Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Deny clip data when the app is in a virtual session

Browse Source 
Bug: 202768910
Test: Impossible
Change-Id: I6a2a502e0a761c7b1be9377c7b6c0027ce0611bd
This commit is contained in:
Christopher Tate
2022-01-13 12:42:56 -08:00
committed by Chris Tate
parent ee4ab7ae15
commit a014e4441b
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
services/core/java/com/android/server/clipboard/ClipboardService.java
View File

@@ -81,6 +81,7 @@ import com.android.internal.util.FrameworkStatsLog;
import com.android.server.LocalServices;
import com.android.server.SystemService;
import com.android.server.UiThread;
import com.android.server.companion.virtual.VirtualDeviceManagerInternal;
import com.android.server.contentcapture.ContentCaptureManagerInternal;
import com.android.server.uri.UriGrantsManagerInternal;
import com.android.server.wm.WindowManagerInternal;
@@ -127,6 +128,7 @@ public class ClipboardService extends SystemService {
private final IUriGrantsManager mUgm;
private final UriGrantsManagerInternal mUgmInternal;
private final WindowManagerInternal mWm;
private final VirtualDeviceManagerInternal mVdm;
private final IUserManager mUm;
private final PackageManager mPm;
private final AppOpsManager mAppOps;
@@ -158,6 +160,8 @@ public class ClipboardService extends SystemService {
mUgm = UriGrantsManager.getService();
mUgmInternal = LocalServices.getService(UriGrantsManagerInternal.class);
mWm = LocalServices.getService(WindowManagerInternal.class);
// Can be null; not all products have CDM + VirtualDeviceManager
mVdm = LocalServices.getService(VirtualDeviceManagerInternal.class);
mPm = getContext().getPackageManager();
mUm = (IUserManager) ServiceManager.getService(Context.USER_SERVICE);
mAppOps = (AppOpsManager) getContext().getSystemService(Context.APP_OPS_SERVICE);
@@ -973,6 +977,13 @@ public class ClipboardService extends SystemService {
// First, verify package ownership to ensure use below is safe.
mAppOps.checkPackage(uid, callingPackage);
// Nothing in a virtual session is permitted to touch clipboard contents
if (mVdm != null && mVdm.isAppRunningOnAnyVirtualDevice(uid)) {
Slog.w(TAG, "Clipboard access denied to " + uid + "/" + callingPackage
+ " within a virtual device session");
return false;
}
// Shell can access the clipboard for testing purposes.
if (mPm.checkPermission(android.Manifest.permission.READ_CLIPBOARD_IN_BACKGROUND,
callingPackage) == PackageManager.PERMISSION_GRANTED) {