From 61c4f64f1bb9bc175a92677aa14d510fe62f2ae3 Mon Sep 17 00:00:00 2001 From: Winson Date: Fri, 5 Mar 2021 14:03:12 -0800 Subject: [PATCH 1/3] Use correct parentUserId when using cross profile domain verification The targetUserId is actually incorrect. It's marks the user ID it's being launched for, which is the source, not the parent which the Intent is trying to cross into. Bug: 174688153 Test: manual, debug linked issue Change-Id: If822996238f73c6f47fcec239c2c9880925d0afc --- .../core/java/com/android/server/pm/PackageManagerService.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index 7da53b50d9276..727f49ed3ebe6 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -2822,7 +2822,7 @@ public class PackageManagerService extends IPackageManager.Stub result.highestApprovalLevel = Math.max(mDomainVerificationManager .approvalLevelForDomain(ps, intent, resultTargetUser, flags, - riTargetUser.targetUserId), result.highestApprovalLevel); + parentUserId), result.highestApprovalLevel); } if (result != null && result.highestApprovalLevel <= DomainVerificationManagerInternal.APPROVAL_LEVEL_NONE) { From 283c3a37ae2a9f6290f1fe09eeae808fe99f8f43 Mon Sep 17 00:00:00 2001 From: Winson Date: Fri, 5 Mar 2021 14:28:16 -0800 Subject: [PATCH 2/3] Only allow forwarding of Intents that MATCH_DEFAULT_ONLY When IntentForwarderActivity is launched by PMS in response to a web URI, the only way it can pass domain verification is by declaring the DEFAULT category. Either explicitly or implicitly through MATCH_DEFAULT_ONLY added by startActivity. This makes the PackageManager API that checks if the Intent forwarding is allowed mirror the web Intent validation so that only DEFAULT marked Intents can be forwarded. Bug: 174688153 Test: manual, debug linked bug Change-Id: Ia87bf657067f2c5c691a07b1e5de35b9f476fde0 --- .../core/java/com/android/server/pm/PackageManagerService.java | 1 + 1 file changed, 1 insertion(+) diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index 727f49ed3ebe6..3eb3e11149d4c 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -9991,6 +9991,7 @@ public class PackageManagerService extends IPackageManager.Stub false /*includeInstantApps*/, isImplicitImageCaptureIntentAndNotSetByDpcLocked(intent, parent.id, resolvedType, 0)); + flags |= PackageManager.MATCH_DEFAULT_ONLY; CrossProfileDomainInfo xpDomainInfo = getCrossProfileDomainPreferredLpr( intent, resolvedType, flags, sourceUserId, parent.id); return xpDomainInfo != null; From d6598b5e7d65df0bb360ce64ab6f5f47f0821870 Mon Sep 17 00:00:00 2001 From: Winson Date: Mon, 8 Mar 2021 10:26:44 -0800 Subject: [PATCH 3/3] Include current profile browsers when resolving cross profile The resolution logic relies on these being added in order to redirect to ResolverActivity. Then it can use the presence of browsers/absence of apps to determine when to show the new UI. Bug: 174688153 Test: manual, launch work profile intent for personal profile app Change-Id: I60fdb0506d9b1d8068e4f7592b3f5cf5907d92ad --- .../java/com/android/server/pm/PackageManagerService.java | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index 3eb3e11149d4c..2333b19686881 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -2654,13 +2654,10 @@ public class PackageManagerService extends IPackageManager.Stub // If no apps are approved for the domain, resolve only to browsers if (approvedInfos.isEmpty()) { - // If the other profile has a result, include that and delegate to - // ResolveActivity + includeBrowser = true; if (xpDomainInfo != null && xpDomainInfo.highestApprovalLevel > DomainVerificationManagerInternal.APPROVAL_LEVEL_NONE) { result.add(xpDomainInfo.resolveInfo); - } else { - includeBrowser = true; } } else { result.addAll(approvedInfos);