From 61164db786006d10f84a9a905ce7a3051561e6e8 Mon Sep 17 00:00:00 2001
From: Kevin Rocard <krocard@google.com>
Date: Fri, 17 May 2019 16:58:22 -0700
Subject: [PATCH] Fix permission check when registering an audio policy

The current checks were allowing public apps to register an audio policy
with an APC mix as intended, but the policy could also have focus
listener and volume controller which are not intended to be used by
public apps.

Test: atest android.media.cts.AudioPlaybackCaptureTest
Bug: 129948989
Change-Id: I97d41ed08faff05e59ae6b495ee62ae11f4a09c1
---
 .../com/android/server/audio/AudioService.java     | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/services/core/java/com/android/server/audio/AudioService.java b/services/core/java/com/android/server/audio/AudioService.java
index 20b0deb930e6e..2631c23da8e1e 100644
--- a/services/core/java/com/android/server/audio/AudioService.java
+++ b/services/core/java/com/android/server/audio/AudioService.java
@@ -6698,7 +6698,10 @@ public class AudioService extends IAudioService.Stub
             boolean isVolumeController, IMediaProjection projection) {
         AudioSystem.setDynamicPolicyCallback(mDynPolicyCallback);
 
-        if (!isPolicyRegisterAllowed(policyConfig, projection)) {
+        if (!isPolicyRegisterAllowed(policyConfig,
+                                     isFocusPolicy || isTestFocusPolicy || hasFocusListener,
+                                     isVolumeController,
+                                     projection)) {
             Slog.w(TAG, "Permission denied to register audio policy for pid "
                     + Binder.getCallingPid() + " / uid " + Binder.getCallingUid()
                     + ", need MODIFY_AUDIO_ROUTING or MediaProjection that can project audio");
@@ -6739,13 +6742,18 @@ public class AudioService extends IAudioService.Stub
      * as those policy do not modify the audio routing.
      */
     private boolean isPolicyRegisterAllowed(AudioPolicyConfig policyConfig,
-             IMediaProjection projection) {
+                                            boolean hasFocusAccess,
+                                            boolean isVolumeController,
+                                            IMediaProjection projection) {
 
         boolean requireValidProjection = false;
         boolean requireCaptureAudioOrMediaOutputPerm = false;
         boolean requireModifyRouting = false;
 
-        if (policyConfig.getMixes().isEmpty()) {
+        if (hasFocusAccess || isVolumeController) {
+            requireModifyRouting |= true;
+        } else if (policyConfig.getMixes().isEmpty()) {
+            // An empty policy could be used to lock the focus or add mixes later
             requireModifyRouting |= true;
         }
         for (AudioMix mix : policyConfig.getMixes()) {