From 5b96c0150693c9eb3b2a9198160353211deeddd0 Mon Sep 17 00:00:00 2001 From: Nicholas Ambur Date: Mon, 16 Nov 2020 17:50:52 -0800 Subject: [PATCH] fix issue with ST listModules check SoundTrigger.listModules call was being passed to the SoundTrigger HAL without SoundTriggerMiddleware checking permissions against the client. Instead, client was checking permissions against the system service UID. Bug: 171342256 Test: verify `dumpsys soundtrigger_middleware` logs listmodules as being called by the SoundTrigger client session Change-Id: Ic4bef05f59ef3d13ab0eed16017275070513ec84 --- .../soundtrigger/SoundTriggerHelper.java | 34 ++++++++++++++----- .../soundtrigger/SoundTriggerService.java | 18 ++++++++-- 2 files changed, 41 insertions(+), 11 deletions(-) diff --git a/services/voiceinteraction/java/com/android/server/soundtrigger/SoundTriggerHelper.java b/services/voiceinteraction/java/com/android/server/soundtrigger/SoundTriggerHelper.java index 632ad4c33e36e..4bf93a26ec03f 100644 --- a/services/voiceinteraction/java/com/android/server/soundtrigger/SoundTriggerHelper.java +++ b/services/voiceinteraction/java/com/android/server/soundtrigger/SoundTriggerHelper.java @@ -60,7 +60,6 @@ import java.util.Iterator; import java.util.Map; import java.util.Objects; import java.util.UUID; -import java.util.function.BiFunction; /** * Helper for {@link SoundTrigger} APIs. Supports two types of models: @@ -118,8 +117,7 @@ public class SoundTriggerHelper implements SoundTrigger.StatusListener { private PowerSaveModeListener mPowerSaveModeListener; - private final BiFunction - mModuleProvider; + private final SoundTriggerModuleProvider mModuleProvider; // Handler to process call state changes will delay to allow time for the audio // and sound trigger HALs to process the end of call notifications @@ -128,12 +126,32 @@ public class SoundTriggerHelper implements SoundTrigger.StatusListener { private static final int MSG_CALL_STATE_CHANGED = 0; private static final int CALL_INACTIVE_MSG_DELAY_MS = 1000; - SoundTriggerHelper(Context context, - @NonNull BiFunction moduleProvider) { + /** + * Provider interface for retrieving SoundTriggerModule instances + */ + public interface SoundTriggerModuleProvider { + /** + * Populate module properties for all available modules + * + * @param modules List of ModuleProperties to be populated + * @return Status int 0 on success. + */ + int listModuleProperties(@NonNull ArrayList modules); + + /** + * Get SoundTriggerModule based on {@link SoundTrigger.ModuleProperties#getId()} + * + * @param moduleId Module ID + * @param statusListener Client listener to be associated with the returned module + * @return Module associated with moduleId + */ + SoundTriggerModule getModule(int moduleId, SoundTrigger.StatusListener statusListener); + } + + SoundTriggerHelper(Context context, SoundTriggerModuleProvider moduleProvider) { ArrayList modules = new ArrayList<>(); mModuleProvider = moduleProvider; - int status = SoundTrigger.listModules(modules); + int status = mModuleProvider.listModuleProperties(modules); mContext = context; mTelephonyManager = (TelephonyManager) context.getSystemService(Context.TELEPHONY_SERVICE); mPowerManager = (PowerManager) context.getSystemService(Context.POWER_SERVICE); @@ -272,7 +290,7 @@ public class SoundTriggerHelper implements SoundTrigger.StatusListener { private int prepareForRecognition(ModelData modelData) { if (mModule == null) { - mModule = mModuleProvider.apply(mModuleProperties.getId(), this); + mModule = mModuleProvider.getModule(mModuleProperties.getId(), this); if (mModule == null) { Slog.w(TAG, "prepareForRecognition: cannot attach to sound trigger module"); return STATUS_ERROR; diff --git a/services/voiceinteraction/java/com/android/server/soundtrigger/SoundTriggerService.java b/services/voiceinteraction/java/com/android/server/soundtrigger/SoundTriggerService.java index 2a5bfce9bb331..bd678fd540634 100644 --- a/services/voiceinteraction/java/com/android/server/soundtrigger/SoundTriggerService.java +++ b/services/voiceinteraction/java/com/android/server/soundtrigger/SoundTriggerService.java @@ -51,6 +51,7 @@ import android.hardware.soundtrigger.SoundTrigger.ModelParamRange; import android.hardware.soundtrigger.SoundTrigger.ModuleProperties; import android.hardware.soundtrigger.SoundTrigger.RecognitionConfig; import android.hardware.soundtrigger.SoundTrigger.SoundModel; +import android.hardware.soundtrigger.SoundTriggerModule; import android.media.AudioAttributes; import android.media.AudioFormat; import android.media.AudioRecord; @@ -219,9 +220,20 @@ public class SoundTriggerService extends SystemService { Identity originatorIdentity = IdentityContext.getNonNull(); return new SoundTriggerHelper(mContext, - (moduleId, listener) -> SoundTrigger.attachModuleAsMiddleman(moduleId, listener, - null, - middlemanIdentity, originatorIdentity)); + new SoundTriggerHelper.SoundTriggerModuleProvider() { + @Override + public int listModuleProperties(ArrayList modules) { + return SoundTrigger.listModulesAsMiddleman(modules, middlemanIdentity, + originatorIdentity); + } + + @Override + public SoundTriggerModule getModule(int moduleId, + SoundTrigger.StatusListener statusListener) { + return SoundTrigger.attachModuleAsMiddleman(moduleId, statusListener, null, + middlemanIdentity, originatorIdentity); + } + }); } class SoundTriggerServiceStub extends ISoundTriggerService.Stub {