From 4034559836d29f95153b1a05526db862fcf8d1d0 Mon Sep 17 00:00:00 2001
From: Charles Chen <liangyuchen@google.com>
Date: Tue, 17 Jan 2023 22:52:17 +0000
Subject: [PATCH] Provide extra seinfo for SandboxedDetectionService

Add an extra seInfo for HotwordDetectionService and
VisualQueryDetectionService such that the two services can run in a
secontext other than isolated_app while holding isolated UID.

Bug: 265540209
Test: atest ActiveServicesTest && manual - sample app has correct seInfo

Change-Id: I3e71e51094b5744bc9f42181d010d06509c9b879
---
 .../com/android/server/am/ActiveServices.java     | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/services/core/java/com/android/server/am/ActiveServices.java b/services/core/java/com/android/server/am/ActiveServices.java
index 6719fdbbeb8b4..3307d9232e625 100644
--- a/services/core/java/com/android/server/am/ActiveServices.java
+++ b/services/core/java/com/android/server/am/ActiveServices.java
@@ -175,6 +175,8 @@ import android.os.TransactionTooLargeException;
 import android.os.UserHandle;
 import android.os.UserManager;
 import android.provider.Settings;
+import android.service.voice.HotwordDetectionService;
+import android.service.voice.VisualQueryDetectionService;
 import android.stats.devicepolicy.DevicePolicyEnums;
 import android.text.TextUtils;
 import android.util.ArrayMap;
@@ -3747,6 +3749,17 @@ public final class ActiveServices {
                 inSharedIsolatedProcess);
     }
 
+    // TODO(b/265746493): Special case for HotwordDetectionService and
+    // VisualQueryDetectionService. Need a cleaner way to append this seInfo.
+    private String generateAdditionalSeInfoFromService(Intent service) {
+        if (service != null && service.getAction() != null
+                && (service.getAction().equals(HotwordDetectionService.SERVICE_INTERFACE)
+                || service.getAction().equals(VisualQueryDetectionService.SERVICE_INTERFACE))) {
+            return ":isolatedComputeApp";
+        }
+        return "";
+    }
+
     private ServiceLookupResult retrieveServiceLocked(Intent service,
             String instanceName, boolean isSdkSandboxService, int sdkSandboxClientAppUid,
             String sdkSandboxClientAppPackage, String resolvedType,
@@ -3864,6 +3877,7 @@ public final class ActiveServices {
                 r.mRecentCallingPackage = callingPackage;
                 r.mRecentCallingUid = callingUid;
             }
+            r.appInfo.seInfo += generateAdditionalSeInfoFromService(service);
             return new ServiceLookupResult(r, resolution.getAlias());
         }
 
@@ -4089,6 +4103,7 @@ public final class ActiveServices {
                     return null;
                 }
             }
+            r.appInfo.seInfo += generateAdditionalSeInfoFromService(service);
             return new ServiceLookupResult(r, resolution.getAlias());
         }
         return null;