Use the PersistableBundle instead of the Bundle

It will be more secure to use PersistableBundle
instead of Bundle for passing the configrations
data from VoiceInteractor to HotwordDetectionService.

Bug: 176938300
Test: Test: atest CtsVoiceInteractionTestCases
Test: atest CtsVoiceInteractionTestCases --instant
Change-Id: I19a412cca5e2cd5f9f79a112a9d7da8fd3a00a38

core/api/system-current.txt

@@ -10372,7 +10372,7 @@ package android.service.voice {
     ctor public HotwordDetectionService();
     method @Nullable public final android.os.IBinder onBind(@NonNull android.content.Intent);
     method public void onDetectFromDspSource(@NonNull android.os.ParcelFileDescriptor, @NonNull android.media.AudioFormat, long, @NonNull android.service.voice.HotwordDetectionService.DspHotwordDetectionCallback);
-    method public void onUpdateState(@Nullable android.os.Bundle, @Nullable android.os.SharedMemory);
+    method public void onUpdateState(@Nullable android.os.PersistableBundle, @Nullable android.os.SharedMemory);
     field public static final String SERVICE_INTERFACE = "android.service.voice.HotwordDetectionService";
   }
 
@@ -10397,7 +10397,7 @@ package android.service.voice {
 
   public class VoiceInteractionService extends android.app.Service {
     method @NonNull public final android.service.voice.AlwaysOnHotwordDetector createAlwaysOnHotwordDetector(String, java.util.Locale, android.service.voice.AlwaysOnHotwordDetector.Callback);
-    method @NonNull @RequiresPermission(android.Manifest.permission.MANAGE_HOTWORD_DETECTION) public final android.service.voice.AlwaysOnHotwordDetector createAlwaysOnHotwordDetector(String, java.util.Locale, @Nullable android.os.Bundle, @Nullable android.os.SharedMemory, android.service.voice.AlwaysOnHotwordDetector.Callback);
+    method @NonNull @RequiresPermission(android.Manifest.permission.MANAGE_HOTWORD_DETECTION) public final android.service.voice.AlwaysOnHotwordDetector createAlwaysOnHotwordDetector(String, java.util.Locale, @Nullable android.os.PersistableBundle, @Nullable android.os.SharedMemory, android.service.voice.AlwaysOnHotwordDetector.Callback);
     method @NonNull @RequiresPermission("android.permission.MANAGE_VOICE_KEYPHRASES") public final android.media.voice.KeyphraseModelManager createKeyphraseModelManager();
   }
 

core/java/android/service/voice/AlwaysOnHotwordDetector.java

@@ -41,10 +41,10 @@ import android.media.permission.Identity;
 import android.os.AsyncTask;
 import android.os.Binder;
 import android.os.Build;
-import android.os.Bundle;
 import android.os.Handler;
 import android.os.IBinder;
 import android.os.Message;
+import android.os.PersistableBundle;
 import android.os.RemoteException;
 import android.os.SharedMemory;
 import android.util.Slog;
@@ -494,8 +494,8 @@ public class AlwaysOnHotwordDetector {
      * @param supportHotwordDetectionService {@code true} if hotword detection service should be
      * triggered, otherwise {@code false}.
      * @param options Application configuration data provided by the
-     * {@link VoiceInteractionService}. The system strips out any remotable objects or other
-     * contents that can be used to communicate with other processes.
+     * {@link VoiceInteractionService}. PersistableBundle does not allow any remotable objects or
+     * other contents that can be used to communicate with other processes.
      * @param sharedMemory The unrestricted data blob provided by the
      * {@link VoiceInteractionService}. Use this to provide the hotword models data or other
      * such data to the trusted process.
@@ -505,7 +505,7 @@ public class AlwaysOnHotwordDetector {
     public AlwaysOnHotwordDetector(String text, Locale locale, Callback callback,
             KeyphraseEnrollmentInfo keyphraseEnrollmentInfo,
             IVoiceInteractionManagerService modelManagementService, int targetSdkVersion,
-            boolean supportHotwordDetectionService, @Nullable Bundle options,
+            boolean supportHotwordDetectionService, @Nullable PersistableBundle options,
             @Nullable SharedMemory sharedMemory) {
         mText = text;
         mLocale = locale;
@@ -534,8 +534,8 @@ public class AlwaysOnHotwordDetector {
      * Set configuration and pass read-only data to hotword detection service.
      *
      * @param options Application configuration data provided by the
-     * {@link VoiceInteractionService}. The system strips out any remotable objects or other
-     * contents that can be used to communicate with other processes.
+     * {@link VoiceInteractionService}. PersistableBundle does not allow any remotable objects or
+     * other contents that can be used to communicate with other processes.
      * @param sharedMemory The unrestricted data blob provided by the
      * {@link VoiceInteractionService}. Use this to provide the hotword models data or other
      * such data to the trusted process.
@@ -544,7 +544,7 @@ public class AlwaysOnHotwordDetector {
      *
      * @hide
      */
-    public final void setHotwordDetectionServiceConfig(@Nullable Bundle options,
+    public final void setHotwordDetectionServiceConfig(@Nullable PersistableBundle options,
             @Nullable SharedMemory sharedMemory) {
         if (DBG) {
             Slog.d(TAG, "setHotwordDetectionServiceConfig()");

core/java/android/service/voice/HotwordDetectionService.java

@@ -27,11 +27,11 @@ import android.annotation.SystemApi;
 import android.app.Service;
 import android.content.Intent;
 import android.media.AudioFormat;
-import android.os.Bundle;
 import android.os.Handler;
 import android.os.IBinder;
 import android.os.Looper;
 import android.os.ParcelFileDescriptor;
+import android.os.PersistableBundle;
 import android.os.RemoteException;
 import android.os.SharedMemory;
 import android.util.Log;
@@ -82,7 +82,8 @@ public abstract class HotwordDetectionService extends Service {
         }
 
         @Override
-        public void setConfig(Bundle options, SharedMemory sharedMemory) throws RemoteException {
+        public void setConfig(PersistableBundle options, SharedMemory sharedMemory)
+                throws RemoteException {
             if (DBG) {
                 Log.d(TAG, "#setConfig");
             }
@@ -137,13 +138,13 @@ public abstract class HotwordDetectionService extends Service {
 
     /**
      * Called when the {@link VoiceInteractionService#createAlwaysOnHotwordDetector(String, Locale,
-     * Bundle, SharedMemory, AlwaysOnHotwordDetector.Callback)} or {@link AlwaysOnHotwordDetector#
-     * setHotwordDetectionServiceConfig(Bundle, SharedMemory)} requests an update of the hotword
-     * detection parameters.
+     * PersistableBundle, SharedMemory, AlwaysOnHotwordDetector.Callback)} or
+     * {@link AlwaysOnHotwordDetector#setHotwordDetectionServiceConfig(PersistableBundle,
+     * SharedMemory)} requests an update of the hotword detection parameters.
      *
      * @param options Application configuration data provided by the
-     * {@link VoiceInteractionService}. The system strips out any remotable objects or other
-     * contents that can be used to communicate with other processes.
+     * {@link VoiceInteractionService}. PersistableBundle does not allow any remotable objects or
+     * other contents that can be used to communicate with other processes.
      * @param sharedMemory The unrestricted data blob provided by the
      * {@link VoiceInteractionService}. Use this to provide the hotword models data or other
      * such data to the trusted process.
@@ -151,7 +152,8 @@ public abstract class HotwordDetectionService extends Service {
      * @hide
      */
     @SystemApi
-    public void onUpdateState(@Nullable Bundle options, @Nullable SharedMemory sharedMemory) {
+    public void onUpdateState(@Nullable PersistableBundle options,
+            @Nullable SharedMemory sharedMemory) {
     }
 
     /**

core/java/android/service/voice/IHotwordDetectionService.aidl

@@ -17,8 +17,8 @@
 package android.service.voice;
 
 import android.media.AudioFormat;
-import android.os.Bundle;
 import android.os.ParcelFileDescriptor;
+import android.os.PersistableBundle;
 import android.os.SharedMemory;
 import android.service.voice.IDspHotwordDetectionCallback;
 
@@ -34,5 +34,5 @@ oneway interface IHotwordDetectionService {
     long timeoutMillis,
     in IDspHotwordDetectionCallback callback);
 
-    void setConfig(in Bundle options, in SharedMemory sharedMemory);
+    void setConfig(in PersistableBundle options, in SharedMemory sharedMemory);
 }

core/java/android/service/voice/VoiceInteractionService.java

@@ -33,6 +33,7 @@ import android.media.voice.KeyphraseModelManager;
 import android.os.Bundle;
 import android.os.Handler;
 import android.os.IBinder;
+import android.os.PersistableBundle;
 import android.os.RemoteException;
 import android.os.ServiceManager;
 import android.os.SharedMemory;
@@ -342,8 +343,8 @@ public class VoiceInteractionService extends Service {
      * @param keyphrase The keyphrase that's being used, for example "Hello Android".
      * @param locale The locale for which the enrollment needs to be performed.
      * @param options Application configuration data provided by the
-     * {@link VoiceInteractionService}. The system strips out any remotable objects or other
-     * contents that can be used to communicate with other processes.
+     * {@link VoiceInteractionService}. PersistableBundle does not allow any remotable objects or
+     * other contents that can be used to communicate with other processes.
      * @param sharedMemory The unrestricted data blob provided by the
      * {@link VoiceInteractionService}. Use this to provide the hotword models data or other
      * such data to the trusted process.
@@ -358,7 +359,7 @@ public class VoiceInteractionService extends Service {
     public final AlwaysOnHotwordDetector createAlwaysOnHotwordDetector(
             @SuppressLint("MissingNullability") String keyphrase,  // TODO: nullability properly
             @SuppressLint({"MissingNullability", "UseIcu"}) Locale locale,
-            @Nullable Bundle options,
+            @Nullable PersistableBundle options,
             @Nullable SharedMemory sharedMemory,
             @SuppressLint("MissingNullability") AlwaysOnHotwordDetector.Callback callback) {
         return createAlwaysOnHotwordDetectorInternal(keyphrase, locale,
@@ -370,7 +371,7 @@ public class VoiceInteractionService extends Service {
             @SuppressLint("MissingNullability") String keyphrase,  // TODO: nullability properly
             @SuppressLint({"MissingNullability", "UseIcu"}) Locale locale,
             boolean supportHotwordDetectionService,
-            @Nullable Bundle options,
+            @Nullable PersistableBundle options,
             @Nullable SharedMemory sharedMemory,
             @SuppressLint("MissingNullability") AlwaysOnHotwordDetector.Callback callback) {
         if (mSystemService == null) {

core/java/com/android/internal/app/IVoiceInteractionManagerService.aidl

@@ -20,6 +20,7 @@ import android.content.ComponentName;
 import android.content.Intent;
 import android.media.permission.Identity;
 import android.os.Bundle;
+import android.os.PersistableBundle;
 import android.os.RemoteCallback;
 import android.os.SharedMemory;
 
@@ -229,13 +230,14 @@ interface IVoiceInteractionManagerService {
      * Set configuration and pass read-only data to hotword detection service.
      *
      * @param options Application configuration data provided by the
-     * {@link VoiceInteractionService}. The system strips out any remotable objects or other
-     * contents that can be used to communicate with other processes.
+     * {@link VoiceInteractionService}. PersistableBundle does not allow any remotable objects or
+     * other contents that can be used to communicate with other processes.
      * @param sharedMemory The unrestricted data blob provided by the
      * {@link VoiceInteractionService}. Use this to provide the hotword models data or other
      * such data to the trusted process.
      */
-    void setHotwordDetectionServiceConfig(in Bundle options, in SharedMemory sharedMemory);
+    void setHotwordDetectionServiceConfig(
+            in PersistableBundle options, in SharedMemory sharedMemory);
 
     /**
      * Requests to shutdown hotword detection service.

services/voiceinteraction/java/com/android/server/voiceinteraction/HotwordDetectionConnection.java

@@ -26,8 +26,8 @@ import android.hardware.soundtrigger.SoundTrigger;
 import android.media.AudioAttributes;
 import android.media.AudioRecord;
 import android.media.MediaRecorder;
-import android.os.Bundle;
 import android.os.ParcelFileDescriptor;
+import android.os.PersistableBundle;
 import android.os.RemoteException;
 import android.os.SharedMemory;
 import android.service.voice.AlwaysOnHotwordDetector;
@@ -77,7 +77,7 @@ final class HotwordDetectionConnection {
     boolean mBound;
 
     HotwordDetectionConnection(Object lock, Context context, ComponentName serviceName,
-            int userId, boolean bindInstantServiceAllowed, @Nullable Bundle options,
+            int userId, boolean bindInstantServiceAllowed, @Nullable PersistableBundle options,
             @Nullable SharedMemory sharedMemory) {
         mLock = lock;
         mContext = context;
@@ -129,7 +129,7 @@ final class HotwordDetectionConnection {
         }
     }
 
-    void setConfigLocked(Bundle options, SharedMemory sharedMemory) {
+    void setConfigLocked(PersistableBundle options, SharedMemory sharedMemory) {
         mRemoteHotwordDetectionService.run(
                 service -> service.setConfig(options, sharedMemory));
     }

services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java

@@ -56,6 +56,7 @@ import android.os.Bundle;
 import android.os.Handler;
 import android.os.IBinder;
 import android.os.Parcel;
+import android.os.PersistableBundle;
 import android.os.RemoteCallback;
 import android.os.RemoteCallbackList;
 import android.os.RemoteException;
@@ -983,7 +984,7 @@ public class VoiceInteractionManagerService extends SystemService {
         }
 
         @Override
-        public void setHotwordDetectionServiceConfig(@Nullable Bundle options,
+        public void setHotwordDetectionServiceConfig(@Nullable PersistableBundle options,
                 @Nullable SharedMemory sharedMemory) {
             enforceCallingPermission(Manifest.permission.MANAGE_HOTWORD_DETECTION);
             synchronized (this) {

services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerServiceImpl.java

@@ -43,6 +43,7 @@ import android.hardware.soundtrigger.IRecognitionStatusCallback;
 import android.os.Bundle;
 import android.os.Handler;
 import android.os.IBinder;
+import android.os.PersistableBundle;
 import android.os.RemoteCallback;
 import android.os.RemoteException;
 import android.os.ServiceManager;
@@ -401,7 +402,7 @@ class VoiceInteractionManagerServiceImpl implements VoiceInteractionSessionConne
         return mInfo.getSupportsLocalInteraction();
     }
 
-    public void setHotwordDetectionServiceConfigLocked(@Nullable Bundle options,
+    public void setHotwordDetectionServiceConfigLocked(@Nullable PersistableBundle options,
             @Nullable SharedMemory sharedMemory) {
         if (DEBUG) {
             Slog.d(TAG, "setHotwordDetectionServiceConfigLocked");
@@ -415,7 +416,6 @@ class VoiceInteractionManagerServiceImpl implements VoiceInteractionSessionConne
             throw new IllegalStateException("Hotword detection service not in isolated process");
         }
         // TODO : Need to check related permissions for hotword detection service
-        // TODO : Sanitize for bundle
 
         if (sharedMemory != null && !sharedMemory.setProtect(OsConstants.PROT_READ)) {
             Slog.w(TAG, "Can't set sharedMemory to be read-only");