9 +2926,8 @@ public class AudioService extends IAudioService.Stub AudioSystem.muteMicrophone(muted); try { if (muted != currentMute) { - mContext.sendBroadcastAsUser( - new Intent(AudioManager.ACTION_MICROPHONE_MUTE_CHANGED) - .setFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY), UserHandle.ALL); + sendMsg(mAudioHandler, MSG_BROADCAST_MICROPHONE_MUTE, + SENDMSG_NOOP, 0, 0, null, 0); } } finally { Binder.restoreCallingIdentity(identity); @@ -5236,6 +5236,13 @@ public class AudioService extends IAudioService.Stub case MSG_PLAYBACK_CONFIG_CHANGE: onPlaybackConfigChange((List) msg.obj); break; + + case MSG_BROADCAST_MICROPHONE_MUTE: + mContext.sendBroadcastAsUser( + new Intent(AudioManager.ACTION_MICROPHONE_MUTE_CHANGED) + .setFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY), + UserHandle.ALL); + break; } } }