From be7785a5556fa1f047c860f6d26d7b7779ae4308 Mon Sep 17 00:00:00 2001 From: Robin Lee Date: Thu, 24 Nov 2022 13:04:44 +0000 Subject: [PATCH] Prevent BAL from Wallpaper Picker Background activity launch logic won't use pending intent creator foreground state as long as the ActivityOptions have been set up to prevent that. This stops an app from registering itself as the handler for ACTION_SET_WALLPAPER and sending a request to launch itself indirectly into the foreground. Change-Id: I4dbaee9cd85aa53d5d2aaf2e8b0734de13c1dafd Test: BALBypassViaWallpaperChooser Bug: 257953844 --- .../wallpaper/WallpaperManagerService.java | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java b/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java index 5d084616bfea2..4480d521323e7 100644 --- a/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java +++ b/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java @@ -34,6 +34,7 @@ import static android.view.WindowManager.LayoutParams.TYPE_WALLPAPER; import android.annotation.NonNull; import android.app.ActivityManager; +import android.app.ActivityOptions; import android.app.AppGlobals; import android.app.AppOpsManager; import android.app.ILocalWallpaperColorConsumer; @@ -3166,6 +3167,15 @@ public class WallpaperManagerService extends IWallpaperManager.Stub } } + final ActivityOptions clientOptions = ActivityOptions.makeBasic(); + clientOptions.setIgnorePendingIntentCreatorForegroundState(true); + PendingIntent clientIntent = PendingIntent.getActivityAsUser( + mContext, 0, Intent.createChooser( + new Intent(Intent.ACTION_SET_WALLPAPER), + mContext.getText(com.android.internal.R.string.chooser_wallpaper)), + PendingIntent.FLAG_IMMUTABLE, clientOptions.toBundle(), + UserHandle.of(serviceUserId)); + // Bind the service! if (DEBUG) Slog.v(TAG, "Binding to:" + componentName); final int componentUid = mIPackageManager.getPackageUid(componentName.getPackageName(), @@ -3174,11 +3184,7 @@ public class WallpaperManagerService extends IWallpaperManager.Stub intent.setComponent(componentName); intent.putExtra(Intent.EXTRA_CLIENT_LABEL, com.android.internal.R.string.wallpaper_binding_label); - intent.putExtra(Intent.EXTRA_CLIENT_INTENT, PendingIntent.getActivityAsUser( - mContext, 0, - Intent.createChooser(new Intent(Intent.ACTION_SET_WALLPAPER), - mContext.getText(com.android.internal.R.string.chooser_wallpaper)), - PendingIntent.FLAG_IMMUTABLE, null, new UserHandle(serviceUserId))); + intent.putExtra(Intent.EXTRA_CLIENT_INTENT, clientIntent); if (!mContext.bindServiceAsUser(intent, newConn, Context.BIND_AUTO_CREATE | Context.BIND_SHOWING_UI | Context.BIND_FOREGROUND_SERVICE_WHILE_AWAKE