From 2875ffc05dc89689f7d5eaf9a5d22c96105aa44f Mon Sep 17 00:00:00 2001 From: Evan Rosky Date: Wed, 21 Jun 2023 10:27:32 -0700 Subject: [PATCH] Add permission check for RemoteTransition in ActivityOptions This was omitted which meant that any app could provide one. Bug: 286882367 Test: atest android.security.cts.ActivityManagerTest#testActivityManager_rejectRemoteTransition Change-Id: Idbc966578805c9e942ff74bae4945f4b1ccbb190 --- .../com/android/server/wm/SafeActivityOptions.java | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/services/core/java/com/android/server/wm/SafeActivityOptions.java b/services/core/java/com/android/server/wm/SafeActivityOptions.java index 586077658a262..c914fa10687f9 100644 --- a/services/core/java/com/android/server/wm/SafeActivityOptions.java +++ b/services/core/java/com/android/server/wm/SafeActivityOptions.java @@ -48,6 +48,7 @@ import android.os.RemoteException; import android.os.UserHandle; import android.util.Slog; import android.view.RemoteAnimationAdapter; +import android.window.RemoteTransition; import android.window.WindowContainerToken; import com.android.internal.annotations.VisibleForTesting; @@ -385,6 +386,18 @@ public class SafeActivityOptions { throw new SecurityException(msg); } + // Check permission for remote transitions + final RemoteTransition transition = options.getRemoteTransition(); + if (transition != null && supervisor.mService.checkPermission( + CONTROL_REMOTE_APP_TRANSITION_ANIMATIONS, callingPid, callingUid) + != PERMISSION_GRANTED) { + final String msg = "Permission Denial: starting " + getIntentString(intent) + + " from " + callerApp + " (pid=" + callingPid + + ", uid=" + callingUid + ") with remoteTransition"; + Slog.w(TAG, msg); + throw new SecurityException(msg); + } + // If launched from bubble is specified, then ensure that the caller is system or sysui. if (options.getLaunchedFromBubble() && !isSystemOrSystemUI(callingPid, callingUid)) { final String msg = "Permission Denial: starting " + getIntentString(intent)