From 745e31e1be11d0b2f005590c4d448a8cb9bfbe35 Mon Sep 17 00:00:00 2001 From: Manjeet Rulhania Date: Thu, 30 Jun 2022 16:36:51 +0000 Subject: [PATCH 1/6] Remove package name from SafetyNet logs Bug: 213323615 Test: AppSecurityTests Change-Id: I4b61d13256ce0bfb8fc9d21db52ee78ce2097f14 (cherry picked from commit 45b23196772a4fe8875f2ca6514208fe368c2cd5) Merged-In: I4b61d13256ce0bfb8fc9d21db52ee78ce2097f14 --- .../android/server/pm/pkg/component/ParsedPermissionUtils.java | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java b/services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java index 281e1bd2824d1..1366de77af8b8 100644 --- a/services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java +++ b/services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java @@ -313,8 +313,7 @@ public class ParsedPermissionUtils { final ParsedPermission perm = checkDuplicatePerm.get(name); if (isMalformedDuplicate(parsedPermission, perm)) { // Fix for b/213323615 - EventLog.writeEvent(0x534e4554, "213323615", - "The package " + pkg.getPackageName() + " seems malicious"); + EventLog.writeEvent(0x534e4554, "213323615"); return true; } checkDuplicatePerm.put(name, parsedPermission); From 86feb702daa2e8748632754a070cbf8473c4c070 Mon Sep 17 00:00:00 2001 From: Yu-Han Yang Date: Wed, 13 Jul 2022 00:11:13 +0000 Subject: [PATCH 2/6] Correct the range of issueOfDataEphemeris as [0, 1023] Bug: 239083503 Test: atest SatellitePvtTest Change-Id: I017b4e83a6af61c7827c9135176953809b139bb7 Merged-In: I017b4e83a6af61c7827c9135176953809b139bb7 (cherry picked from commit 70f5d083ce832841c1b646a8c8a82e73f5d2d481) Merged-In: I017b4e83a6af61c7827c9135176953809b139bb7 --- core/api/system-current.txt | 4 ++-- location/java/android/location/SatellitePvt.java | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/core/api/system-current.txt b/core/api/system-current.txt index ec4ad8b704c32..0126199add0c2 100644 --- a/core/api/system-current.txt +++ b/core/api/system-current.txt @@ -5956,7 +5956,7 @@ package android.location { method public int getEphemerisSource(); method @FloatRange public double getIonoDelayMeters(); method @IntRange(from=0, to=1023) public int getIssueOfDataClock(); - method @IntRange(from=0, to=255) public int getIssueOfDataEphemeris(); + method @IntRange(from=0, to=1023) public int getIssueOfDataEphemeris(); method @Nullable public android.location.SatellitePvt.PositionEcef getPositionEcef(); method @IntRange(from=0) public long getTimeOfClockSeconds(); method @IntRange(from=0) public long getTimeOfEphemerisSeconds(); @@ -5984,7 +5984,7 @@ package android.location { method @NonNull public android.location.SatellitePvt.Builder setEphemerisSource(int); method @NonNull public android.location.SatellitePvt.Builder setIonoDelayMeters(@FloatRange(from=0.0f, to=100.0f) double); method @NonNull public android.location.SatellitePvt.Builder setIssueOfDataClock(@IntRange(from=0, to=1023) int); - method @NonNull public android.location.SatellitePvt.Builder setIssueOfDataEphemeris(@IntRange(from=0, to=255) int); + method @NonNull public android.location.SatellitePvt.Builder setIssueOfDataEphemeris(@IntRange(from=0, to=1023) int); method @NonNull public android.location.SatellitePvt.Builder setPositionEcef(@NonNull android.location.SatellitePvt.PositionEcef); method @NonNull public android.location.SatellitePvt.Builder setTimeOfClockSeconds(@IntRange(from=0) long); method @NonNull public android.location.SatellitePvt.Builder setTimeOfEphemerisSeconds(@IntRange(from=0) long); diff --git a/location/java/android/location/SatellitePvt.java b/location/java/android/location/SatellitePvt.java index f3e15084d7303..2031929514f3f 100644 --- a/location/java/android/location/SatellitePvt.java +++ b/location/java/android/location/SatellitePvt.java @@ -539,7 +539,7 @@ public final class SatellitePvt implements Parcelable { * *

This field is valid if {@link #hasIssueOfDataEphemeris()} is true. */ - @IntRange(from = 0, to = 255) + @IntRange(from = 0, to = 1023) public int getIssueOfDataEphemeris() { return mIssueOfDataEphemeris; } @@ -847,8 +847,8 @@ public final class SatellitePvt implements Parcelable { */ @NonNull public Builder setIssueOfDataEphemeris( - @IntRange(from = 0, to = 255) int issueOfDataEphemeris) { - Preconditions.checkArgumentInRange(issueOfDataEphemeris, 0, 255, + @IntRange(from = 0, to = 1023) int issueOfDataEphemeris) { + Preconditions.checkArgumentInRange(issueOfDataEphemeris, 0, 1023, "issueOfDataEphemeris"); mIssueOfDataEphemeris = issueOfDataEphemeris; mFlags = (byte) (mFlags | HAS_ISSUE_OF_DATA_EPHEMERIS); From f3097ad6d536a0f96b0246711de5353cc660c57c Mon Sep 17 00:00:00 2001 From: Steve Elliott Date: Fri, 24 Jun 2022 11:01:49 -0400 Subject: [PATCH 3/6] Fix stale NSSL "fling" state caused by no-op fling If a fling gesture ends with the current Y position in the exact end position for the fling, then the code to run the fling animation is bypassed, but the flag in AmbientState tracking whether a fling is active is never reset. This CL replaces the short circuit logic with the standard fling-end logic, ensuring that all expected code paths are executed. Fixes: 234824085 Fixes: 237272856 Test: manual 1. Enter lockscreen 2. Swipe up and then down to the exact same position, in one continuous gesture 3. Wait for a notification update Observe: Shade resizes correctly to match the new contents Change-Id: Ie8ddf1dbaaf1ba607657646db05d3eb622fc9415 Merged-In: Ie8ddf1dbaaf1ba607657646db05d3eb622fc9415 (cherry picked from commit 7f387f9ae92490d7ab196eb2274019b543b8ab88) (cherry picked from commit 28dc43e6a7698f4e6ace7718ce71a2d7a5b8bec4) Merged-In: Ie8ddf1dbaaf1ba607657646db05d3eb622fc9415 --- .../statusbar/phone/PanelViewController.java | 4 +--- .../NotificationPanelViewControllerTest.java | 15 +++++++++++++++ 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/packages/SystemUI/src/com/android/systemui/statusbar/phone/PanelViewController.java b/packages/SystemUI/src/com/android/systemui/statusbar/phone/PanelViewController.java index 82ca842d48c9a..5d417e0b59e24 100644 --- a/packages/SystemUI/src/com/android/systemui/statusbar/phone/PanelViewController.java +++ b/packages/SystemUI/src/com/android/systemui/statusbar/phone/PanelViewController.java @@ -599,9 +599,7 @@ public abstract class PanelViewController { float collapseSpeedUpFactor, boolean expandBecauseOfFalsing) { if (target == mExpandedHeight && mOverExpansion == 0.0f) { // We're at the target and didn't fling and there's no overshoot - endJankMonitoring(CUJ_NOTIFICATION_SHADE_EXPAND_COLLAPSE); - mKeyguardStateController.notifyPanelFlingEnd(); - notifyExpandingFinished(); + onFlingEnd(false /* cancelled */); return; } mIsFlinging = true; diff --git a/packages/SystemUI/tests/src/com/android/systemui/statusbar/phone/NotificationPanelViewControllerTest.java b/packages/SystemUI/tests/src/com/android/systemui/statusbar/phone/NotificationPanelViewControllerTest.java index d47644f047a29..8900d8ff9fdac 100644 --- a/packages/SystemUI/tests/src/com/android/systemui/statusbar/phone/NotificationPanelViewControllerTest.java +++ b/packages/SystemUI/tests/src/com/android/systemui/statusbar/phone/NotificationPanelViewControllerTest.java @@ -985,6 +985,21 @@ public class NotificationPanelViewControllerTest extends SysuiTestCase { verify(mKeyguardStateController).notifyPanelFlingEnd(); } + @Test + public void testSwipe_exactlyToTarget_notifiesNssl() { + // No over-expansion + mNotificationPanelViewController.setOverExpansion(0f); + // Fling to a target that is equal to the current position (i.e. a no-op fling). + mNotificationPanelViewController.flingToHeight( + 0f, + true, + mNotificationPanelViewController.mExpandedHeight, + 1f, + false); + // Verify that the NSSL is notified that the panel is *not* flinging. + verify(mNotificationStackScrollLayoutController).setPanelFlinging(false); + } + @Test public void testDoubleTapRequired_Keyguard() { FalsingManager.FalsingTapListener listener = getFalsingTapListener(); From 3e0e8128d5667be6d739dda8730d5a6f5483b3ef Mon Sep 17 00:00:00 2001 From: John Wu Date: Thu, 14 Jul 2022 21:55:23 +0000 Subject: [PATCH 4/6] Ignore sharedUserId when package already left shared UID After a package has left shared UID, its non-shared UID state should be preserved after the next scan (e.g. reboot or an APK upgrade), or else the app would observe data loss. Bug: 235460457 Test: atest CtsSharedUserMigrationTestCases Change-Id: I692fe3ff59b43f2fc0ee53de0ce8a2f38cd29f02 (cherry picked from commit 84ba40de12dac4efa6b90197e910dcdf432009f5) Merged-In: I692fe3ff59b43f2fc0ee53de0ce8a2f38cd29f02 --- .../java/com/android/server/pm/InstallPackageHelper.java | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/services/core/java/com/android/server/pm/InstallPackageHelper.java b/services/core/java/com/android/server/pm/InstallPackageHelper.java index e90a5db39d71f..7da5f51bcbc28 100644 --- a/services/core/java/com/android/server/pm/InstallPackageHelper.java +++ b/services/core/java/com/android/server/pm/InstallPackageHelper.java @@ -3701,8 +3701,9 @@ final class InstallPackageHelper { parsedPackage.getPackageName()); boolean ignoreSharedUserId = false; - if (installedPkgSetting == null) { - // We can directly ignore sharedUserSetting for new installs + if (installedPkgSetting == null || !installedPkgSetting.hasSharedUser()) { + // Directly ignore sharedUserSetting for new installs, or if the app has + // already left shared UID ignoreSharedUserId = parsedPackage.isLeavingSharedUid(); } From 07a5b5962779c4e8974c30c600427732b7799381 Mon Sep 17 00:00:00 2001 From: Nikita Ioffe Date: Wed, 6 Jul 2022 03:27:03 +0100 Subject: [PATCH 5/6] Fix the visibility check for sdk_sandbox processes For some cases (e.g. WebView), the visibility is implicitly granted to the calling uid. Right now the visibility rules for sdk sandbox uids only take into account the forceQueryable apks, which means that WebView will never be visible to sdk sandbox uids. This change adds the implicitly queryable apps to the app visibility check for the sdk sandbox uids. Test: run SdkSandboxClientWebView Test: atest CtsSdkSandboxInprocessTests Test: atest AppsFilterImplTest Bug: 238871061 Merged-In: Icfeb8e48151e1675d7b85c9714238f4a499ec6ea Change-Id: Icfeb8e48151e1675d7b85c9714238f4a499ec6ea (cherry picked from commit 5a1cba22d1e6a4cc9fd549ef1f9216f38bfdc601) (cherry picked from commit a9d522f43ce64f66de149ec3b9cf43aa2bf9dfc8) Merged-In: Icfeb8e48151e1675d7b85c9714238f4a499ec6ea --- .../com/android/server/pm/AppsFilterBase.java | 3 +- .../android/server/pm/AppsFilterImplTest.java | 33 +++++++++++++++++++ 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/services/core/java/com/android/server/pm/AppsFilterBase.java b/services/core/java/com/android/server/pm/AppsFilterBase.java index 7ca1978b2031a..5de7674a74226 100644 --- a/services/core/java/com/android/server/pm/AppsFilterBase.java +++ b/services/core/java/com/android/server/pm/AppsFilterBase.java @@ -323,7 +323,8 @@ public abstract class AppsFilterBase implements AppsFilterSnapshot { return false; } else if (Process.isSdkSandboxUid(callingAppId)) { // we only allow sdk sandbox processes access to forcequeryable packages - return !isForceQueryable(targetPkgSetting.getAppId()); + return !isForceQueryable(targetPkgSetting.getAppId()) + && !isImplicitlyQueryable(callingAppId, targetPkgSetting.getAppId()); } if (mCacheReady) { // use cache if (!shouldFilterApplicationUsingCache(callingUid, diff --git a/services/tests/servicestests/src/com/android/server/pm/AppsFilterImplTest.java b/services/tests/servicestests/src/com/android/server/pm/AppsFilterImplTest.java index facbe80bde678..92443c51b37da 100644 --- a/services/tests/servicestests/src/com/android/server/pm/AppsFilterImplTest.java +++ b/services/tests/servicestests/src/com/android/server/pm/AppsFilterImplTest.java @@ -1376,6 +1376,39 @@ public class AppsFilterImplTest { null /* callingSetting */, target, SYSTEM_USER)); } + @Test + public void testSdkSandbox_implicitAccessGranted_canSeePackage() throws Exception { + final AppsFilterImpl appsFilter = + new AppsFilterImpl(mFeatureConfigMock, new String[]{}, false, null, + mMockHandler); + final WatchableTester watcher = new WatchableTester(appsFilter, "onChange"); + watcher.register(); + simulateAddBasicAndroid(appsFilter); + watcher.verifyChangeReported("addBasic"); + appsFilter.onSystemReady(mPmInternal); + watcher.verifyChangeReported("systemReady"); + + PackageSetting target = simulateAddPackage(appsFilter, + pkg("com.some.package"), DUMMY_TARGET_APPID, + setting -> setting.setPkgFlags(ApplicationInfo.FLAG_SYSTEM)); + + int callingUid = 20123; + assertTrue(Process.isSdkSandboxUid(callingUid)); + + // Without granting the implicit access the app shouldn't be visible to the sdk sandbox uid. + assertTrue( + appsFilter.shouldFilterApplication(mSnapshot, callingUid, + null /* callingSetting */, target, SYSTEM_USER)); + + appsFilter.grantImplicitAccess(callingUid, target.getAppId(), false /* retainOnUpdate */); + watcher.verifyChangeReported("grantImplicitAccess"); + + // After implicit access was granted the app should be visible to the sdk sandbox uid. + assertFalse( + appsFilter.shouldFilterApplication(mSnapshot, callingUid, + null /* callingSetting */, target, SYSTEM_USER)); + } + private List toList(int[] array) { ArrayList ret = new ArrayList<>(array.length); for (int i = 0; i < array.length; i++) { From 9c2b2c7b2ca2d1eebea485d453460f3b7f9ccf68 Mon Sep 17 00:00:00 2001 From: Pinyao Ting Date: Wed, 29 Jun 2022 17:05:23 -0700 Subject: [PATCH 6/6] Fix AppPrediction/Smartspace leak AppPrediction and Smartspace session info are associated with two types of Binder objects: one maps to the client object (i.e. AppPredictor/SmartspaceSession) that represents the session itself, the other one maps to the callback functions that handles incoming update at the client side. The death recipient of the former performs the clean-up which removes the session info object from system process followed by calling a destroy on the session info object, while the other one simply calls destroy. Unfortunately upon destroy of the session info object, we unlink the former from its death recipient, which means if the callback function objects died before the session object in the client process, the death recipient is unlinked, therefore the clean-up will not be performed. Both the callback function object and the session info object lives in the same process, when the process dies, both object dies, so there's no reason to having cleanup logic in both places. This CL removes the death recipient associated with the callback in favor of the one associated with the session since the later provides more coverage, e.g. in case the process died before it start listening to prediction updates. Bug: 230696939 Test: manual Change-Id: I27641d347c2b436eaafba306842854a97a440f7a (cherry picked from commit f9ba3f64c07fd5fc6b93523e78751dbe26a93400) Merged-In: I27641d347c2b436eaafba306842854a97a440f7a --- .../appprediction/AppPredictionPerUserService.java | 13 +------------ .../server/smartspace/SmartspacePerUserService.java | 13 +------------ 2 files changed, 2 insertions(+), 24 deletions(-) diff --git a/services/appprediction/java/com/android/server/appprediction/AppPredictionPerUserService.java b/services/appprediction/java/com/android/server/appprediction/AppPredictionPerUserService.java index 1af8ad3441905..84707a8d9c003 100644 --- a/services/appprediction/java/com/android/server/appprediction/AppPredictionPerUserService.java +++ b/services/appprediction/java/com/android/server/appprediction/AppPredictionPerUserService.java @@ -398,18 +398,7 @@ public class AppPredictionPerUserService extends final IBinder.DeathRecipient mDeathRecipient; private final RemoteCallbackList mCallbacks = - new RemoteCallbackList() { - @Override - public void onCallbackDied(IPredictionCallback callback) { - if (DEBUG) { - Slog.d(TAG, "Binder died for session Id=" + mSessionId - + " and callback=" + callback.asBinder()); - } - if (mCallbacks.getRegisteredCallbackCount() == 0) { - destroy(); - } - } - }; + new RemoteCallbackList<>(); AppPredictionSessionInfo( @NonNull final AppPredictionSessionId id, diff --git a/services/smartspace/java/com/android/server/smartspace/SmartspacePerUserService.java b/services/smartspace/java/com/android/server/smartspace/SmartspacePerUserService.java index dcffc9e73c0e0..f041fbd7bf902 100644 --- a/services/smartspace/java/com/android/server/smartspace/SmartspacePerUserService.java +++ b/services/smartspace/java/com/android/server/smartspace/SmartspacePerUserService.java @@ -334,18 +334,7 @@ public class SmartspacePerUserService extends @NonNull private final SmartspaceConfig mSmartspaceConfig; private final RemoteCallbackList mCallbacks = - new RemoteCallbackList() { - @Override - public void onCallbackDied(ISmartspaceCallback callback) { - if (DEBUG) { - Slog.d(TAG, "Binder died for session Id=" + mSessionId - + " and callback=" + callback.asBinder()); - } - if (mCallbacks.getRegisteredCallbackCount() == 0) { - destroy(); - } - } - }; + new RemoteCallbackList<>(); SmartspaceSessionInfo( @NonNull final SmartspaceSessionId id,