From 3e6e3855ea10c92a0328c360fc8414e85fb3ad61 Mon Sep 17 00:00:00 2001 From: Dianne Hackborn Date: Fri, 19 May 2017 16:12:08 -0700 Subject: [PATCH] Fix issue #38393543: Not allowed to start service Intent Turns out there was another path in to the activity manager to trigger a PendingIntent, which needs to be modified to now also pass in the whitelist token of that pending intent. Test: manual Change-Id: I755ff87db1b782fa6974d404dcb490786053c5e0 --- core/java/android/app/Activity.java | 4 +++- core/java/android/app/ContextImpl.java | 4 +++- core/java/android/app/IActivityManager.aidl | 4 ++-- core/java/android/content/IntentSender.java | 5 +++++ .../android/server/am/ActivityManagerService.java | 13 ++++++------- 5 files changed, 19 insertions(+), 11 deletions(-) diff --git a/core/java/android/app/Activity.java b/core/java/android/app/Activity.java index ab035569fea24..65e0b90384bfd 100644 --- a/core/java/android/app/Activity.java +++ b/core/java/android/app/Activity.java @@ -4719,7 +4719,9 @@ public class Activity extends ContextThemeWrapper resolvedType = fillInIntent.resolveTypeIfNeeded(getContentResolver()); } int result = ActivityManager.getService() - .startActivityIntentSender(mMainThread.getApplicationThread(), intent, + .startActivityIntentSender(mMainThread.getApplicationThread(), + intent != null ? intent.getTarget() : null, + intent != null ? intent.getWhitelistToken() : null, fillInIntent, resolvedType, mToken, who, requestCode, flagsMask, flagsValues, options); if (result == ActivityManager.START_CANCELED) { diff --git a/core/java/android/app/ContextImpl.java b/core/java/android/app/ContextImpl.java index 2de205b409703..268a105b7c6f6 100644 --- a/core/java/android/app/ContextImpl.java +++ b/core/java/android/app/ContextImpl.java @@ -925,7 +925,9 @@ class ContextImpl extends Context { resolvedType = fillInIntent.resolveTypeIfNeeded(getContentResolver()); } int result = ActivityManager.getService() - .startActivityIntentSender(mMainThread.getApplicationThread(), intent, + .startActivityIntentSender(mMainThread.getApplicationThread(), + intent != null ? intent.getTarget() : null, + intent != null ? intent.getWhitelistToken() : null, fillInIntent, resolvedType, null, null, 0, flagsMask, flagsValues, options); if (result == ActivityManager.START_CANCELED) { diff --git a/core/java/android/app/IActivityManager.aidl b/core/java/android/app/IActivityManager.aidl index 9552d1723317a..3ac026d70a6f9 100644 --- a/core/java/android/app/IActivityManager.aidl +++ b/core/java/android/app/IActivityManager.aidl @@ -236,8 +236,8 @@ interface IActivityManager { Debug.MemoryInfo[] getProcessMemoryInfo(in int[] pids); void killApplicationProcess(in String processName, int uid); int startActivityIntentSender(in IApplicationThread caller, - in IntentSender intent, in Intent fillInIntent, in String resolvedType, - in IBinder resultTo, in String resultWho, int requestCode, + in IIntentSender target, in IBinder whitelistToken, in Intent fillInIntent, + in String resolvedType, in IBinder resultTo, in String resultWho, int requestCode, int flagsMask, int flagsValues, in Bundle options); void overridePendingTransition(in IBinder token, in String packageName, int enterAnim, int exitAnim); diff --git a/core/java/android/content/IntentSender.java b/core/java/android/content/IntentSender.java index 0a456b528b0f2..ff127df6ec9bc 100644 --- a/core/java/android/content/IntentSender.java +++ b/core/java/android/content/IntentSender.java @@ -360,6 +360,11 @@ public class IntentSender implements Parcelable { return mTarget; } + /** @hide */ + public IBinder getWhitelistToken() { + return mWhitelistToken; + } + /** @hide */ public IntentSender(IIntentSender target) { mTarget = target; diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java index 54b28d1584e07..bb6637d102d73 100644 --- a/services/core/java/com/android/server/am/ActivityManagerService.java +++ b/services/core/java/com/android/server/am/ActivityManagerService.java @@ -4587,9 +4587,9 @@ public class ActivityManagerService extends IActivityManager.Stub } @Override - public int startActivityIntentSender(IApplicationThread caller, IntentSender intent, - Intent fillInIntent, String resolvedType, IBinder resultTo, String resultWho, - int requestCode, int flagsMask, int flagsValues, Bundle bOptions) + public int startActivityIntentSender(IApplicationThread caller, IIntentSender target, + IBinder whitelistToken, Intent fillInIntent, String resolvedType, IBinder resultTo, + String resultWho, int requestCode, int flagsMask, int flagsValues, Bundle bOptions) throws TransactionTooLargeException { enforceNotIsolatedCaller("startActivityIntentSender"); // Refuse possible leaked file descriptors @@ -4597,12 +4597,11 @@ public class ActivityManagerService extends IActivityManager.Stub throw new IllegalArgumentException("File descriptors passed in Intent"); } - IIntentSender sender = intent.getTarget(); - if (!(sender instanceof PendingIntentRecord)) { + if (!(target instanceof PendingIntentRecord)) { throw new IllegalArgumentException("Bad PendingIntent object"); } - PendingIntentRecord pir = (PendingIntentRecord)sender; + PendingIntentRecord pir = (PendingIntentRecord)target; synchronized (this) { // If this is coming from the currently resumed activity, it is @@ -4613,7 +4612,7 @@ public class ActivityManagerService extends IActivityManager.Stub mAppSwitchesAllowedTime = 0; } } - int ret = pir.sendInner(0, fillInIntent, resolvedType, null, null, null, + int ret = pir.sendInner(0, fillInIntent, resolvedType, whitelistToken, null, null, resultTo, resultWho, requestCode, flagsMask, flagsValues, bOptions, null); return ret; }