From a84612483f2fce702ed8272320d5cff576e65e6f Mon Sep 17 00:00:00 2001 From: Vishnu Nair Date: Wed, 26 Jan 2022 23:25:07 +0000 Subject: [PATCH 1/2] SurfaceControl: Add setDropInputMode api Introduces an API to drop input events on this SurfaceControl. This policy will be inherited by its children. The caller must hold the ACCESS_SURFACE_FLINGER permission. Options include: ALL: SurfaceControl and its children will not receive any input regardless of whether it has a valid input channel. These policies are used to enable features that allow for a less trusted interaction model between apps. See the bug for more details. Note: this backport doesn't include the oclude mode since its not needed for the security fix. Test: atest libgui_test InputDispatcherDropInputFeatureTest Bug: 197296414 Merged-In: Ifcb4133306a43874e74e8fb0f42b60842daf6f25 Change-Id: Ifcb4133306a43874e74e8fb0f42b60842daf6f25 --- Android.bp | 1 + core/java/android/view/SurfaceControl.java | 15 ++++++++++++++- core/jni/android_view_SurfaceControl.cpp | 9 +++++++++ 3 files changed, 24 insertions(+), 1 deletion(-) diff --git a/Android.bp b/Android.bp index 3af2f07884e50..3f7581cf17c60 100644 --- a/Android.bp +++ b/Android.bp @@ -113,6 +113,7 @@ filegroup { ":gatekeeper_aidl", ":gsiservice_aidl", ":idmap2_aidl", + ":guiconstants_aidl", ":idmap2_core_aidl", ":incidentcompanion_aidl", ":inputconstants_aidl", diff --git a/core/java/android/view/SurfaceControl.java b/core/java/android/view/SurfaceControl.java index 8143cf953f19b..4dc9807aca5d0 100644 --- a/core/java/android/view/SurfaceControl.java +++ b/core/java/android/view/SurfaceControl.java @@ -41,6 +41,7 @@ import android.graphics.PixelFormat; import android.graphics.Point; import android.graphics.Rect; import android.graphics.Region; +import android.gui.DropInputMode; import android.hardware.HardwareBuffer; import android.hardware.display.DeviceProductInfo; import android.hardware.display.DisplayedContentSample; @@ -150,7 +151,8 @@ public final class SurfaceControl implements Parcelable { float childRelativeTop, float childRelativeRight, float childRelativeBottom); private static native void nativeSetTrustedOverlay(long transactionObj, long nativeObject, boolean isTrustedOverlay); - + private static native void nativeSetDropInputMode( + long transactionObj, long nativeObject, int flags); private static native boolean nativeClearContentFrameStats(long nativeObject); private static native boolean nativeGetContentFrameStats(long nativeObject, WindowContentFrameStats outStats); private static native boolean nativeClearAnimationFrameStats(); @@ -3426,6 +3428,17 @@ public final class SurfaceControl implements Parcelable { return this; } + /** + * Sets the input event drop mode on this SurfaceControl and its children. The caller must + * hold the ACCESS_SURFACE_FLINGER permission. See {@code InputEventDropMode}. + * @hide + */ + public Transaction setDropInputMode(SurfaceControl sc, @DropInputMode int mode) { + checkPreconditions(sc); + nativeSetDropInputMode(mNativeObject, sc.mNativeObject, mode); + return this; + } + /** * Merge the other transaction into this transaction, clearing the * other transaction as if it had been applied. diff --git a/core/jni/android_view_SurfaceControl.cpp b/core/jni/android_view_SurfaceControl.cpp index 8d12df226ffe3..7f99e2998b13d 100644 --- a/core/jni/android_view_SurfaceControl.cpp +++ b/core/jni/android_view_SurfaceControl.cpp @@ -868,6 +868,13 @@ static void nativeSetFixedTransformHint(JNIEnv* env, jclass clazz, jlong transac transaction->setFixedTransformHint(ctrl, transformHint); } +static void nativeSetDropInputMode(JNIEnv* env, jclass clazz, jlong transactionObj, + jlong nativeObject, jint mode) { + auto transaction = reinterpret_cast(transactionObj); + SurfaceControl* const ctrl = reinterpret_cast(nativeObject); + transaction->setDropInputMode(ctrl, static_cast(mode)); +} + static jlongArray nativeGetPhysicalDisplayIds(JNIEnv* env, jclass clazz) { const auto displayIds = SurfaceComposerClient::getPhysicalDisplayIds(); jlongArray array = env->NewLongArray(displayIds.size()); @@ -1994,6 +2001,8 @@ static const JNINativeMethod sSurfaceControlMethods[] = { (void*)nativeGetTransformHint }, {"nativeSetTrustedOverlay", "(JJZ)V", (void*)nativeSetTrustedOverlay }, + {"nativeSetDropInputMode", "(JJI)V", + (void*)nativeSetDropInputMode}, // clang-format on }; From 6ac8376cd79ff485dd5531fca3dff2b093c5ea15 Mon Sep 17 00:00:00 2001 From: Vishnu Nair Date: Thu, 27 Jan 2022 23:29:32 +0000 Subject: [PATCH 2/2] Drop input for toast and child surfaces Toasts that do not have the trustedOverlay flag should not receive input. These windows should not have any children, so force this hierarchy of windows to drop all input by setting a flag on the toast window state which will apply the DROP_INPUT flag on all windows with an input channel. This is to prevent malicious apps from parenting surfaces with input channels to the toast window. Test: show toast and check if input feature flag DROP_INPUT id set via dumpsys Bug: b/197296414 Merged-In: I316b76b685ca5030fd8aa91283555efcce4d6994 Change-Id: I316b76b685ca5030fd8aa91283555efcce4d6994 --- .../java/com/android/server/wm/DisplayPolicy.java | 15 +++++++++++++++ .../android/server/wm/WindowManagerService.java | 1 + 2 files changed, 16 insertions(+) diff --git a/services/core/java/com/android/server/wm/DisplayPolicy.java b/services/core/java/com/android/server/wm/DisplayPolicy.java index 73d31bf7e0c80..1eb7281d37ed3 100644 --- a/services/core/java/com/android/server/wm/DisplayPolicy.java +++ b/services/core/java/com/android/server/wm/DisplayPolicy.java @@ -124,6 +124,7 @@ import android.graphics.Insets; import android.graphics.PixelFormat; import android.graphics.Rect; import android.graphics.Region; +import android.gui.DropInputMode; import android.hardware.power.Boost; import android.os.Handler; import android.os.IBinder; @@ -927,6 +928,20 @@ public class DisplayPolicy { } } + /** + * Add additional policy if needed to ensure the window or its children should not receive any + * input. + */ + public void setDropInputModePolicy(WindowState win, LayoutParams attrs) { + if (attrs.type == TYPE_TOAST + && (attrs.privateFlags & PRIVATE_FLAG_TRUSTED_OVERLAY) == 0) { + // Toasts should not receive input. These windows should not have any children, so + // force this hierarchy of windows to drop all input. + mService.mTransactionFactory.get() + .setDropInputMode(win.getSurfaceControl(), DropInputMode.ALL).apply(); + } + } + /** * Check if a window can be added to the system. * diff --git a/services/core/java/com/android/server/wm/WindowManagerService.java b/services/core/java/com/android/server/wm/WindowManagerService.java index 4281568b44d99..fac953910e927 100644 --- a/services/core/java/com/android/server/wm/WindowManagerService.java +++ b/services/core/java/com/android/server/wm/WindowManagerService.java @@ -1780,6 +1780,7 @@ public class WindowManagerService extends IWindowManager.Stub win.mToken.addWindow(win); displayPolicy.addWindowLw(win, attrs); + displayPolicy.setDropInputModePolicy(win, win.mAttrs); if (type == TYPE_INPUT_METHOD) { displayContent.setInputMethodWindowLocked(win); imMayMove = false;