From 0cfda55b95e842d7a90548de80292576bf5a0bd9 Mon Sep 17 00:00:00 2001 From: Robert Carr Date: Wed, 26 Jan 2022 10:49:18 -0800 Subject: [PATCH] DO NOT MERGE: SurfaceControlViewHost: Restrict disclosure of input token Currently we send the input (channel) token from the embedded view hierarchy to the remote embedding process via SurfacePackage. This is used to call grantEmbeddedWindowFocus. However this could also allow the host process to invoke updateInputChannel, which is not desirable. To fix this we rework updateInputChannel to work in terms of a focusGrantToken, which only carries this 1 capability. SurfacePackage is modified to not include the input token, but rather include this focus grant token. Bug: 215912712 Test: SurfaceControlViewHostTests Change-Id: Ie278f678f12f50c32f142a4260ff7d1c2a9ca57c (cherry picked from commit 501ee91b957eab6feb05832168573f51573efced) --- core/java/android/view/IWindowSession.aidl | 2 +- .../android/view/SurfaceControlViewHost.java | 2 +- .../android/view/WindowlessWindowManager.java | 12 +++++-- .../server/wm/EmbeddedWindowController.java | 33 +++++++++++++++++-- .../java/com/android/server/wm/Session.java | 4 +-- .../server/wm/WindowManagerService.java | 22 ++++++++----- 6 files changed, 57 insertions(+), 18 deletions(-) diff --git a/core/java/android/view/IWindowSession.aidl b/core/java/android/view/IWindowSession.aidl index 9da50889e43f9..46ee0f839fa90 100644 --- a/core/java/android/view/IWindowSession.aidl +++ b/core/java/android/view/IWindowSession.aidl @@ -306,7 +306,7 @@ interface IWindowSession { */ void grantInputChannel(int displayId, in SurfaceControl surface, in IWindow window, in IBinder hostInputToken, int flags, int privateFlags, int type, - out InputChannel outInputChannel); + in IBinder focusGrantToken, out InputChannel outInputChannel); /** * Update the flags on an input channel associated with a particular surface. diff --git a/core/java/android/view/SurfaceControlViewHost.java b/core/java/android/view/SurfaceControlViewHost.java index a6c5042db275b..a312939e65228 100644 --- a/core/java/android/view/SurfaceControlViewHost.java +++ b/core/java/android/view/SurfaceControlViewHost.java @@ -231,7 +231,7 @@ public class SurfaceControlViewHost { public @Nullable SurfacePackage getSurfacePackage() { if (mSurfaceControl != null && mAccessibilityEmbeddedConnection != null) { return new SurfacePackage(mSurfaceControl, mAccessibilityEmbeddedConnection, - mViewRoot.getInputToken()); + mWm.getFocusGrantToken()); } else { return null; } diff --git a/core/java/android/view/WindowlessWindowManager.java b/core/java/android/view/WindowlessWindowManager.java index ffb7efa672432..d5cf1a360b0f1 100644 --- a/core/java/android/view/WindowlessWindowManager.java +++ b/core/java/android/view/WindowlessWindowManager.java @@ -22,6 +22,7 @@ import android.graphics.PixelFormat; import android.graphics.Point; import android.graphics.Rect; import android.graphics.Region; +import android.os.Binder; import android.os.IBinder; import android.os.RemoteCallback; import android.os.RemoteException; @@ -75,6 +76,7 @@ public class WindowlessWindowManager implements IWindowSession { private final Configuration mConfiguration; private final IWindowSession mRealWm; private final IBinder mHostInputToken; + private final IBinder mFocusGrantToken = new Binder(); private int mForceHeight = -1; private int mForceWidth = -1; @@ -91,6 +93,10 @@ public class WindowlessWindowManager implements IWindowSession { mConfiguration.setTo(configuration); } + IBinder getFocusGrantToken() { + return mFocusGrantToken; + } + /** * Utility API. */ @@ -153,10 +159,10 @@ public class WindowlessWindowManager implements IWindowSession { mRealWm.grantInputChannel(displayId, new SurfaceControl(sc, "WindowlessWindowManager.addToDisplay"), window, mHostInputToken, attrs.flags, attrs.privateFlags, attrs.type, - outInputChannel); + mFocusGrantToken, outInputChannel); } else { mRealWm.grantInputChannel(displayId, sc, window, mHostInputToken, attrs.flags, - attrs.privateFlags, attrs.type, outInputChannel); + attrs.privateFlags, attrs.type, mFocusGrantToken, outInputChannel); } } catch (RemoteException e) { Log.e(TAG, "Failed to grant input to surface: ", e); @@ -464,7 +470,7 @@ public class WindowlessWindowManager implements IWindowSession { @Override public void grantInputChannel(int displayId, SurfaceControl surface, IWindow window, - IBinder hostInputToken, int flags, int privateFlags, int type, + IBinder hostInputToken, int flags, int privateFlags, int type, IBinder focusGrantToken, InputChannel outInputChannel) { } diff --git a/services/core/java/com/android/server/wm/EmbeddedWindowController.java b/services/core/java/com/android/server/wm/EmbeddedWindowController.java index fc317a1212d5b..a05769c0a48b8 100644 --- a/services/core/java/com/android/server/wm/EmbeddedWindowController.java +++ b/services/core/java/com/android/server/wm/EmbeddedWindowController.java @@ -41,6 +41,8 @@ class EmbeddedWindowController { private static final String TAG = TAG_WITH_CLASS_NAME ? "EmbeddedWindowController" : TAG_WM; /* maps input token to an embedded window */ private ArrayMap mWindows = new ArrayMap<>(); + private ArrayMap mWindowsByFocusToken = + new ArrayMap<>(); private final Object mGlobalLock; private final ActivityTaskManagerService mAtmService; @@ -59,10 +61,13 @@ class EmbeddedWindowController { void add(IBinder inputToken, EmbeddedWindow window) { try { mWindows.put(inputToken, window); + final IBinder focusToken = window.getFocusGrantToken(); + mWindowsByFocusToken.put(focusToken, window); updateProcessController(window); window.mClient.asBinder().linkToDeath(()-> { synchronized (mGlobalLock) { mWindows.remove(inputToken); + mWindowsByFocusToken.remove(focusToken); } }, 0); } catch (RemoteException e) { @@ -95,8 +100,10 @@ class EmbeddedWindowController { void remove(IWindow client) { for (int i = mWindows.size() - 1; i >= 0; i--) { - if (mWindows.valueAt(i).mClient.asBinder() == client.asBinder()) { + EmbeddedWindow ew = mWindows.valueAt(i); + if (ew.mClient.asBinder() == client.asBinder()) { mWindows.removeAt(i).onRemoved(); + mWindowsByFocusToken.remove(ew.getFocusGrantToken()); return; } } @@ -104,8 +111,10 @@ class EmbeddedWindowController { void onWindowRemoved(WindowState host) { for (int i = mWindows.size() - 1; i >= 0; i--) { - if (mWindows.valueAt(i).mHostWindowState == host) { + EmbeddedWindow ew = mWindows.valueAt(i); + if (ew.mHostWindowState == host) { mWindows.removeAt(i).onRemoved(); + mWindowsByFocusToken.remove(ew.getFocusGrantToken()); } } } @@ -114,6 +123,10 @@ class EmbeddedWindowController { return mWindows.get(inputToken); } + EmbeddedWindow getByFocusToken(IBinder focusGrantToken) { + return mWindowsByFocusToken.get(focusGrantToken); + } + void onActivityRemoved(ActivityRecord activityRecord) { for (int i = mWindows.size() - 1; i >= 0; i--) { final EmbeddedWindow window = mWindows.valueAt(i); @@ -139,6 +152,8 @@ class EmbeddedWindowController { InputChannel mInputChannel; final int mWindowType; + private IBinder mFocusGrantToken; + /** * @param session calling session to check ownership of the window * @param clientToken client token used to clean up the map if the embedding process dies @@ -153,7 +168,7 @@ class EmbeddedWindowController { */ EmbeddedWindow(Session session, WindowManagerService service, IWindow clientToken, WindowState hostWindowState, int ownerUid, int ownerPid, int windowType, - int displayId) { + int displayId, IBinder focusGrantToken) { mSession = session; mWmService = service; mClient = clientToken; @@ -164,6 +179,7 @@ class EmbeddedWindowController { mOwnerPid = ownerPid; mWindowType = windowType; mDisplayId = displayId; + mFocusGrantToken = focusGrantToken; } @Override @@ -216,5 +232,16 @@ class EmbeddedWindowController { public int getPid() { return mOwnerPid; } + + IBinder getFocusGrantToken() { + return mFocusGrantToken; + } + + IBinder getInputChannelToken() { + if (mInputChannel != null) { + return mInputChannel.getToken(); + } + return null; + } } } diff --git a/services/core/java/com/android/server/wm/Session.java b/services/core/java/com/android/server/wm/Session.java index d8adc512b65ac..deed514464dac 100644 --- a/services/core/java/com/android/server/wm/Session.java +++ b/services/core/java/com/android/server/wm/Session.java @@ -807,7 +807,7 @@ class Session extends IWindowSession.Stub implements IBinder.DeathRecipient { @Override public void grantInputChannel(int displayId, SurfaceControl surface, IWindow window, IBinder hostInputToken, int flags, int privateFlags, int type, - InputChannel outInputChannel) { + IBinder focusGrantToken, InputChannel outInputChannel) { if (hostInputToken == null && !mCanAddInternalSystemWindow) { // Callers without INTERNAL_SYSTEM_WINDOW permission cannot grant input channel to // embedded windows without providing a host window input token @@ -823,7 +823,7 @@ class Session extends IWindowSession.Stub implements IBinder.DeathRecipient { try { mService.grantInputChannel(this, mUid, mPid, displayId, surface, window, hostInputToken, flags, mCanAddInternalSystemWindow ? privateFlags : 0, - mCanAddInternalSystemWindow ? type : 0, outInputChannel); + mCanAddInternalSystemWindow ? type : 0, focusGrantToken, outInputChannel); } finally { Binder.restoreCallingIdentity(identity); } diff --git a/services/core/java/com/android/server/wm/WindowManagerService.java b/services/core/java/com/android/server/wm/WindowManagerService.java index 8839fbac26a10..237b2d741c3ea 100644 --- a/services/core/java/com/android/server/wm/WindowManagerService.java +++ b/services/core/java/com/android/server/wm/WindowManagerService.java @@ -8374,7 +8374,8 @@ public class WindowManagerService extends IWindowManager.Stub */ void grantInputChannel(Session session, int callingUid, int callingPid, int displayId, SurfaceControl surface, IWindow window, IBinder hostInputToken, - int flags, int privateFlags, int type, InputChannel outInputChannel) { + int flags, int privateFlags, int type, IBinder focusGrantToken, + InputChannel outInputChannel) { final InputApplicationHandle applicationHandle; final String name; final InputChannel clientChannel; @@ -8382,7 +8383,7 @@ public class WindowManagerService extends IWindowManager.Stub EmbeddedWindowController.EmbeddedWindow win = new EmbeddedWindowController.EmbeddedWindow(session, this, window, mInputToWindowMap.get(hostInputToken), callingUid, callingPid, type, - displayId); + displayId, focusGrantToken); clientChannel = win.openInputChannel(); mEmbeddedWindowController.add(clientChannel.getToken(), win); applicationHandle = win.getApplicationHandle(); @@ -8602,10 +8603,10 @@ public class WindowManagerService extends IWindowManager.Stub } } - void grantEmbeddedWindowFocus(Session session, IBinder inputToken, boolean grantFocus) { + void grantEmbeddedWindowFocus(Session session, IBinder focusToken, boolean grantFocus) { synchronized (mGlobalLock) { final EmbeddedWindowController.EmbeddedWindow embeddedWindow = - mEmbeddedWindowController.get(inputToken); + mEmbeddedWindowController.getByFocusToken(focusToken); if (embeddedWindow == null) { Slog.e(TAG, "Embedded window not found"); return; @@ -8614,6 +8615,11 @@ public class WindowManagerService extends IWindowManager.Stub Slog.e(TAG, "Window not in session:" + session); return; } + IBinder inputToken = embeddedWindow.getInputChannelToken(); + if (inputToken == null) { + Slog.e(TAG, "Focus token found but input channel token not found"); + return; + } SurfaceControl.Transaction t = mTransactionFactory.get(); final int displayId = embeddedWindow.mDisplayId; if (grantFocus) { @@ -8643,7 +8649,7 @@ public class WindowManagerService extends IWindowManager.Stub } } - void grantEmbeddedWindowFocus(Session session, IWindow callingWindow, IBinder targetInputToken, + void grantEmbeddedWindowFocus(Session session, IWindow callingWindow, IBinder targetFocusToken, boolean grantFocus) { synchronized (mGlobalLock) { final WindowState hostWindow = @@ -8657,7 +8663,7 @@ public class WindowManagerService extends IWindowManager.Stub return; } final EmbeddedWindowController.EmbeddedWindow embeddedWindow = - mEmbeddedWindowController.get(targetInputToken); + mEmbeddedWindowController.getByFocusToken(targetFocusToken); if (embeddedWindow == null) { Slog.e(TAG, "Embedded window not found"); return; @@ -8668,7 +8674,7 @@ public class WindowManagerService extends IWindowManager.Stub } SurfaceControl.Transaction t = mTransactionFactory.get(); if (grantFocus) { - t.requestFocusTransfer(targetInputToken, embeddedWindow.toString(), + t.requestFocusTransfer(embeddedWindow.getInputChannelToken(), embeddedWindow.toString(), hostWindow.mInputChannel.getToken(), hostWindow.getName(), hostWindow.getDisplayId()).apply(); @@ -8677,7 +8683,7 @@ public class WindowManagerService extends IWindowManager.Stub "reason=grantEmbeddedWindowFocus(true)"); } else { t.requestFocusTransfer(hostWindow.mInputChannel.getToken(), hostWindow.getName(), - targetInputToken, + embeddedWindow.getInputChannelToken(), embeddedWindow.toString(), hostWindow.getDisplayId()).apply(); EventLog.writeEvent(LOGTAG_INPUT_FOCUS,