From 3640aee24416aa8b17e1c861af301c9518d977ae Mon Sep 17 00:00:00 2001 From: Christopher Tate Date: Wed, 27 Apr 2022 14:50:35 -0700 Subject: [PATCH] Prevent user stop of protected apps Paralleling the policy for "force stop," disallow the "task manager" class of user-invoked application shutdown when the target app is protected. Covers both the UI-driven and shell-command-driven paths. Fixes: 228111137 Test: atest com.android.cts.devicepolicy.DeviceOwnerTest Change-Id: Idd8b7ef1876f813e97b9f6af85264acb6555335f --- .../com/android/server/am/ActivityManagerService.java | 8 ++++++++ .../android/server/am/ActivityManagerShellCommand.java | 3 +++ 2 files changed, 11 insertions(+) diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java index f6e8bc826153d..4bf36229f0e4c 100644 --- a/services/core/java/com/android/server/am/ActivityManagerService.java +++ b/services/core/java/com/android/server/am/ActivityManagerService.java @@ -4358,6 +4358,14 @@ public class ActivityManagerService extends IActivityManager.Stub + " but does not exist in that user"); return; } + + // Policy: certain classes of app are not subject to user-invoked stop + if (getPackageManagerInternal().isPackageStateProtected(packageName, userId)) { + Slog.w(TAG, "Asked to stop " + packageName + "/u" + userId + + " but it is protected"); + return; + } + Slog.i(TAG, "Stopping app for user: " + packageName + "/" + userId); // A specific subset of the work done in forceStopPackageLocked(), because we are diff --git a/services/core/java/com/android/server/am/ActivityManagerShellCommand.java b/services/core/java/com/android/server/am/ActivityManagerShellCommand.java index 397a4420700e9..2c2579f9e504f 100644 --- a/services/core/java/com/android/server/am/ActivityManagerShellCommand.java +++ b/services/core/java/com/android/server/am/ActivityManagerShellCommand.java @@ -3561,6 +3561,9 @@ final class ActivityManagerShellCommand extends ShellCommand { pw.println(" Enable/disable rate limit on FGS notification deferral policy."); pw.println(" force-stop [--user | all | current] "); pw.println(" Completely stop the given application package."); + pw.println(" stop-app [--user | all | current] "); + pw.println(" Stop an app and all of its services. Unlike `force-stop` this does"); + pw.println(" not cancel the app's scheduled alarms and jobs."); pw.println(" crash [--user ] "); pw.println(" Induce a VM crash in the specified package or process"); pw.println(" kill [--user | all | current] ");