From 53f1bcf670068581e26d1bff2302ee111e02cf0d Mon Sep 17 00:00:00 2001 From: mattgilbride Date: Mon, 11 Jul 2022 20:22:03 +0000 Subject: [PATCH] @EnforcePermission migrations - services.core Immediate calls to helper methods that themselves call Context.enforceCallingOrSelfPermission. Fixes applied by Android Lint (cl/18432857). Bug: 232058525 Test: N/A Change-Id: I2b233caac7ee6db04f674f0143c79973847336c2 --- .../hardware/biometrics/IAuthService.aidl | 3 + .../biometrics/IBiometricService.aidl | 15 +++ .../hardware/biometrics/ITestSession.aidl | 8 ++ .../android/hardware/face/IFaceService.aidl | 29 +++++ .../fingerprint/IFingerprintService.aidl | 32 ++++++ .../android/hardware/iris/IIrisService.aidl | 1 + .../hardware/location/IContextHubService.aidl | 16 +++ .../android/os/storage/IStorageManager.aidl | 26 +++++ media/java/android/media/IAudioService.aidl | 50 +++++++++ .../android/server/StorageManagerService.java | 52 ++++----- .../android/server/audio/AudioService.java | 100 +++++++++--------- .../server/biometrics/AuthService.java | 6 +- .../server/biometrics/BiometricService.java | 30 +++--- .../biometrics/sensors/face/FaceService.java | 58 +++++----- .../face/aidl/BiometricTestSessionImpl.java | 16 +-- .../face/hidl/BiometricTestSessionImpl.java | 16 +-- .../fingerprint/FingerprintService.java | 64 +++++------ .../aidl/BiometricTestSessionImpl.java | 16 +-- .../hidl/BiometricTestSessionImpl.java | 16 +-- .../biometrics/sensors/iris/IrisService.java | 2 +- .../contexthub/ContextHubService.java | 32 +++--- 21 files changed, 384 insertions(+), 204 deletions(-) diff --git a/core/java/android/hardware/biometrics/IAuthService.aidl b/core/java/android/hardware/biometrics/IAuthService.aidl index 91f794c161bf6..7c3cc10b2b991 100644 --- a/core/java/android/hardware/biometrics/IAuthService.aidl +++ b/core/java/android/hardware/biometrics/IAuthService.aidl @@ -33,12 +33,15 @@ import android.hardware.biometrics.SensorPropertiesInternal; */ interface IAuthService { // Creates a test session with the specified sensorId + @EnforcePermission("TEST_BIOMETRIC") ITestSession createTestSession(int sensorId, ITestSessionCallback callback, String opPackageName); // Retrieve static sensor properties for all biometric sensors + @EnforcePermission("TEST_BIOMETRIC") List getSensorProperties(String opPackageName); // Retrieve the package where BIometricOrompt's UI is implemented + @EnforcePermission("TEST_BIOMETRIC") String getUiPackage(); // Requests authentication. The service chooses the appropriate biometric to use, and shows diff --git a/core/java/android/hardware/biometrics/IBiometricService.aidl b/core/java/android/hardware/biometrics/IBiometricService.aidl index 42aad36e44c14..08f9ed6203f5f 100644 --- a/core/java/android/hardware/biometrics/IBiometricService.aidl +++ b/core/java/android/hardware/biometrics/IBiometricService.aidl @@ -31,59 +31,74 @@ import android.hardware.biometrics.SensorPropertiesInternal; */ interface IBiometricService { // Creates a test session with the specified sensorId + @EnforcePermission("USE_BIOMETRIC_INTERNAL") ITestSession createTestSession(int sensorId, ITestSessionCallback callback, String opPackageName); // Retrieve static sensor properties for all biometric sensors + @EnforcePermission("USE_BIOMETRIC_INTERNAL") List getSensorProperties(String opPackageName); // Requests authentication. The service chooses the appropriate biometric to use, and shows // the corresponding BiometricDialog. A requestId is returned that can be used to cancel // this operation. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") long authenticate(IBinder token, long operationId, int userId, IBiometricServiceReceiver receiver, String opPackageName, in PromptInfo promptInfo); // Cancel authentication for the given requestId. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void cancelAuthentication(IBinder token, String opPackageName, long requestId); // Checks if biometrics can be used. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") int canAuthenticate(String opPackageName, int userId, int callingUserId, int authenticators); // Checks if any biometrics are enrolled. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") boolean hasEnrolledBiometrics(int userId, String opPackageName); // Registers an authenticator (e.g. face, fingerprint, iris). // Id must be unique, whereas strength and modality don't need to be. // TODO(b/123321528): Turn strength and modality into enums. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void registerAuthenticator(int id, int modality, int strength, IBiometricAuthenticator authenticator); // Register callback for when keyguard biometric eligibility changes. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void registerEnabledOnKeyguardCallback(IBiometricEnabledOnKeyguardCallback callback, int callingUserId); // Notify BiometricService when Service is ready to start the prepared client. // Client lifecycle is still managed in Service. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void onReadyForAuthentication(long requestId, int cookie); // Requests all BIOMETRIC_STRONG sensors to have their authenticatorId invalidated for the // specified user. This happens when enrollments have been added on devices with multiple // biometric sensors. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void invalidateAuthenticatorIds(int userId, int fromSensorId, IInvalidationCallback callback); // Get a list of AuthenticatorIDs for authenticators which have enrolled templates and meet // the requirements for integrating with Keystore. The AuthenticatorID are known in Keystore // land as SIDs, and are used during key generation. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") long[] getAuthenticatorIds(int callingUserId); // See documentation in BiometricManager. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void resetLockoutTimeBound(IBinder token, String opPackageName, int fromSensorId, int userId, in byte[] hardwareAuthToken); + @EnforcePermission("USE_BIOMETRIC_INTERNAL") int getCurrentStrength(int sensorId); // Returns a bit field of the modality (or modalities) that are will be used for authentication. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") int getCurrentModality(String opPackageName, int userId, int callingUserId, int authenticators); // Returns a bit field of the authentication modalities that are supported by this device. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") int getSupportedModalities(int authenticators); } diff --git a/core/java/android/hardware/biometrics/ITestSession.aidl b/core/java/android/hardware/biometrics/ITestSession.aidl index f8395a119c0b4..df9f504a2c055 100644 --- a/core/java/android/hardware/biometrics/ITestSession.aidl +++ b/core/java/android/hardware/biometrics/ITestSession.aidl @@ -27,28 +27,36 @@ interface ITestSession { // portion of the framework code that would otherwise require human interaction. Note that // secure pathways such as HAT/Keystore are not testable, since they depend on the TEE or its // equivalent for the secret key. + @EnforcePermission("TEST_BIOMETRIC") void setTestHalEnabled(boolean enableTestHal); // Starts the enrollment process. This should generally be used when the test HAL is enabled. + @EnforcePermission("TEST_BIOMETRIC") void startEnroll(int userId); // Finishes the enrollment process. Simulates the HAL's callback. + @EnforcePermission("TEST_BIOMETRIC") void finishEnroll(int userId); // Simulates a successful authentication, but does not provide a valid HAT. + @EnforcePermission("TEST_BIOMETRIC") void acceptAuthentication(int userId); // Simulates a rejected attempt. + @EnforcePermission("TEST_BIOMETRIC") void rejectAuthentication(int userId); // Simulates an acquired message from the HAL. + @EnforcePermission("TEST_BIOMETRIC") void notifyAcquired(int userId, int acquireInfo); // Simulates an error message from the HAL. + @EnforcePermission("TEST_BIOMETRIC") void notifyError(int userId, int errorCode); // Matches the framework's cached enrollments against the HAL's enrollments. Any enrollment // that isn't known by both sides are deleted. This should generally be used when the test // HAL is disabled (e.g. to clean up after a test). + @EnforcePermission("TEST_BIOMETRIC") void cleanupInternalState(int userId); } diff --git a/core/java/android/hardware/face/IFaceService.aidl b/core/java/android/hardware/face/IFaceService.aidl index 989b001ca8bf0..369248edd5809 100644 --- a/core/java/android/hardware/face/IFaceService.aidl +++ b/core/java/android/hardware/face/IFaceService.aidl @@ -33,24 +33,30 @@ import android.view.Surface; interface IFaceService { // Creates a test session with the specified sensorId + @EnforcePermission("USE_BIOMETRIC_INTERNAL") ITestSession createTestSession(int sensorId, ITestSessionCallback callback, String opPackageName); // Requests a proto dump of the specified sensor + @EnforcePermission("USE_BIOMETRIC_INTERNAL") byte[] dumpSensorServiceStateProto(int sensorId, boolean clearSchedulerBuffer); // Retrieve static sensor properties for all face sensors + @EnforcePermission("MANAGE_BIOMETRIC") List getSensorPropertiesInternal(String opPackageName); // Retrieve static sensor properties for the specified sensor + @EnforcePermission("USE_BIOMETRIC_INTERNAL") FaceSensorPropertiesInternal getSensorProperties(int sensorId, String opPackageName); // Authenticate with a face. A requestId is returned that can be used to cancel this operation. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") long authenticate(IBinder token, long operationId, int userId, IFaceServiceReceiver receiver, String opPackageName, boolean isKeyguardBypassEnabled); // Uses the face hardware to detect for the presence of a face, without giving details // about accept/reject/lockout. A requestId is returned that can be used to cancel this // operation. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") long detectFace(IBinder token, int userId, IFaceServiceReceiver receiver, String opPackageName); // This method prepares the service to start authenticating, but doesn't start authentication. @@ -58,80 +64,103 @@ interface IFaceService { // called from BiometricService. The additional uid, pid, userId arguments should be determined // by BiometricService. To start authentication after the clients are ready, use // startPreparedClient(). + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void prepareForAuthentication(int sensorId, boolean requireConfirmation, IBinder token, long operationId, int userId, IBiometricSensorReceiver sensorReceiver, String opPackageName, long requestId, int cookie, boolean allowBackgroundAuthentication); // Starts authentication with the previously prepared client. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void startPreparedClient(int sensorId, int cookie); // Cancel authentication for the given requestId. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void cancelAuthentication(IBinder token, String opPackageName, long requestId); // Cancel face detection for the given requestId. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void cancelFaceDetect(IBinder token, String opPackageName, long requestId); // Same as above, with extra arguments. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void cancelAuthenticationFromService(int sensorId, IBinder token, String opPackageName, long requestId); // Start face enrollment + @EnforcePermission("MANAGE_BIOMETRIC") long enroll(int userId, IBinder token, in byte [] hardwareAuthToken, IFaceServiceReceiver receiver, String opPackageName, in int [] disabledFeatures, in Surface previewSurface, boolean debugConsent); // Start remote face enrollment + @EnforcePermission("MANAGE_BIOMETRIC") long enrollRemotely(int userId, IBinder token, in byte [] hardwareAuthToken, IFaceServiceReceiver receiver, String opPackageName, in int [] disabledFeatures); // Cancel enrollment in progress + @EnforcePermission("MANAGE_BIOMETRIC") void cancelEnrollment(IBinder token, long requestId); // Removes the specified face enrollment for the specified userId. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void remove(IBinder token, int faceId, int userId, IFaceServiceReceiver receiver, String opPackageName); // Removes all face enrollments for the specified userId. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void removeAll(IBinder token, int userId, IFaceServiceReceiver receiver, String opPackageName); // Get the enrolled face for user. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") List getEnrolledFaces(int sensorId, int userId, String opPackageName); // Determine if HAL is loaded and ready + @EnforcePermission("USE_BIOMETRIC_INTERNAL") boolean isHardwareDetected(int sensorId, String opPackageName); // Get a pre-enrollment authentication token + @EnforcePermission("MANAGE_BIOMETRIC") void generateChallenge(IBinder token, int sensorId, int userId, IFaceServiceReceiver receiver, String opPackageName); // Finish an enrollment sequence and invalidate the authentication token + @EnforcePermission("MANAGE_BIOMETRIC") void revokeChallenge(IBinder token, int sensorId, int userId, String opPackageName, long challenge); // Determine if a user has at least one enrolled face + @EnforcePermission("USE_BIOMETRIC_INTERNAL") boolean hasEnrolledFaces(int sensorId, int userId, String opPackageName); // Return the LockoutTracker status for the specified user + @EnforcePermission("USE_BIOMETRIC_INTERNAL") int getLockoutModeForUser(int sensorId, int userId); // Requests for the specified sensor+userId's authenticatorId to be invalidated + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void invalidateAuthenticatorId(int sensorId, int userId, IInvalidationCallback callback); // Gets the authenticator ID for face + @EnforcePermission("USE_BIOMETRIC_INTERNAL") long getAuthenticatorId(int sensorId, int callingUserId); // Reset the lockout when user authenticates with strong auth (e.g. PIN, pattern or password) + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void resetLockout(IBinder token, int sensorId, int userId, in byte [] hardwareAuthToken, String opPackageName); // Add a callback which gets notified when the face lockout period expired. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void addLockoutResetCallback(IBiometricServiceLockoutResetCallback callback, String opPackageName); + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void setFeature(IBinder token, int userId, int feature, boolean enabled, in byte [] hardwareAuthToken, IFaceServiceReceiver receiver, String opPackageName); + @EnforcePermission("MANAGE_BIOMETRIC") void getFeature(IBinder token, int userId, int feature, IFaceServiceReceiver receiver, String opPackageName); // Registers all HIDL and AIDL sensors. Only HIDL sensor properties need to be provided, because // AIDL sensor properties are retrieved directly from the available HALs. If no HIDL HALs exist, // hidlSensors must be non-null and empty. See AuthService.java + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void registerAuthenticators(in List hidlSensors); } diff --git a/core/java/android/hardware/fingerprint/IFingerprintService.aidl b/core/java/android/hardware/fingerprint/IFingerprintService.aidl index 0b6344617663a..1fc6eab3fd26e 100644 --- a/core/java/android/hardware/fingerprint/IFingerprintService.aidl +++ b/core/java/android/hardware/fingerprint/IFingerprintService.aidl @@ -37,15 +37,18 @@ import java.util.List; interface IFingerprintService { // Creates a test session with the specified sensorId + @EnforcePermission("TEST_BIOMETRIC") ITestSession createTestSession(int sensorId, ITestSessionCallback callback, String opPackageName); // Requests a proto dump of the specified sensor + @EnforcePermission("USE_BIOMETRIC_INTERNAL") byte[] dumpSensorServiceStateProto(int sensorId, boolean clearSchedulerBuffer); // Retrieve static sensor properties for all fingerprint sensors List getSensorPropertiesInternal(String opPackageName); // Retrieve static sensor properties for the specified sensor + @EnforcePermission("USE_BIOMETRIC_INTERNAL") FingerprintSensorPropertiesInternal getSensorProperties(int sensorId, String opPackageName); // Authenticate with a fingerprint. This is protected by USE_FINGERPRINT/USE_BIOMETRIC @@ -58,6 +61,7 @@ interface IFingerprintService { // Uses the fingerprint hardware to detect for the presence of a finger, without giving details // about accept/reject/lockout. A requestId is returned that can be used to cancel this // operation. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") long detectFingerprint(IBinder token, int userId, IFingerprintServiceReceiver receiver, String opPackageName); @@ -66,38 +70,47 @@ interface IFingerprintService { // called from BiometricService. The additional uid, pid, userId arguments should be determined // by BiometricService. To start authentication after the clients are ready, use // startPreparedClient(). + @EnforcePermission("MANAGE_BIOMETRIC") void prepareForAuthentication(int sensorId, IBinder token, long operationId, int userId, IBiometricSensorReceiver sensorReceiver, String opPackageName, long requestId, int cookie, boolean allowBackgroundAuthentication); // Starts authentication with the previously prepared client. + @EnforcePermission("MANAGE_BIOMETRIC") void startPreparedClient(int sensorId, int cookie); // Cancel authentication for the given requestId. void cancelAuthentication(IBinder token, String opPackageName, String attributionTag, long requestId); // Cancel finger detection for the given requestId. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void cancelFingerprintDetect(IBinder token, String opPackageName, long requestId); // Same as above, except this is protected by the MANAGE_BIOMETRIC signature permission. Takes // an additional uid, pid, userid. + @EnforcePermission("MANAGE_BIOMETRIC") void cancelAuthenticationFromService(int sensorId, IBinder token, String opPackageName, long requestId); // Start fingerprint enrollment + @EnforcePermission("MANAGE_FINGERPRINT") long enroll(IBinder token, in byte [] hardwareAuthToken, int userId, IFingerprintServiceReceiver receiver, String opPackageName, int enrollReason); // Cancel enrollment in progress + @EnforcePermission("MANAGE_FINGERPRINT") void cancelEnrollment(IBinder token, long requestId); // Any errors resulting from this call will be returned to the listener + @EnforcePermission("MANAGE_FINGERPRINT") void remove(IBinder token, int fingerId, int userId, IFingerprintServiceReceiver receiver, String opPackageName); // Removes all face enrollments for the specified userId. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void removeAll(IBinder token, int userId, IFingerprintServiceReceiver receiver, String opPackageName); // Rename the fingerprint specified by fingerId and userId to the given name + @EnforcePermission("MANAGE_FINGERPRINT") void rename(int fingerId, int userId, String name); // Get a list of enrolled fingerprints in the given userId. @@ -107,66 +120,85 @@ interface IFingerprintService { boolean isHardwareDetectedDeprecated(String opPackageName, String attributionTag); // Determine if the specified HAL is loaded and ready + @EnforcePermission("USE_BIOMETRIC_INTERNAL") boolean isHardwareDetected(int sensorId, String opPackageName); // Get a pre-enrollment authentication token + @EnforcePermission("MANAGE_FINGERPRINT") void generateChallenge(IBinder token, int sensorId, int userId, IFingerprintServiceReceiver receiver, String opPackageName); // Finish an enrollment sequence and invalidate the authentication token + @EnforcePermission("MANAGE_FINGERPRINT") void revokeChallenge(IBinder token, int sensorId, int userId, String opPackageName, long challenge); // Determine if a user has at least one enrolled fingerprint. Meant to support the deprecated FingerprintManager APIs boolean hasEnrolledFingerprintsDeprecated(int userId, String opPackageName, String attributionTag); // Determine if a user has at least one enrolled fingerprint. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") boolean hasEnrolledFingerprints(int sensorId, int userId, String opPackageName); // Return the LockoutTracker status for the specified user + @EnforcePermission("USE_BIOMETRIC_INTERNAL") int getLockoutModeForUser(int sensorId, int userId); // Requests for the specified sensor+userId's authenticatorId to be invalidated + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void invalidateAuthenticatorId(int sensorId, int userId, IInvalidationCallback callback); // Gets the authenticator ID for fingerprint + @EnforcePermission("USE_BIOMETRIC_INTERNAL") long getAuthenticatorId(int sensorId, int callingUserId); // Reset the timeout when user authenticates with strong auth (e.g. PIN, pattern or password) + @EnforcePermission("RESET_FINGERPRINT_LOCKOUT") void resetLockout(IBinder token, int sensorId, int userId, in byte[] hardwareAuthToken, String opPackageNAame); // Add a callback which gets notified when the fingerprint lockout period expired. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void addLockoutResetCallback(IBiometricServiceLockoutResetCallback callback, String opPackageName); // Check if a client request is currently being handled + @EnforcePermission("MANAGE_FINGERPRINT") boolean isClientActive(); // Add a callback which gets notified when the service starts and stops handling client requests + @EnforcePermission("MANAGE_FINGERPRINT") void addClientActiveCallback(IFingerprintClientActiveCallback callback); // Removes a callback set by addClientActiveCallback + @EnforcePermission("MANAGE_FINGERPRINT") void removeClientActiveCallback(IFingerprintClientActiveCallback callback); // Registers all HIDL and AIDL sensors. Only HIDL sensor properties need to be provided, because // AIDL sensor properties are retrieved directly from the available HALs. If no HIDL HALs exist, // hidlSensors must be non-null and empty. See AuthService.java + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void registerAuthenticators(in List hidlSensors); // Adds a callback which gets called when the service registers all of the fingerprint // authenticators. The callback is automatically removed after it's invoked. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void addAuthenticatorsRegisteredCallback(IFingerprintAuthenticatorsRegisteredCallback callback); // Notifies about a finger touching the sensor area. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void onPointerDown(long requestId, int sensorId, int x, int y, float minor, float major); // Notifies about a finger leaving the sensor area. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void onPointerUp(long requestId, int sensorId); // Notifies about the fingerprint UI being ready (e.g. HBM illumination is enabled). + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void onUiReady(long requestId, int sensorId); // Sets the controller for managing the UDFPS overlay. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void setUdfpsOverlayController(in IUdfpsOverlayController controller); // Sets the controller for managing the SideFPS overlay. + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void setSidefpsController(in ISidefpsController controller); // Registers BiometricStateListener. diff --git a/core/java/android/hardware/iris/IIrisService.aidl b/core/java/android/hardware/iris/IIrisService.aidl index 98057d5482261..764f4d448843a 100644 --- a/core/java/android/hardware/iris/IIrisService.aidl +++ b/core/java/android/hardware/iris/IIrisService.aidl @@ -26,5 +26,6 @@ interface IIrisService { // Registers all HIDL and AIDL sensors. Only HIDL sensor properties need to be provided, because // AIDL sensor properties are retrieved directly from the available HALs. If no HIDL HALs exist, // hidlSensors must be non-null and empty. See AuthService.java + @EnforcePermission("USE_BIOMETRIC_INTERNAL") void registerAuthenticators(in List hidlSensors); } diff --git a/core/java/android/hardware/location/IContextHubService.aidl b/core/java/android/hardware/location/IContextHubService.aidl index 92882c4f93bb6..ced75c4d0247f 100644 --- a/core/java/android/hardware/location/IContextHubService.aidl +++ b/core/java/android/hardware/location/IContextHubService.aidl @@ -35,62 +35,78 @@ import android.hardware.location.IContextHubTransactionCallback; interface IContextHubService { // Registers a callback to receive messages + @EnforcePermission("ACCESS_CONTEXT_HUB") int registerCallback(in IContextHubCallback callback); // Gets a list of available context hub handles + @EnforcePermission("ACCESS_CONTEXT_HUB") int[] getContextHubHandles(); // Gets the properties of a hub + @EnforcePermission("ACCESS_CONTEXT_HUB") ContextHubInfo getContextHubInfo(int contextHubHandle); // Loads a nanoapp at the specified hub (old API) + @EnforcePermission("ACCESS_CONTEXT_HUB") int loadNanoApp(int contextHubHandle, in NanoApp nanoApp); // Unloads a nanoapp given its instance ID (old API) + @EnforcePermission("ACCESS_CONTEXT_HUB") int unloadNanoApp(int nanoAppHandle); // Gets the NanoAppInstanceInfo of a nanoapp give its instance ID + @EnforcePermission("ACCESS_CONTEXT_HUB") NanoAppInstanceInfo getNanoAppInstanceInfo(int nanoAppHandle); // Finds all nanoApp instances matching some filter + @EnforcePermission("ACCESS_CONTEXT_HUB") int[] findNanoAppOnHub(int contextHubHandle, in NanoAppFilter filter); // Sends a message to a nanoApp + @EnforcePermission("ACCESS_CONTEXT_HUB") int sendMessage(int contextHubHandle, int nanoAppHandle, in ContextHubMessage msg); // Creates a client to send and receive messages + @EnforcePermission("ACCESS_CONTEXT_HUB") IContextHubClient createClient( int contextHubId, in IContextHubClientCallback client, in String attributionTag, in String packageName); // Creates a PendingIntent-based client to send and receive messages + @EnforcePermission("ACCESS_CONTEXT_HUB") IContextHubClient createPendingIntentClient( int contextHubId, in PendingIntent pendingIntent, long nanoAppId, in String attributionTag); // Returns a list of ContextHub objects of available hubs + @EnforcePermission("ACCESS_CONTEXT_HUB") List getContextHubs(); // Loads a nanoapp at the specified hub (new API) + @EnforcePermission("ACCESS_CONTEXT_HUB") void loadNanoAppOnHub( int contextHubId, in IContextHubTransactionCallback transactionCallback, in NanoAppBinary nanoAppBinary); // Unloads a nanoapp on a specified context hub (new API) + @EnforcePermission("ACCESS_CONTEXT_HUB") void unloadNanoAppFromHub( int contextHubId, in IContextHubTransactionCallback transactionCallback, long nanoAppId); // Enables a nanoapp at the specified hub + @EnforcePermission("ACCESS_CONTEXT_HUB") void enableNanoApp( int contextHubId, in IContextHubTransactionCallback transactionCallback, long nanoAppId); // Disables a nanoapp at the specified hub + @EnforcePermission("ACCESS_CONTEXT_HUB") void disableNanoApp( int contextHubId, in IContextHubTransactionCallback transactionCallback, long nanoAppId); // Queries for a list of nanoapps + @EnforcePermission("ACCESS_CONTEXT_HUB") void queryNanoApps(int contextHubId, in IContextHubTransactionCallback transactionCallback); } diff --git a/core/java/android/os/storage/IStorageManager.aidl b/core/java/android/os/storage/IStorageManager.aidl index a0f6598640ba1..df0bee7e1f2df 100644 --- a/core/java/android/os/storage/IStorageManager.aidl +++ b/core/java/android/os/storage/IStorageManager.aidl @@ -52,6 +52,7 @@ interface IStorageManager { * Shuts down the StorageManagerService and gracefully unmounts all external media. * Invokes call back once the shutdown is complete. */ + @EnforcePermission("SHUTDOWN") void shutdown(IStorageShutdownObserver observer) = 19; /** * Mounts an Opaque Binary Blob (OBB). Only allows the calling process's UID @@ -100,33 +101,55 @@ interface IStorageManager { * Kick off an immediate maintenance operation * @throws RemoteException */ + @EnforcePermission("MOUNT_UNMOUNT_FILESYSTEMS") void runMaintenance() = 42; DiskInfo[] getDisks() = 44; VolumeInfo[] getVolumes(int flags) = 45; VolumeRecord[] getVolumeRecords(int flags) = 46; + @EnforcePermission("MOUNT_UNMOUNT_FILESYSTEMS") void mount(in String volId) = 47; + @EnforcePermission("MOUNT_UNMOUNT_FILESYSTEMS") void unmount(in String volId) = 48; + @EnforcePermission("MOUNT_FORMAT_FILESYSTEMS") void format(in String volId) = 49; + @EnforcePermission("MOUNT_FORMAT_FILESYSTEMS") void partitionPublic(in String diskId) = 50; + @EnforcePermission("MOUNT_FORMAT_FILESYSTEMS") void partitionPrivate(in String diskId) = 51; + @EnforcePermission("MOUNT_FORMAT_FILESYSTEMS") void partitionMixed(in String diskId, int ratio) = 52; + @EnforcePermission("MOUNT_UNMOUNT_FILESYSTEMS") void setVolumeNickname(in String fsUuid, in String nickname) = 53; + @EnforcePermission("MOUNT_UNMOUNT_FILESYSTEMS") void setVolumeUserFlags(in String fsUuid, int flags, int mask) = 54; + @EnforcePermission("MOUNT_UNMOUNT_FILESYSTEMS") void forgetVolume(in String fsUuid) = 55; + @EnforcePermission("MOUNT_UNMOUNT_FILESYSTEMS") void forgetAllVolumes() = 56; String getPrimaryStorageUuid() = 57; + @EnforcePermission("MOUNT_UNMOUNT_FILESYSTEMS") void setPrimaryStorageUuid(in String volumeUuid, IPackageMoveObserver callback) = 58; + @EnforcePermission("MOUNT_FORMAT_FILESYSTEMS") void benchmark(in String volId, IVoldTaskListener listener) = 59; + @EnforcePermission("MOUNT_UNMOUNT_FILESYSTEMS") void setDebugFlags(int flags, int mask) = 60; + @EnforcePermission("STORAGE_INTERNAL") void createUserKey(int userId, int serialNumber, boolean ephemeral) = 61; + @EnforcePermission("STORAGE_INTERNAL") void destroyUserKey(int userId) = 62; void unlockUserKey(int userId, int serialNumber, in byte[] secret) = 63; + @EnforcePermission("STORAGE_INTERNAL") void lockUserKey(int userId) = 64; boolean isUserKeyUnlocked(int userId) = 65; + @EnforcePermission("STORAGE_INTERNAL") void prepareUserStorage(in String volumeUuid, int userId, int serialNumber, int flags) = 66; + @EnforcePermission("STORAGE_INTERNAL") void destroyUserStorage(in String volumeUuid, int userId, int flags) = 67; + @EnforcePermission("STORAGE_INTERNAL") void addUserKeyAuth(int userId, int serialNumber, in byte[] secret) = 70; + @EnforcePermission("STORAGE_INTERNAL") void fixateNewestUserKeyAuth(int userId) = 71; + @EnforcePermission("MOUNT_FORMAT_FILESYSTEMS") void fstrim(int flags, IVoldTaskListener listener) = 72; AppFuseMount mountProxyFileDescriptorBridge() = 73; ParcelFileDescriptor openProxyFileDescriptor(int mountPointId, int fileId, int mode) = 74; @@ -139,14 +162,17 @@ interface IStorageManager { void commitChanges() = 83; boolean supportsCheckpoint() = 84; void startCheckpoint(int numTries) = 85; + @EnforcePermission("MOUNT_FORMAT_FILESYSTEMS") boolean needsCheckpoint() = 86; void abortChanges(in String message, boolean retry) = 87; + @EnforcePermission("STORAGE_INTERNAL") void clearUserKeyAuth(int userId, int serialNumber, in byte[] secret) = 88; void fixupAppDir(in String path) = 89; void disableAppDataIsolation(in String pkgName, int pid, int userId) = 90; PendingIntent getManageSpaceActivityIntent(in String packageName, int requestCode) = 91; void notifyAppIoBlocked(in String volumeUuid, int uid, int tid, int reason) = 92; void notifyAppIoResumed(in String volumeUuid, int uid, int tid, int reason) = 93; + @EnforcePermission("WRITE_MEDIA_STORAGE") int getExternalStorageMountMode(int uid, in String packageName) = 94; boolean isAppIoBlocked(in String volumeUuid, int uid, int tid, int reason) = 95; void setCloudMediaProvider(in String authority) = 96; diff --git a/media/java/android/media/IAudioService.aidl b/media/java/android/media/IAudioService.aidl index e28178a8d5d8e..f9b043f2525ca 100755 --- a/media/java/android/media/IAudioService.aidl +++ b/media/java/android/media/IAudioService.aidl @@ -107,6 +107,7 @@ interface IAudioService { boolean isMasterMute(); + @EnforcePermission("MODIFY_AUDIO_ROUTING") void setMasterMute(boolean mute, int flags, String callingPackage, int userId, in String attributionTag); @@ -118,27 +119,37 @@ interface IAudioService { @UnsupportedAppUsage int getStreamMaxVolume(int streamType); + @EnforcePermission("MODIFY_AUDIO_ROUTING") List getAudioVolumeGroups(); + @EnforcePermission("MODIFY_AUDIO_ROUTING") void setVolumeIndexForAttributes(in AudioAttributes aa, int index, int flags, String callingPackage, in String attributionTag); + @EnforcePermission("MODIFY_AUDIO_ROUTING") int getVolumeIndexForAttributes(in AudioAttributes aa); + @EnforcePermission("MODIFY_AUDIO_ROUTING") int getMaxVolumeIndexForAttributes(in AudioAttributes aa); + @EnforcePermission("MODIFY_AUDIO_ROUTING") int getMinVolumeIndexForAttributes(in AudioAttributes aa); + @EnforcePermission("QUERY_AUDIO_STATE") int getLastAudibleStreamVolume(int streamType); + @EnforcePermission("MODIFY_AUDIO_ROUTING") void setSupportedSystemUsages(in int[] systemUsages); + @EnforcePermission("MODIFY_AUDIO_ROUTING") int[] getSupportedSystemUsages(); + @EnforcePermission("MODIFY_AUDIO_ROUTING") List getAudioProductStrategies(); boolean isMicrophoneMuted(); + @EnforcePermission("ACCESS_ULTRASOUND") boolean isUltrasoundSupported(); void setMicrophoneMute(boolean on, String callingPackage, int userId, in String attributionTag); @@ -220,6 +231,7 @@ interface IAudioService { IRingtonePlayer getRingtonePlayer(); int getUiSoundsStreamType(); + @EnforcePermission("MODIFY_AUDIO_ROUTING") void setWiredDeviceConnectionState(in AudioDeviceAttributes aa, int state, String caller); @UnsupportedAppUsage @@ -306,8 +318,10 @@ interface IAudioService { int setPreferredDevicesForStrategy(in int strategy, in List device); + @EnforcePermission("MODIFY_AUDIO_ROUTING") int removePreferredDevicesForStrategy(in int strategy); + @EnforcePermission("MODIFY_AUDIO_ROUTING") List getPreferredDevicesForStrategy(in int strategy); List getDevicesForAttributes(in AudioAttributes attributes); @@ -325,6 +339,7 @@ interface IAudioService { oneway void setRttEnabled(in boolean rttEnabled); + @EnforcePermission("MODIFY_AUDIO_ROUTING") void setDeviceVolumeBehavior(in AudioDeviceAttributes device, in int deviceVolumeBehavior, in String pkgName); @@ -333,13 +348,16 @@ interface IAudioService { // WARNING: read warning at top of file, new methods that need to be used by native // code via IAudioManager.h need to be added to the top section. + @EnforcePermission("MODIFY_AUDIO_ROUTING") oneway void setMultiAudioFocusEnabled(in boolean enabled); int setPreferredDevicesForCapturePreset( in int capturePreset, in List devices); + @EnforcePermission("MODIFY_AUDIO_ROUTING") int clearPreferredDevicesForCapturePreset(in int capturePreset); + @EnforcePermission("MODIFY_AUDIO_ROUTING") List getPreferredDevicesForCapturePreset(in int capturePreset); void registerCapturePresetDevicesRoleDispatcher(ICapturePresetDevicesRoleDispatcher dispatcher); @@ -407,12 +425,16 @@ interface IAudioService { boolean isSpatializerAvailable(); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") boolean isSpatializerAvailableForDevice(in AudioDeviceAttributes device); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") boolean hasHeadTracker(in AudioDeviceAttributes device); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") void setHeadTrackerEnabled(boolean enabled, in AudioDeviceAttributes device); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") boolean isHeadTrackerEnabled(in AudioDeviceAttributes device); boolean isHeadTrackerAvailable(); @@ -420,6 +442,7 @@ interface IAudioService { void registerSpatializerHeadTrackerAvailableCallback( in ISpatializerHeadTrackerAvailableCallback cb, boolean register); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") void setSpatializerEnabled(boolean enabled); boolean canBeSpatialized(in AudioAttributes aa, in AudioFormat af); @@ -428,46 +451,65 @@ interface IAudioService { void unregisterSpatializerCallback(in ISpatializerCallback cb); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") void registerSpatializerHeadTrackingCallback(in ISpatializerHeadTrackingModeCallback cb); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") void unregisterSpatializerHeadTrackingCallback(in ISpatializerHeadTrackingModeCallback cb); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") void registerHeadToSoundstagePoseCallback(in ISpatializerHeadToSoundStagePoseCallback cb); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") void unregisterHeadToSoundstagePoseCallback(in ISpatializerHeadToSoundStagePoseCallback cb); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") List getSpatializerCompatibleAudioDevices(); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") void addSpatializerCompatibleAudioDevice(in AudioDeviceAttributes ada); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") void removeSpatializerCompatibleAudioDevice(in AudioDeviceAttributes ada); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") void setDesiredHeadTrackingMode(int mode); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") int getDesiredHeadTrackingMode(); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") int[] getSupportedHeadTrackingModes(); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") int getActualHeadTrackingMode(); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") oneway void setSpatializerGlobalTransform(in float[] transform); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") oneway void recenterHeadTracker(); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") void setSpatializerParameter(int key, in byte[] value); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") void getSpatializerParameter(int key, inout byte[] value); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") int getSpatializerOutput(); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") void registerSpatializerOutputCallback(in ISpatializerOutputCallback cb); + @EnforcePermission("MODIFY_DEFAULT_AUDIO_EFFECTS") void unregisterSpatializerOutputCallback(in ISpatializerOutputCallback cb); boolean isVolumeFixed(); VolumeInfo getDefaultVolumeInfo(); + @EnforcePermission("CALL_AUDIO_INTERCEPTION") boolean isPstnCallAudioInterceptable(); oneway void muteAwaitConnection(in int[] usagesToMute, in AudioDeviceAttributes dev, @@ -475,8 +517,10 @@ interface IAudioService { oneway void cancelMuteAwaitConnection(in AudioDeviceAttributes dev); + @EnforcePermission("MODIFY_AUDIO_ROUTING") AudioDeviceAttributes getMutingExpectedDevice(); + @EnforcePermission("MODIFY_AUDIO_ROUTING") void registerMuteAwaitConnectionDispatcher(in IMuteAwaitConnectionCallback cb, boolean register); @@ -486,22 +530,28 @@ interface IAudioService { void registerDeviceVolumeBehaviorDispatcher(boolean register, in IDeviceVolumeBehaviorDispatcher dispatcher); + @EnforcePermission("MODIFY_AUDIO_ROUTING") List getFocusStack(); boolean sendFocusLoss(in AudioFocusInfo focusLoser, in IAudioPolicyCallback apcb); + @EnforcePermission("MODIFY_AUDIO_ROUTING") @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING)") void addAssistantServicesUids(in int[] assistantUID); + @EnforcePermission("MODIFY_AUDIO_ROUTING") @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING)") void removeAssistantServicesUids(in int[] assistantUID); + @EnforcePermission("MODIFY_AUDIO_ROUTING") @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING)") void setActiveAssistantServiceUids(in int[] activeUids); + @EnforcePermission("MODIFY_AUDIO_ROUTING") @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING)") int[] getAssistantServicesUids(); + @EnforcePermission("MODIFY_AUDIO_ROUTING") @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING)") int[] getActiveAssistantServiceUids(); diff --git a/services/core/java/com/android/server/StorageManagerService.java b/services/core/java/com/android/server/StorageManagerService.java index 9cdb2df6bc79d..f1f861e4d6fcb 100644 --- a/services/core/java/com/android/server/StorageManagerService.java +++ b/services/core/java/com/android/server/StorageManagerService.java @@ -1248,10 +1248,10 @@ class StorageManagerService extends IStorageManager.Stub mHandler.sendMessage(mHandler.obtainMessage(H_FSTRIM, callback)); } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS) // Binder entry point for kicking off an immediate fstrim @Override public void runMaintenance() { - enforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS); runIdleMaintenance(null); } @@ -2165,17 +2165,17 @@ class StorageManagerService extends IStorageManager.Stub mCallbacks.unregister(listener); } + @android.annotation.EnforcePermission(android.Manifest.permission.SHUTDOWN) @Override public void shutdown(final IStorageShutdownObserver observer) { - enforcePermission(android.Manifest.permission.SHUTDOWN); Slog.i(TAG, "Shutting down"); mHandler.obtainMessage(H_SHUTDOWN, observer).sendToTarget(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS) @Override public void mount(String volId) { - enforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS); final VolumeInfo vol = findVolumeByIdOrThrow(volId); if (isMountDisallowed(vol)) { @@ -2241,9 +2241,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS) @Override public void unmount(String volId) { - enforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS); final VolumeInfo vol = findVolumeByIdOrThrow(volId); unmount(vol); @@ -2265,9 +2265,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_FORMAT_FILESYSTEMS) @Override public void format(String volId) { - enforcePermission(android.Manifest.permission.MOUNT_FORMAT_FILESYSTEMS); final VolumeInfo vol = findVolumeByIdOrThrow(volId); final String fsUuid = vol.fsUuid; @@ -2284,9 +2284,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_FORMAT_FILESYSTEMS) @Override public void benchmark(String volId, IVoldTaskListener listener) { - enforcePermission(android.Manifest.permission.MOUNT_FORMAT_FILESYSTEMS); try { mVold.benchmark(volId, new IVoldTaskListener.Stub() { @@ -2323,9 +2323,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_FORMAT_FILESYSTEMS) @Override public void partitionPublic(String diskId) { - enforcePermission(android.Manifest.permission.MOUNT_FORMAT_FILESYSTEMS); final CountDownLatch latch = findOrCreateDiskScanLatch(diskId); try { @@ -2336,9 +2336,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_FORMAT_FILESYSTEMS) @Override public void partitionPrivate(String diskId) { - enforcePermission(android.Manifest.permission.MOUNT_FORMAT_FILESYSTEMS); enforceAdminUser(); final CountDownLatch latch = findOrCreateDiskScanLatch(diskId); @@ -2350,9 +2350,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_FORMAT_FILESYSTEMS) @Override public void partitionMixed(String diskId, int ratio) { - enforcePermission(android.Manifest.permission.MOUNT_FORMAT_FILESYSTEMS); enforceAdminUser(); final CountDownLatch latch = findOrCreateDiskScanLatch(diskId); @@ -2364,9 +2364,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS) @Override public void setVolumeNickname(String fsUuid, String nickname) { - enforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS); Objects.requireNonNull(fsUuid); synchronized (mLock) { @@ -2377,9 +2377,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS) @Override public void setVolumeUserFlags(String fsUuid, int flags, int mask) { - enforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS); Objects.requireNonNull(fsUuid); synchronized (mLock) { @@ -2390,9 +2390,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS) @Override public void forgetVolume(String fsUuid) { - enforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS); Objects.requireNonNull(fsUuid); @@ -2414,9 +2414,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS) @Override public void forgetAllVolumes() { - enforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS); synchronized (mLock) { for (int i = 0; i < mRecords.size(); i++) { @@ -2446,9 +2446,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_FORMAT_FILESYSTEMS) @Override public void fstrim(int flags, IVoldTaskListener listener) { - enforcePermission(android.Manifest.permission.MOUNT_FORMAT_FILESYSTEMS); try { // Block based checkpoint process runs fstrim. So, if checkpoint is in progress @@ -2737,9 +2737,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS) @Override public void setDebugFlags(int flags, int mask) { - enforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS); if ((mask & (StorageManager.DEBUG_ADOPTABLE_FORCE_ON | StorageManager.DEBUG_ADOPTABLE_FORCE_OFF)) != 0) { @@ -2807,9 +2807,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS) @Override public void setPrimaryStorageUuid(String volumeUuid, IPackageMoveObserver callback) { - enforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS); final VolumeInfo from; final VolumeInfo to; @@ -3013,12 +3013,12 @@ class StorageManagerService extends IStorageManager.Stub mVold.commitChanges(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MOUNT_FORMAT_FILESYSTEMS) /** * Check if we should be mounting with checkpointing or are checkpointing now */ @Override public boolean needsCheckpoint() throws RemoteException { - enforcePermission(android.Manifest.permission.MOUNT_FORMAT_FILESYSTEMS); return mVold.needsCheckpoint(); } @@ -3035,9 +3035,9 @@ class StorageManagerService extends IStorageManager.Stub mVold.abortChanges(message, retry); } + @android.annotation.EnforcePermission(android.Manifest.permission.STORAGE_INTERNAL) @Override public void createUserKey(int userId, int serialNumber, boolean ephemeral) { - enforcePermission(android.Manifest.permission.STORAGE_INTERNAL); try { mVold.createUserKey(userId, serialNumber, ephemeral); @@ -3046,9 +3046,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.STORAGE_INTERNAL) @Override public void destroyUserKey(int userId) { - enforcePermission(android.Manifest.permission.STORAGE_INTERNAL); try { mVold.destroyUserKey(userId); @@ -3065,6 +3065,7 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.STORAGE_INTERNAL) /* * Add this secret to the set of ways we can recover a user's disk * encryption key. Changing the secret for a disk encryption key is done in @@ -3075,7 +3076,6 @@ class StorageManagerService extends IStorageManager.Stub */ @Override public void addUserKeyAuth(int userId, int serialNumber, byte[] secret) { - enforcePermission(android.Manifest.permission.STORAGE_INTERNAL); try { mVold.addUserKeyAuth(userId, serialNumber, encodeBytes(secret)); @@ -3084,6 +3084,7 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.STORAGE_INTERNAL) /* * Store a user's disk encryption key without secret binding. Removing the * secret for a disk encryption key is done in two phases. First, this @@ -3093,7 +3094,6 @@ class StorageManagerService extends IStorageManager.Stub */ @Override public void clearUserKeyAuth(int userId, int serialNumber, byte[] secret) { - enforcePermission(android.Manifest.permission.STORAGE_INTERNAL); try { mVold.clearUserKeyAuth(userId, serialNumber, encodeBytes(secret)); @@ -3102,13 +3102,13 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.STORAGE_INTERNAL) /* * Delete all bindings of a user's disk encryption key except the most * recently added one. */ @Override public void fixateNewestUserKeyAuth(int userId) { - enforcePermission(android.Manifest.permission.STORAGE_INTERNAL); try { mVold.fixateNewestUserKeyAuth(userId); @@ -3152,6 +3152,7 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.STORAGE_INTERNAL) @Override public void lockUserKey(int userId) { // Do not lock user 0 data for headless system user @@ -3160,7 +3161,6 @@ class StorageManagerService extends IStorageManager.Stub throw new IllegalArgumentException("Headless system user data cannot be locked.."); } - enforcePermission(android.Manifest.permission.STORAGE_INTERNAL); if (!isUserKeyUnlocked(userId)) { Slog.d(TAG, "User " + userId + "'s CE storage is already locked"); @@ -3215,9 +3215,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.STORAGE_INTERNAL) @Override public void prepareUserStorage(String volumeUuid, int userId, int serialNumber, int flags) { - enforcePermission(android.Manifest.permission.STORAGE_INTERNAL); try { prepareUserStorageInternal(volumeUuid, userId, serialNumber, flags); @@ -3258,9 +3258,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.STORAGE_INTERNAL) @Override public void destroyUserStorage(String volumeUuid, int userId, int flags) { - enforcePermission(android.Manifest.permission.STORAGE_INTERNAL); try { mVold.destroyUserStorage(volumeUuid, userId, flags); @@ -4305,9 +4305,9 @@ class StorageManagerService extends IStorageManager.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.WRITE_MEDIA_STORAGE) @Override public int getExternalStorageMountMode(int uid, String packageName) { - enforcePermission(android.Manifest.permission.WRITE_MEDIA_STORAGE); return mStorageManagerInternal.getExternalStorageMountMode(uid, packageName); } diff --git a/services/core/java/com/android/server/audio/AudioService.java b/services/core/java/com/android/server/audio/AudioService.java index 42d8778522c5b..7c02531d54079 100644 --- a/services/core/java/com/android/server/audio/AudioService.java +++ b/services/core/java/com/android/server/audio/AudioService.java @@ -1792,11 +1792,11 @@ public class AudioService extends IAudioService.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** * @see AudioManager#setSupportedSystemUsages(int[]) */ public void setSupportedSystemUsages(@NonNull @AttributeSystemUsage int[] systemUsages) { - enforceModifyAudioRoutingPermission(); verifySystemUsages(systemUsages); synchronized (mSupportedSystemUsagesLock) { @@ -1805,11 +1805,11 @@ public class AudioService extends IAudioService.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** * @see AudioManager#getSupportedSystemUsages() */ public @NonNull @AttributeSystemUsage int[] getSupportedSystemUsages() { - enforceModifyAudioRoutingPermission(); synchronized (mSupportedSystemUsagesLock) { return Arrays.copyOf(mSupportedSystemUsages, mSupportedSystemUsages.length); } @@ -1823,6 +1823,7 @@ public class AudioService extends IAudioService.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** * @return the {@link android.media.audiopolicy.AudioProductStrategy} discovered from the * platform configuration file. @@ -1830,10 +1831,10 @@ public class AudioService extends IAudioService.Stub @NonNull public List getAudioProductStrategies() { // verify permissions - enforceModifyAudioRoutingPermission(); return AudioProductStrategy.getAudioProductStrategies(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** * @return the List of {@link android.media.audiopolicy.AudioVolumeGroup} discovered from the * platform configuration file. @@ -1841,7 +1842,6 @@ public class AudioService extends IAudioService.Stub @NonNull public List getAudioVolumeGroups() { // verify permissions - enforceModifyAudioRoutingPermission(); return AudioVolumeGroup.getAudioVolumeGroups(); } @@ -2723,9 +2723,9 @@ public class AudioService extends IAudioService.Stub return status; } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** @see AudioManager#removePreferredDeviceForStrategy(AudioProductStrategy) */ public int removePreferredDevicesForStrategy(int strategy) { - enforceModifyAudioRoutingPermission(); final String logString = String.format("removePreferredDeviceForStrategy strat:%d", strategy); sDeviceLogger.log(new AudioEventLogger.StringEvent(logString).printLog(TAG)); @@ -2737,12 +2737,12 @@ public class AudioService extends IAudioService.Stub return status; } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** * @see AudioManager#getPreferredDeviceForStrategy(AudioProductStrategy) * @see AudioManager#getPreferredDevicesForStrategy(AudioProductStrategy) */ public List getPreferredDevicesForStrategy(int strategy) { - enforceModifyAudioRoutingPermission(); List devices = new ArrayList<>(); final long identity = Binder.clearCallingIdentity(); final int status = AudioSystem.getDevicesForRoleAndStrategy( @@ -2810,9 +2810,9 @@ public class AudioService extends IAudioService.Stub return status; } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** @see AudioManager#clearPreferredDevicesForCapturePreset(int) */ public int clearPreferredDevicesForCapturePreset(int capturePreset) { - enforceModifyAudioRoutingPermission(); final String logString = String.format( "removePreferredDeviceForCapturePreset source:%d", capturePreset); sDeviceLogger.log(new AudioEventLogger.StringEvent(logString).printLog(TAG)); @@ -2824,11 +2824,11 @@ public class AudioService extends IAudioService.Stub return status; } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** * @see AudioManager#getPreferredDevicesForCapturePreset(int) */ public List getPreferredDevicesForCapturePreset(int capturePreset) { - enforceModifyAudioRoutingPermission(); List devices = new ArrayList<>(); final long identity = Binder.clearCallingIdentity(); final int status = AudioSystem.getDevicesForRoleAndCapturePreset( @@ -3558,10 +3558,10 @@ public class AudioService extends IAudioService.Stub } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** @see AudioManager#setVolumeIndexForAttributes(attr, int, int) */ public void setVolumeIndexForAttributes(@NonNull AudioAttributes attr, int index, int flags, String callingPackage, String attributionTag) { - enforceModifyAudioRoutingPermission(); Objects.requireNonNull(attr, "attr must not be null"); final int volumeGroup = getVolumeGroupIdForAttributes(attr); if (sVolumeGroupStates.indexOfKey(volumeGroup) < 0) { @@ -3601,9 +3601,9 @@ public class AudioService extends IAudioService.Stub return null; } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** @see AudioManager#getVolumeIndexForAttributes(attr) */ public int getVolumeIndexForAttributes(@NonNull AudioAttributes attr) { - enforceModifyAudioRoutingPermission(); Objects.requireNonNull(attr, "attr must not be null"); final int volumeGroup = getVolumeGroupIdForAttributes(attr); if (sVolumeGroupStates.indexOfKey(volumeGroup) < 0) { @@ -3613,16 +3613,16 @@ public class AudioService extends IAudioService.Stub return vgs.getVolumeIndex(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** @see AudioManager#getMaxVolumeIndexForAttributes(attr) */ public int getMaxVolumeIndexForAttributes(@NonNull AudioAttributes attr) { - enforceModifyAudioRoutingPermission(); Objects.requireNonNull(attr, "attr must not be null"); return AudioSystem.getMaxVolumeIndexForAttributes(attr); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** @see AudioManager#getMinVolumeIndexForAttributes(attr) */ public int getMinVolumeIndexForAttributes(@NonNull AudioAttributes attr) { - enforceModifyAudioRoutingPermission(); Objects.requireNonNull(attr, "attr must not be null"); return AudioSystem.getMinVolumeIndexForAttributes(attr); } @@ -3664,9 +3664,9 @@ public class AudioService extends IAudioService.Stub attributionTag, Binder.getCallingUid(), callingOrSelfHasAudioSettingsPermission()); } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_ULTRASOUND) /** @see AudioManager#isUltrasoundSupported() */ public boolean isUltrasoundSupported() { - enforceAccessUltrasoundPermission(); return AudioSystem.isUltrasoundSupported(); } @@ -4438,10 +4438,10 @@ public class AudioService extends IAudioService.Stub return AudioSystem.getMasterMute(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** @see AudioManager#setMasterMute(boolean, int) */ public void setMasterMute(boolean mute, int flags, String callingPackage, int userId, String attributionTag) { - enforceModifyAudioRoutingPermission(); setMasterMuteInternal(mute, flags, callingPackage, Binder.getCallingUid(), userId, Binder.getCallingPid(), attributionTag); } @@ -4483,9 +4483,9 @@ public class AudioService extends IAudioService.Stub return (mStreamStates[streamType].getMinIndex(isPrivileged) + 5) / 10; } + @android.annotation.EnforcePermission(android.Manifest.permission.QUERY_AUDIO_STATE) /** Get last audible volume before stream was muted. */ public int getLastAudibleStreamVolume(int streamType) { - enforceQueryStatePermission(); ensureValidStreamType(streamType); int device = getDeviceForStream(streamType); return (mStreamStates[streamType].getIndex(device) + 5) / 10; @@ -5332,9 +5332,9 @@ public class AudioService extends IAudioService.Stub mModeDispatchers.unregister(dispatcher); } + @android.annotation.EnforcePermission(android.Manifest.permission.CALL_AUDIO_INTERCEPTION) /** @see AudioManager#isPstnCallAudioInterceptable() */ public boolean isPstnCallAudioInterceptable() { - enforceCallAudioInterceptionPermission(); boolean uplinkDeviceFound = false; boolean downlinkDeviceFound = false; @@ -6689,6 +6689,7 @@ public class AudioService extends IAudioService.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** * @see AudioManager#setDeviceVolumeBehavior(AudioDeviceAttributes, int) * @param device the audio device to be affected @@ -6697,7 +6698,6 @@ public class AudioService extends IAudioService.Stub public void setDeviceVolumeBehavior(@NonNull AudioDeviceAttributes device, @AudioManager.DeviceVolumeBehavior int deviceVolumeBehavior, @Nullable String pkgName) { // verify permissions - enforceModifyAudioRoutingPermission(); // verify arguments Objects.requireNonNull(device); AudioManager.enforceValidVolumeBehavior(deviceVolumeBehavior); @@ -6847,12 +6847,12 @@ public class AudioService extends IAudioService.Stub @Retention(RetentionPolicy.SOURCE) public @interface ConnectionState {} + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** * see AudioManager.setWiredDeviceConnectionState() */ public void setWiredDeviceConnectionState(AudioDeviceAttributes attributes, @ConnectionState int state, String caller) { - enforceModifyAudioRoutingPermission(); if (state != CONNECTION_STATE_CONNECTED && state != CONNECTION_STATE_DISCONNECTED) { throw new IllegalArgumentException("Invalid state " + state); @@ -8970,27 +8970,27 @@ public class AudioService extends IAudioService.Stub return mSpatializerHelper.isAvailable(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#isAvailableForDevice(AudioDeviceAttributes) */ public boolean isSpatializerAvailableForDevice(@NonNull AudioDeviceAttributes device) { - enforceModifyDefaultAudioEffectsPermission(); return mSpatializerHelper.isAvailableForDevice(Objects.requireNonNull(device)); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#hasHeadTracker(AudioDeviceAttributes) */ public boolean hasHeadTracker(@NonNull AudioDeviceAttributes device) { - enforceModifyDefaultAudioEffectsPermission(); return mSpatializerHelper.hasHeadTracker(Objects.requireNonNull(device)); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#setHeadTrackerEnabled(boolean, AudioDeviceAttributes) */ public void setHeadTrackerEnabled(boolean enabled, @NonNull AudioDeviceAttributes device) { - enforceModifyDefaultAudioEffectsPermission(); mSpatializerHelper.setHeadTrackerEnabled(enabled, Objects.requireNonNull(device)); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#isHeadTrackerEnabled(AudioDeviceAttributes) */ public boolean isHeadTrackerEnabled(@NonNull AudioDeviceAttributes device) { - enforceModifyDefaultAudioEffectsPermission(); return mSpatializerHelper.isHeadTrackerEnabled(Objects.requireNonNull(device)); } @@ -8999,9 +8999,9 @@ public class AudioService extends IAudioService.Stub return mSpatializerHelper.isHeadTrackerAvailable(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#setSpatializerEnabled(boolean) */ public void setSpatializerEnabled(boolean enabled) { - enforceModifyDefaultAudioEffectsPermission(); mSpatializerHelper.setFeatureEnabled(enabled); } @@ -9027,18 +9027,18 @@ public class AudioService extends IAudioService.Stub mSpatializerHelper.unregisterStateCallback(cb); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#SpatializerHeadTrackingDispatcherStub */ public void registerSpatializerHeadTrackingCallback( @NonNull ISpatializerHeadTrackingModeCallback cb) { - enforceModifyDefaultAudioEffectsPermission(); Objects.requireNonNull(cb); mSpatializerHelper.registerHeadTrackingModeCallback(cb); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#SpatializerHeadTrackingDispatcherStub */ public void unregisterSpatializerHeadTrackingCallback( @NonNull ISpatializerHeadTrackingModeCallback cb) { - enforceModifyDefaultAudioEffectsPermission(); Objects.requireNonNull(cb); mSpatializerHelper.unregisterHeadTrackingModeCallback(cb); } @@ -9050,76 +9050,76 @@ public class AudioService extends IAudioService.Stub mSpatializerHelper.registerHeadTrackerAvailableCallback(cb, register); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#setOnHeadToSoundstagePoseUpdatedListener */ public void registerHeadToSoundstagePoseCallback( @NonNull ISpatializerHeadToSoundStagePoseCallback cb) { - enforceModifyDefaultAudioEffectsPermission(); Objects.requireNonNull(cb); mSpatializerHelper.registerHeadToSoundstagePoseCallback(cb); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#clearOnHeadToSoundstagePoseUpdatedListener */ public void unregisterHeadToSoundstagePoseCallback( @NonNull ISpatializerHeadToSoundStagePoseCallback cb) { - enforceModifyDefaultAudioEffectsPermission(); Objects.requireNonNull(cb); mSpatializerHelper.unregisterHeadToSoundstagePoseCallback(cb); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#getSpatializerCompatibleAudioDevices() */ public @NonNull List getSpatializerCompatibleAudioDevices() { - enforceModifyDefaultAudioEffectsPermission(); return mSpatializerHelper.getCompatibleAudioDevices(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#addSpatializerCompatibleAudioDevice(AudioDeviceAttributes) */ public void addSpatializerCompatibleAudioDevice(@NonNull AudioDeviceAttributes ada) { - enforceModifyDefaultAudioEffectsPermission(); Objects.requireNonNull(ada); mSpatializerHelper.addCompatibleAudioDevice(ada); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#removeSpatializerCompatibleAudioDevice(AudioDeviceAttributes) */ public void removeSpatializerCompatibleAudioDevice(@NonNull AudioDeviceAttributes ada) { - enforceModifyDefaultAudioEffectsPermission(); Objects.requireNonNull(ada); mSpatializerHelper.removeCompatibleAudioDevice(ada); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#getSupportedHeadTrackingModes() */ public int[] getSupportedHeadTrackingModes() { - enforceModifyDefaultAudioEffectsPermission(); return mSpatializerHelper.getSupportedHeadTrackingModes(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#getHeadTrackingMode() */ public int getActualHeadTrackingMode() { - enforceModifyDefaultAudioEffectsPermission(); return mSpatializerHelper.getActualHeadTrackingMode(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#getDesiredHeadTrackingMode() */ public int getDesiredHeadTrackingMode() { - enforceModifyDefaultAudioEffectsPermission(); return mSpatializerHelper.getDesiredHeadTrackingMode(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#setGlobalTransform */ public void setSpatializerGlobalTransform(@NonNull float[] transform) { - enforceModifyDefaultAudioEffectsPermission(); Objects.requireNonNull(transform); mSpatializerHelper.setGlobalTransform(transform); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#recenterHeadTracker() */ public void recenterHeadTracker() { - enforceModifyDefaultAudioEffectsPermission(); mSpatializerHelper.recenterHeadTracker(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#setDesiredHeadTrackingMode */ public void setDesiredHeadTrackingMode(@Spatializer.HeadTrackingModeSet int mode) { - enforceModifyDefaultAudioEffectsPermission(); switch(mode) { case Spatializer.HEAD_TRACKING_MODE_DISABLED: case Spatializer.HEAD_TRACKING_MODE_RELATIVE_WORLD: @@ -9131,36 +9131,36 @@ public class AudioService extends IAudioService.Stub mSpatializerHelper.setDesiredHeadTrackingMode(mode); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#setEffectParameter */ public void setSpatializerParameter(int key, @NonNull byte[] value) { - enforceModifyDefaultAudioEffectsPermission(); Objects.requireNonNull(value); mSpatializerHelper.setEffectParameter(key, value); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#getEffectParameter */ public void getSpatializerParameter(int key, @NonNull byte[] value) { - enforceModifyDefaultAudioEffectsPermission(); Objects.requireNonNull(value); mSpatializerHelper.getEffectParameter(key, value); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#getOutput */ public int getSpatializerOutput() { - enforceModifyDefaultAudioEffectsPermission(); return mSpatializerHelper.getOutput(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#setOnSpatializerOutputChangedListener */ public void registerSpatializerOutputCallback(ISpatializerOutputCallback cb) { - enforceModifyDefaultAudioEffectsPermission(); Objects.requireNonNull(cb); mSpatializerHelper.registerSpatializerOutputCallback(cb); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_DEFAULT_AUDIO_EFFECTS) /** @see Spatializer#clearOnSpatializerOutputChangedListener */ public void unregisterSpatializerOutputCallback(ISpatializerOutputCallback cb) { - enforceModifyDefaultAudioEffectsPermission(); Objects.requireNonNull(cb); mSpatializerHelper.unregisterSpatializerOutputCallback(cb); } @@ -9268,9 +9268,9 @@ public class AudioService extends IAudioService.Stub cb.dispatchOnMutedUntilConnection(device, usages); } catch (RemoteException e) { } }); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** @see AudioManager#getMutingExpectedDevice */ public @Nullable AudioDeviceAttributes getMutingExpectedDevice() { - enforceModifyAudioRoutingPermission(); synchronized (mMuteAwaitConnectionLock) { return mMutingExpectedDevice; } @@ -9308,10 +9308,10 @@ public class AudioService extends IAudioService.Stub final RemoteCallbackList mMuteAwaitConnectionDispatchers = new RemoteCallbackList(); + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** @see AudioManager#registerMuteAwaitConnectionCallback */ public void registerMuteAwaitConnectionDispatcher(@NonNull IMuteAwaitConnectionCallback cb, boolean register) { - enforceModifyAudioRoutingPermission(); if (register) { mMuteAwaitConnectionDispatchers.register(cb); } else { @@ -10817,9 +10817,9 @@ public class AudioService extends IAudioService.Stub return AudioManager.SUCCESS; } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** @see AudioPolicy#getFocusStack() */ public List getFocusStack() { - enforceModifyAudioRoutingPermission(); return mMediaFocusControl.getFocusStack(); } @@ -11582,11 +11582,11 @@ public class AudioService extends IAudioService.Stub AudioSystem.setAudioHalPids(pidsArray); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) //====================== // Multi Audio Focus //====================== public void setMultiAudioFocusEnabled(boolean enabled) { - enforceModifyAudioRoutingPermission(); if (mMediaFocusControl != null) { boolean mafEnabled = mMediaFocusControl.getMultiAudioFocusEnabled(); if (mafEnabled != enabled) { @@ -11685,10 +11685,10 @@ public class AudioService extends IAudioService.Stub return delayMillis; } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** @see AudioManager#addAssistantServicesUids(int []) */ @Override public void addAssistantServicesUids(int [] assistantUids) { - enforceModifyAudioRoutingPermission(); Objects.requireNonNull(assistantUids); synchronized (mSettingsLock) { @@ -11696,20 +11696,20 @@ public class AudioService extends IAudioService.Stub } } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** @see AudioManager#removeAssistantServicesUids(int []) */ @Override public void removeAssistantServicesUids(int [] assistantUids) { - enforceModifyAudioRoutingPermission(); Objects.requireNonNull(assistantUids); synchronized (mSettingsLock) { removeAssistantServiceUidsLocked(assistantUids); } } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** @see AudioManager#getAssistantServicesUids() */ @Override public int[] getAssistantServicesUids() { - enforceModifyAudioRoutingPermission(); int [] assistantUids; synchronized (mSettingsLock) { assistantUids = mAssistantUids.stream().mapToInt(Integer::intValue).toArray(); @@ -11717,10 +11717,10 @@ public class AudioService extends IAudioService.Stub return assistantUids; } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** @see AudioManager#setActiveAssistantServiceUids(int []) */ @Override public void setActiveAssistantServiceUids(int [] activeAssistantUids) { - enforceModifyAudioRoutingPermission(); Objects.requireNonNull(activeAssistantUids); synchronized (mSettingsLock) { mActiveAssistantServiceUids = activeAssistantUids; @@ -11728,10 +11728,10 @@ public class AudioService extends IAudioService.Stub updateActiveAssistantServiceUids(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MODIFY_AUDIO_ROUTING) /** @see AudioManager#getActiveAssistantServiceUids() */ @Override public int[] getActiveAssistantServiceUids() { - enforceModifyAudioRoutingPermission(); int [] activeAssistantUids; synchronized (mSettingsLock) { activeAssistantUids = mActiveAssistantServiceUids.clone(); diff --git a/services/core/java/com/android/server/biometrics/AuthService.java b/services/core/java/com/android/server/biometrics/AuthService.java index bc550d3113703..d2016c473bf44 100644 --- a/services/core/java/com/android/server/biometrics/AuthService.java +++ b/services/core/java/com/android/server/biometrics/AuthService.java @@ -173,10 +173,10 @@ public class AuthService extends SystemService { } private final class AuthServiceImpl extends IAuthService.Stub { + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public ITestSession createTestSession(int sensorId, @NonNull ITestSessionCallback callback, @NonNull String opPackageName) throws RemoteException { - Utils.checkPermission(getContext(), TEST_BIOMETRIC); final long identity = Binder.clearCallingIdentity(); try { @@ -187,10 +187,10 @@ public class AuthService extends SystemService { } } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public List getSensorProperties(String opPackageName) throws RemoteException { - Utils.checkPermission(getContext(), TEST_BIOMETRIC); final long identity = Binder.clearCallingIdentity(); try { @@ -202,9 +202,9 @@ public class AuthService extends SystemService { } } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public String getUiPackage() { - Utils.checkPermission(getContext(), TEST_BIOMETRIC); return getContext().getResources() .getString(R.string.config_biometric_prompt_ui_package); diff --git a/services/core/java/com/android/server/biometrics/BiometricService.java b/services/core/java/com/android/server/biometrics/BiometricService.java index 4767969bd3ed5..689ddd2fb9ee2 100644 --- a/services/core/java/com/android/server/biometrics/BiometricService.java +++ b/services/core/java/com/android/server/biometrics/BiometricService.java @@ -491,10 +491,10 @@ public class BiometricService extends SystemService { * sensor arbitration, threading, etc. */ private final class BiometricServiceWrapper extends IBiometricService.Stub { + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public ITestSession createTestSession(int sensorId, @NonNull ITestSessionCallback callback, @NonNull String opPackageName) throws RemoteException { - checkInternalPermission(); for (BiometricSensor sensor : mSensors) { if (sensor.id == sensorId) { @@ -506,10 +506,10 @@ public class BiometricService extends SystemService { return null; } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public List getSensorProperties(String opPackageName) throws RemoteException { - checkInternalPermission(); final List sensors = new ArrayList<>(); for (BiometricSensor sensor : mSensors) { @@ -523,17 +523,17 @@ public class BiometricService extends SystemService { return sensors; } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void onReadyForAuthentication(long requestId, int cookie) { - checkInternalPermission(); mHandler.post(() -> handleOnReadyForAuthentication(requestId, cookie)); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public long authenticate(IBinder token, long operationId, int userId, IBiometricServiceReceiver receiver, String opPackageName, PromptInfo promptInfo) { - checkInternalPermission(); if (token == null || receiver == null || opPackageName == null || promptInfo == null) { Slog.e(TAG, "Unable to authenticate, one or more null arguments"); @@ -561,9 +561,9 @@ public class BiometricService extends SystemService { return requestId; } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void cancelAuthentication(IBinder token, String opPackageName, long requestId) { - checkInternalPermission(); SomeArgs args = SomeArgs.obtain(); args.arg1 = token; @@ -573,10 +573,10 @@ public class BiometricService extends SystemService { mHandler.post(() -> handleCancelAuthentication(requestId)); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public int canAuthenticate(String opPackageName, int userId, int callingUserId, @Authenticators.Types int authenticators) { - checkInternalPermission(); Slog.d(TAG, "canAuthenticate: User=" + userId + ", Caller=" + callingUserId @@ -596,9 +596,9 @@ public class BiometricService extends SystemService { } } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public boolean hasEnrolledBiometrics(int userId, String opPackageName) { - checkInternalPermission(); try { for (BiometricSensor sensor : mSensors) { @@ -613,11 +613,11 @@ public class BiometricService extends SystemService { return false; } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public synchronized void registerAuthenticator(int id, int modality, @Authenticators.Types int strength, @NonNull IBiometricAuthenticator authenticator) { - checkInternalPermission(); Slog.d(TAG, "Registering ID: " + id + " Modality: " + modality @@ -660,10 +660,10 @@ public class BiometricService extends SystemService { mBiometricStrengthController.updateStrengths(); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void registerEnabledOnKeyguardCallback( IBiometricEnabledOnKeyguardCallback callback, int callingUserId) { - checkInternalPermission(); mEnabledOnKeyguardCallbacks.add(new EnabledOnKeyguardCallback(callback)); try { @@ -674,17 +674,17 @@ public class BiometricService extends SystemService { } } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void invalidateAuthenticatorIds(int userId, int fromSensorId, IInvalidationCallback callback) { - checkInternalPermission(); InvalidationTracker.start(getContext(), mSensors, userId, fromSensorId, callback); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public long[] getAuthenticatorIds(int callingUserId) { - checkInternalPermission(); final List authenticatorIds = new ArrayList<>(); for (BiometricSensor sensor : mSensors) { @@ -712,10 +712,10 @@ public class BiometricService extends SystemService { return result; } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void resetLockoutTimeBound(IBinder token, String opPackageName, int fromSensorId, int userId, byte[] hardwareAuthToken) { - checkInternalPermission(); // Check originating strength if (!Utils.isAtLeastStrength(getSensorForId(fromSensorId).getCurrentStrength(), @@ -751,9 +751,9 @@ public class BiometricService extends SystemService { } } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public int getCurrentStrength(int sensorId) { - checkInternalPermission(); for (BiometricSensor sensor : mSensors) { if (sensor.id == sensorId) { @@ -764,6 +764,7 @@ public class BiometricService extends SystemService { return Authenticators.EMPTY_SET; } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public int getCurrentModality( String opPackageName, @@ -771,7 +772,6 @@ public class BiometricService extends SystemService { int callingUserId, @Authenticators.Types int authenticators) { - checkInternalPermission(); Slog.d(TAG, "getCurrentModality: User=" + userId + ", Caller=" + callingUserId @@ -791,9 +791,9 @@ public class BiometricService extends SystemService { } } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public int getSupportedModalities(@Authenticators.Types int authenticators) { - checkInternalPermission(); Slog.d(TAG, "getSupportedModalities: Authenticators=" + authenticators); diff --git a/services/core/java/com/android/server/biometrics/sensors/face/FaceService.java b/services/core/java/com/android/server/biometrics/sensors/face/FaceService.java index 75d09f2051925..79e65cc6d2e54 100644 --- a/services/core/java/com/android/server/biometrics/sensors/face/FaceService.java +++ b/services/core/java/com/android/server/biometrics/sensors/face/FaceService.java @@ -138,10 +138,10 @@ public class FaceService extends SystemService { * Receives the incoming binder calls from FaceManager. */ private final class FaceServiceWrapper extends IFaceService.Stub { + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public ITestSession createTestSession(int sensorId, @NonNull ITestSessionCallback callback, @NonNull String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); @@ -153,9 +153,9 @@ public class FaceService extends SystemService { return provider.createTestSession(sensorId, callback, opPackageName); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public byte[] dumpSensorServiceStateProto(int sensorId, boolean clearSchedulerBuffer) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ProtoOutputStream proto = new ProtoOutputStream(); final ServiceProvider provider = getProviderForSensor(sensorId); @@ -166,18 +166,18 @@ public class FaceService extends SystemService { return proto.getBytes(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_BIOMETRIC) @Override // Binder call public List getSensorPropertiesInternal( String opPackageName) { - Utils.checkPermission(getContext(), MANAGE_BIOMETRIC); return FaceService.this.getSensorProperties(); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public FaceSensorPropertiesInternal getSensorProperties(int sensorId, @NonNull String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -189,10 +189,10 @@ public class FaceService extends SystemService { return provider.getSensorProperties(sensorId); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_BIOMETRIC) @Override // Binder call public void generateChallenge(IBinder token, int sensorId, int userId, IFaceServiceReceiver receiver, String opPackageName) { - Utils.checkPermission(getContext(), MANAGE_BIOMETRIC); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -203,10 +203,10 @@ public class FaceService extends SystemService { provider.scheduleGenerateChallenge(sensorId, userId, token, receiver, opPackageName); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_BIOMETRIC) @Override // Binder call public void revokeChallenge(IBinder token, int sensorId, int userId, String opPackageName, long challenge) { - Utils.checkPermission(getContext(), MANAGE_BIOMETRIC); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -217,11 +217,11 @@ public class FaceService extends SystemService { provider.scheduleRevokeChallenge(sensorId, userId, token, opPackageName, challenge); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_BIOMETRIC) @Override // Binder call public long enroll(int userId, final IBinder token, final byte[] hardwareAuthToken, final IFaceServiceReceiver receiver, final String opPackageName, final int[] disabledFeatures, Surface previewSurface, boolean debugConsent) { - Utils.checkPermission(getContext(), MANAGE_BIOMETRIC); final Pair provider = getSingleProvider(); if (provider == null) { @@ -233,18 +233,18 @@ public class FaceService extends SystemService { receiver, opPackageName, disabledFeatures, previewSurface, debugConsent); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_BIOMETRIC) @Override // Binder call public long enrollRemotely(int userId, final IBinder token, final byte[] hardwareAuthToken, final IFaceServiceReceiver receiver, final String opPackageName, final int[] disabledFeatures) { - Utils.checkPermission(getContext(), MANAGE_BIOMETRIC); // TODO(b/145027036): Implement this. return -1; } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_BIOMETRIC) @Override // Binder call public void cancelEnrollment(final IBinder token, long requestId) { - Utils.checkPermission(getContext(), MANAGE_BIOMETRIC); final Pair provider = getSingleProvider(); if (provider == null) { @@ -255,11 +255,11 @@ public class FaceService extends SystemService { provider.second.cancelEnrollment(provider.first, token, requestId); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public long authenticate(final IBinder token, final long operationId, int userId, final IFaceServiceReceiver receiver, final String opPackageName, boolean isKeyguardBypassEnabled) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); // TODO(b/152413782): If the sensor supports face detect and the device is encrypted or // lockdown, something wrong happened. See similar path in FingerprintService. @@ -285,10 +285,10 @@ public class FaceService extends SystemService { statsClient, isKeyguard, isKeyguardBypassEnabled); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public long detectFace(final IBinder token, final int userId, final IFaceServiceReceiver receiver, final String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); if (!Utils.isKeyguard(getContext(), opPackageName)) { Slog.w(TAG, "detectFace called from non-sysui package: " + opPackageName); return -1; @@ -312,12 +312,12 @@ public class FaceService extends SystemService { BiometricsProtoEnums.CLIENT_KEYGUARD); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void prepareForAuthentication(int sensorId, boolean requireConfirmation, IBinder token, long operationId, int userId, IBiometricSensorReceiver sensorReceiver, String opPackageName, long requestId, int cookie, boolean allowBackgroundAuthentication) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -333,9 +333,9 @@ public class FaceService extends SystemService { allowBackgroundAuthentication, isKeyguardBypassEnabled); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void startPreparedClient(int sensorId, int cookie) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -346,10 +346,10 @@ public class FaceService extends SystemService { provider.startPreparedClient(sensorId, cookie); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void cancelAuthentication(final IBinder token, final String opPackageName, final long requestId) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final Pair provider = getSingleProvider(); if (provider == null) { @@ -360,10 +360,10 @@ public class FaceService extends SystemService { provider.second.cancelAuthentication(provider.first, token, requestId); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void cancelFaceDetect(final IBinder token, final String opPackageName, final long requestId) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); if (!Utils.isKeyguard(getContext(), opPackageName)) { Slog.w(TAG, "cancelFaceDetect called from non-sysui package: " + opPackageName); @@ -379,10 +379,10 @@ public class FaceService extends SystemService { provider.second.cancelFaceDetect(provider.first, token, requestId); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void cancelAuthenticationFromService(int sensorId, final IBinder token, final String opPackageName, final long requestId) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -393,10 +393,10 @@ public class FaceService extends SystemService { provider.cancelAuthentication(sensorId, token, requestId); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void remove(final IBinder token, final int faceId, final int userId, final IFaceServiceReceiver receiver, final String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final Pair provider = getSingleProvider(); if (provider == null) { @@ -408,10 +408,10 @@ public class FaceService extends SystemService { opPackageName); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void removeAll(final IBinder token, final int userId, final IFaceServiceReceiver receiver, final String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final FaceServiceReceiver internalReceiver = new FaceServiceReceiver() { int sensorsFinishedRemoving = 0; @@ -441,10 +441,10 @@ public class FaceService extends SystemService { } } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void addLockoutResetCallback(final IBiometricServiceLockoutResetCallback callback, final String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); mLockoutResetDispatcher.addCallback(callback, opPackageName); } @@ -501,9 +501,9 @@ public class FaceService extends SystemService { } } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public boolean isHardwareDetected(int sensorId, String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final long token = Binder.clearCallingIdentity(); try { @@ -518,9 +518,9 @@ public class FaceService extends SystemService { } } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public List getEnrolledFaces(int sensorId, int userId, String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); if (userId != UserHandle.getCallingUserId()) { Utils.checkPermission(getContext(), INTERACT_ACROSS_USERS); @@ -535,9 +535,9 @@ public class FaceService extends SystemService { return provider.getEnrolledFaces(sensorId, userId); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public boolean hasEnrolledFaces(int sensorId, int userId, String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); if (userId != UserHandle.getCallingUserId()) { Utils.checkPermission(getContext(), INTERACT_ACROSS_USERS); @@ -552,9 +552,9 @@ public class FaceService extends SystemService { return provider.getEnrolledFaces(sensorId, userId).size() > 0; } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public @LockoutTracker.LockoutMode int getLockoutModeForUser(int sensorId, int userId) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -565,10 +565,10 @@ public class FaceService extends SystemService { return provider.getLockoutModeForUser(sensorId, userId); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public void invalidateAuthenticatorId(int sensorId, int userId, IInvalidationCallback callback) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -578,9 +578,9 @@ public class FaceService extends SystemService { provider.scheduleInvalidateAuthenticatorId(sensorId, userId, callback); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public long getAuthenticatorId(int sensorId, int userId) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -591,10 +591,10 @@ public class FaceService extends SystemService { return provider.getAuthenticatorId(sensorId, userId); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void resetLockout(IBinder token, int sensorId, int userId, byte[] hardwareAuthToken, String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -605,11 +605,11 @@ public class FaceService extends SystemService { provider.scheduleResetLockout(sensorId, userId, hardwareAuthToken); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public void setFeature(final IBinder token, int userId, int feature, boolean enabled, final byte[] hardwareAuthToken, IFaceServiceReceiver receiver, final String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final Pair provider = getSingleProvider(); if (provider == null) { @@ -621,10 +621,10 @@ public class FaceService extends SystemService { hardwareAuthToken, receiver, opPackageName); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_BIOMETRIC) @Override public void getFeature(final IBinder token, int userId, int feature, IFaceServiceReceiver receiver, final String opPackageName) { - Utils.checkPermission(getContext(), MANAGE_BIOMETRIC); final Pair provider = getSingleProvider(); if (provider == null) { @@ -667,10 +667,10 @@ public class FaceService extends SystemService { } } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void registerAuthenticators( @NonNull List hidlSensors) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); // Some HAL might not be started before the system service and will cause the code below // to wait, and some of the operations below might take a significant amount of time to diff --git a/services/core/java/com/android/server/biometrics/sensors/face/aidl/BiometricTestSessionImpl.java b/services/core/java/com/android/server/biometrics/sensors/face/aidl/BiometricTestSessionImpl.java index 9bd7476abca21..73c272f7a779a 100644 --- a/services/core/java/com/android/server/biometrics/sensors/face/aidl/BiometricTestSessionImpl.java +++ b/services/core/java/com/android/server/biometrics/sensors/face/aidl/BiometricTestSessionImpl.java @@ -138,26 +138,26 @@ public class BiometricTestSessionImpl extends ITestSession.Stub { mRandom = new Random(); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void setTestHalEnabled(boolean enabled) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mProvider.setTestHalEnabled(enabled); mSensor.setTestHalEnabled(enabled); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void startEnroll(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mProvider.scheduleEnroll(mSensorId, new Binder(), new byte[69], userId, mReceiver, mContext.getOpPackageName(), new int[0] /* disabledFeatures */, null /* previewSurface */, false /* debugConsent */); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void finishEnroll(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); int nextRandomId = mRandom.nextInt(); while (mEnrollmentIds.contains(nextRandomId)) { @@ -169,9 +169,9 @@ public class BiometricTestSessionImpl extends ITestSession.Stub { .onEnrollmentProgress(nextRandomId, 0 /* remaining */); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void acceptAuthentication(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); // Fake authentication with any of the existing faces List faces = FaceUtils.getInstance(mSensorId) @@ -185,17 +185,17 @@ public class BiometricTestSessionImpl extends ITestSession.Stub { HardwareAuthTokenUtils.toHardwareAuthToken(new byte[69])); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void rejectAuthentication(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mSensor.getSessionForUser(userId).getHalSessionCallback().onAuthenticationFailed(); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) // TODO(b/178414967): replace with notifyAuthenticationFrame and notifyEnrollmentFrame. @Override public void notifyAcquired(int userId, int acquireInfo) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); BaseFrame data = new BaseFrame(); data.acquiredInfo = (byte) acquireInfo; @@ -209,17 +209,17 @@ public class BiometricTestSessionImpl extends ITestSession.Stub { authenticationFrame); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void notifyError(int userId, int errorCode) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mSensor.getSessionForUser(userId).getHalSessionCallback().onError((byte) errorCode, 0 /* vendorCode */); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void cleanupInternalState(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); Slog.d(TAG, "cleanupInternalState: " + userId); mProvider.scheduleInternalCleanup(mSensorId, userId, new ClientMonitorCallback() { diff --git a/services/core/java/com/android/server/biometrics/sensors/face/hidl/BiometricTestSessionImpl.java b/services/core/java/com/android/server/biometrics/sensors/face/hidl/BiometricTestSessionImpl.java index e7483b3eeae3b..14af216a9dc56 100644 --- a/services/core/java/com/android/server/biometrics/sensors/face/hidl/BiometricTestSessionImpl.java +++ b/services/core/java/com/android/server/biometrics/sensors/face/hidl/BiometricTestSessionImpl.java @@ -127,25 +127,25 @@ public class BiometricTestSessionImpl extends ITestSession.Stub { mRandom = new Random(); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void setTestHalEnabled(boolean enabled) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mFace10.setTestHalEnabled(enabled); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void startEnroll(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mFace10.scheduleEnroll(mSensorId, new Binder(), new byte[69], userId, mReceiver, mContext.getOpPackageName(), new int[0] /* disabledFeatures */, null /* previewSurface */, false /* debugConsent */); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void finishEnroll(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); int nextRandomId = mRandom.nextInt(); while (mEnrollmentIds.contains(nextRandomId)) { @@ -157,9 +157,9 @@ public class BiometricTestSessionImpl extends ITestSession.Stub { nextRandomId /* faceId */, userId, 0); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void acceptAuthentication(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); // Fake authentication with any of the existing fingers List faces = FaceUtils.getLegacyInstance(mSensorId) @@ -173,30 +173,30 @@ public class BiometricTestSessionImpl extends ITestSession.Stub { mHalResultController.onAuthenticated(0 /* deviceId */, fid, userId, hat); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void rejectAuthentication(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mHalResultController.onAuthenticated(0 /* deviceId */, 0 /* faceId */, userId, null); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void notifyAcquired(int userId, int acquireInfo) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mHalResultController.onAcquired(0 /* deviceId */, userId, acquireInfo, 0 /* vendorCode */); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void notifyError(int userId, int errorCode) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mHalResultController.onError(0 /* deviceId */, userId, errorCode, 0 /* vendorCode */); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void cleanupInternalState(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mFace10.scheduleInternalCleanup(mSensorId, userId, new ClientMonitorCallback() { @Override diff --git a/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintService.java b/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintService.java index 17b63736029e9..64a01360b8423 100644 --- a/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintService.java +++ b/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintService.java @@ -177,10 +177,10 @@ public class FingerprintService extends SystemService { * Receives the incoming binder calls from FingerprintManager. */ private final IFingerprintService.Stub mServiceWrapper = new IFingerprintService.Stub() { + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public ITestSession createTestSession(int sensorId, @NonNull ITestSessionCallback callback, @NonNull String opPackageName) { - Utils.checkPermission(getContext(), TEST_BIOMETRIC); final ServiceProvider provider = getProviderForSensor(sensorId); @@ -192,9 +192,9 @@ public class FingerprintService extends SystemService { return provider.createTestSession(sensorId, callback, opPackageName); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public byte[] dumpSensorServiceStateProto(int sensorId, boolean clearSchedulerBuffer) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ProtoOutputStream proto = new ProtoOutputStream(); final ServiceProvider provider = getProviderForSensor(sensorId); @@ -216,10 +216,10 @@ public class FingerprintService extends SystemService { return FingerprintService.this.getSensorProperties(); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public FingerprintSensorPropertiesInternal getSensorProperties(int sensorId, @NonNull String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -230,10 +230,10 @@ public class FingerprintService extends SystemService { return provider.getSensorProperties(sensorId); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_FINGERPRINT) @Override // Binder call public void generateChallenge(IBinder token, int sensorId, int userId, IFingerprintServiceReceiver receiver, String opPackageName) { - Utils.checkPermission(getContext(), MANAGE_FINGERPRINT); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -244,10 +244,10 @@ public class FingerprintService extends SystemService { provider.scheduleGenerateChallenge(sensorId, userId, token, receiver, opPackageName); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_FINGERPRINT) @Override // Binder call public void revokeChallenge(IBinder token, int sensorId, int userId, String opPackageName, long challenge) { - Utils.checkPermission(getContext(), MANAGE_FINGERPRINT); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -259,11 +259,11 @@ public class FingerprintService extends SystemService { challenge); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_FINGERPRINT) @Override // Binder call public long enroll(final IBinder token, @NonNull final byte[] hardwareAuthToken, final int userId, final IFingerprintServiceReceiver receiver, final String opPackageName, @FingerprintManager.EnrollReason int enrollReason) { - Utils.checkPermission(getContext(), MANAGE_FINGERPRINT); final Pair provider = getSingleProvider(); if (provider == null) { @@ -275,9 +275,9 @@ public class FingerprintService extends SystemService { receiver, opPackageName, enrollReason); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_FINGERPRINT) @Override // Binder call public void cancelEnrollment(final IBinder token, long requestId) { - Utils.checkPermission(getContext(), MANAGE_FINGERPRINT); final Pair provider = getSingleProvider(); if (provider == null) { @@ -452,10 +452,10 @@ public class FingerprintService extends SystemService { new CancellationSignal(), executor, promptCallback, operationId); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public long detectFingerprint(final IBinder token, final int userId, final IFingerprintServiceReceiver receiver, final String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); if (!Utils.isKeyguard(getContext(), opPackageName)) { Slog.w(TAG, "detectFingerprint called from non-sysui package: " + opPackageName); return -1; @@ -479,11 +479,11 @@ public class FingerprintService extends SystemService { BiometricsProtoEnums.CLIENT_KEYGUARD); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_BIOMETRIC) @Override // Binder call public void prepareForAuthentication(int sensorId, IBinder token, long operationId, int userId, IBiometricSensorReceiver sensorReceiver, String opPackageName, long requestId, int cookie, boolean allowBackgroundAuthentication) { - Utils.checkPermission(getContext(), MANAGE_BIOMETRIC); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -498,9 +498,9 @@ public class FingerprintService extends SystemService { allowBackgroundAuthentication); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_BIOMETRIC) @Override // Binder call public void startPreparedClient(int sensorId, int cookie) { - Utils.checkPermission(getContext(), MANAGE_BIOMETRIC); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -541,10 +541,10 @@ public class FingerprintService extends SystemService { provider.second.cancelAuthentication(provider.first, token, requestId); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void cancelFingerprintDetect(final IBinder token, final String opPackageName, final long requestId) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); if (!Utils.isKeyguard(getContext(), opPackageName)) { Slog.w(TAG, "cancelFingerprintDetect called from non-sysui package: " + opPackageName); @@ -562,11 +562,11 @@ public class FingerprintService extends SystemService { provider.second.cancelAuthentication(provider.first, token, requestId); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_BIOMETRIC) @Override // Binder call public void cancelAuthenticationFromService(final int sensorId, final IBinder token, final String opPackageName, final long requestId) { - Utils.checkPermission(getContext(), MANAGE_BIOMETRIC); Slog.d(TAG, "cancelAuthenticationFromService, sensorId: " + sensorId); @@ -579,10 +579,10 @@ public class FingerprintService extends SystemService { provider.cancelAuthentication(sensorId, token, requestId); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_FINGERPRINT) @Override // Binder call public void remove(final IBinder token, final int fingerId, final int userId, final IFingerprintServiceReceiver receiver, final String opPackageName) { - Utils.checkPermission(getContext(), MANAGE_FINGERPRINT); final Pair provider = getSingleProvider(); if (provider == null) { @@ -593,10 +593,10 @@ public class FingerprintService extends SystemService { opPackageName); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void removeAll(final IBinder token, final int userId, final IFingerprintServiceReceiver receiver, final String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final FingerprintServiceReceiver internalReceiver = new FingerprintServiceReceiver() { int sensorsFinishedRemoving = 0; @@ -626,10 +626,10 @@ public class FingerprintService extends SystemService { } } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void addLockoutResetCallback(final IBiometricServiceLockoutResetCallback callback, final String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); mLockoutResetDispatcher.addCallback(callback, opPackageName); } @@ -710,9 +710,9 @@ public class FingerprintService extends SystemService { } } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public boolean isHardwareDetected(int sensorId, String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -723,9 +723,9 @@ public class FingerprintService extends SystemService { return provider.isHardwareDetected(sensorId); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_FINGERPRINT) @Override // Binder call public void rename(final int fingerId, final int userId, final String name) { - Utils.checkPermission(getContext(), MANAGE_FINGERPRINT); if (!Utils.isCurrentUserOrProfile(getContext(), userId)) { return; } @@ -779,8 +779,8 @@ public class FingerprintService extends SystemService { .isEmpty(); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) public boolean hasEnrolledFingerprints(int sensorId, int userId, String opPackageName) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -791,9 +791,9 @@ public class FingerprintService extends SystemService { return provider.getEnrolledFingerprints(sensorId, userId).size() > 0; } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public @LockoutTracker.LockoutMode int getLockoutModeForUser(int sensorId, int userId) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -803,10 +803,10 @@ public class FingerprintService extends SystemService { return provider.getLockoutModeForUser(sensorId, userId); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public void invalidateAuthenticatorId(int sensorId, int userId, IInvalidationCallback callback) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -816,9 +816,9 @@ public class FingerprintService extends SystemService { provider.scheduleInvalidateAuthenticatorId(sensorId, userId, callback); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public long getAuthenticatorId(int sensorId, int userId) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -828,10 +828,10 @@ public class FingerprintService extends SystemService { return provider.getAuthenticatorId(sensorId, userId); } + @android.annotation.EnforcePermission(android.Manifest.permission.RESET_FINGERPRINT_LOCKOUT) @Override // Binder call public void resetLockout(IBinder token, int sensorId, int userId, @Nullable byte[] hardwareAuthToken, String opPackageName) { - Utils.checkPermission(getContext(), RESET_FINGERPRINT_LOCKOUT); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -842,28 +842,28 @@ public class FingerprintService extends SystemService { provider.scheduleResetLockout(sensorId, userId, hardwareAuthToken); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_FINGERPRINT) @Override public boolean isClientActive() { - Utils.checkPermission(getContext(), MANAGE_FINGERPRINT); return mGestureAvailabilityDispatcher.isAnySensorActive(); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_FINGERPRINT) @Override public void addClientActiveCallback(IFingerprintClientActiveCallback callback) { - Utils.checkPermission(getContext(), MANAGE_FINGERPRINT); mGestureAvailabilityDispatcher.registerCallback(callback); } + @android.annotation.EnforcePermission(android.Manifest.permission.MANAGE_FINGERPRINT) @Override public void removeClientActiveCallback(IFingerprintClientActiveCallback callback) { - Utils.checkPermission(getContext(), MANAGE_FINGERPRINT); mGestureAvailabilityDispatcher.removeCallback(callback); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void registerAuthenticators( @NonNull List hidlSensors) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); // Some HAL might not be started before the system service and will cause the code below // to wait, and some of the operations below might take a significant amount of time to @@ -885,10 +885,10 @@ public class FingerprintService extends SystemService { thread.quitSafely(); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public void addAuthenticatorsRegisteredCallback( IFingerprintAuthenticatorsRegisteredCallback callback) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); if (callback == null) { Slog.e(TAG, "addAuthenticatorsRegisteredCallback, callback is null"); return; @@ -907,10 +907,10 @@ public class FingerprintService extends SystemService { } } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public void onPointerDown(long requestId, int sensorId, int x, int y, float minor, float major) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -920,9 +920,9 @@ public class FingerprintService extends SystemService { provider.onPointerDown(requestId, sensorId, x, y, minor, major); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public void onPointerUp(long requestId, int sensorId) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -932,9 +932,9 @@ public class FingerprintService extends SystemService { provider.onPointerUp(requestId, sensorId); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public void onUiReady(long requestId, int sensorId) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); if (provider == null) { @@ -944,18 +944,18 @@ public class FingerprintService extends SystemService { provider.onUiReady(requestId, sensorId); } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public void setUdfpsOverlayController(@NonNull IUdfpsOverlayController controller) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); for (ServiceProvider provider : mServiceProviders) { provider.setUdfpsOverlayController(controller); } } + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override public void setSidefpsController(@NonNull ISidefpsController controller) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); for (ServiceProvider provider : mServiceProviders) { provider.setSidefpsController(controller); diff --git a/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/BiometricTestSessionImpl.java b/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/BiometricTestSessionImpl.java index ba7202fec93bb..4181b99f9abad 100644 --- a/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/BiometricTestSessionImpl.java +++ b/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/BiometricTestSessionImpl.java @@ -131,25 +131,25 @@ class BiometricTestSessionImpl extends ITestSession.Stub { mRandom = new Random(); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void setTestHalEnabled(boolean enabled) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mProvider.setTestHalEnabled(enabled); mSensor.setTestHalEnabled(enabled); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void startEnroll(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mProvider.scheduleEnroll(mSensorId, new Binder(), new byte[69], userId, mReceiver, mContext.getOpPackageName(), FingerprintManager.ENROLL_ENROLL); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void finishEnroll(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); int nextRandomId = mRandom.nextInt(); while (mEnrollmentIds.contains(nextRandomId)) { @@ -161,9 +161,9 @@ class BiometricTestSessionImpl extends ITestSession.Stub { .onEnrollmentProgress(nextRandomId, 0 /* remaining */); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void acceptAuthentication(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); // Fake authentication with any of the existing fingers List fingerprints = FingerprintUtils.getInstance(mSensorId) @@ -177,32 +177,32 @@ class BiometricTestSessionImpl extends ITestSession.Stub { HardwareAuthTokenUtils.toHardwareAuthToken(new byte[69])); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void rejectAuthentication(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mSensor.getSessionForUser(userId).getHalSessionCallback().onAuthenticationFailed(); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void notifyAcquired(int userId, int acquireInfo) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mSensor.getSessionForUser(userId).getHalSessionCallback() .onAcquired((byte) acquireInfo, 0 /* vendorCode */); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void notifyError(int userId, int errorCode) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mSensor.getSessionForUser(userId).getHalSessionCallback().onError((byte) errorCode, 0 /* vendorCode */); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void cleanupInternalState(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); Slog.d(TAG, "cleanupInternalState: " + userId); mProvider.scheduleInternalCleanup(mSensorId, userId, new ClientMonitorCallback() { diff --git a/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/BiometricTestSessionImpl.java b/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/BiometricTestSessionImpl.java index a58bb8981cf63..682c00536e103 100644 --- a/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/BiometricTestSessionImpl.java +++ b/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/BiometricTestSessionImpl.java @@ -132,24 +132,24 @@ public class BiometricTestSessionImpl extends ITestSession.Stub { mRandom = new Random(); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void setTestHalEnabled(boolean enabled) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mFingerprint21.setTestHalEnabled(enabled); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void startEnroll(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mFingerprint21.scheduleEnroll(mSensorId, new Binder(), new byte[69], userId, mReceiver, mContext.getOpPackageName(), FingerprintManager.ENROLL_ENROLL); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void finishEnroll(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); int nextRandomId = mRandom.nextInt(); while (mEnrollmentIds.contains(nextRandomId)) { @@ -161,9 +161,9 @@ public class BiometricTestSessionImpl extends ITestSession.Stub { nextRandomId /* fingerId */, userId, 0); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void acceptAuthentication(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); // Fake authentication with any of the existing fingers List fingerprints = FingerprintUtils.getLegacyInstance(mSensorId) @@ -177,30 +177,30 @@ public class BiometricTestSessionImpl extends ITestSession.Stub { mHalResultController.onAuthenticated(0 /* deviceId */, fid, userId, hat); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void rejectAuthentication(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mHalResultController.onAuthenticated(0 /* deviceId */, 0 /* fingerId */, userId, null); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void notifyAcquired(int userId, int acquireInfo) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mHalResultController.onAcquired(0 /* deviceId */, acquireInfo, 0 /* vendorCode */); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void notifyError(int userId, int errorCode) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mHalResultController.onError(0 /* deviceId */, errorCode, 0 /* vendorCode */); } + @android.annotation.EnforcePermission(android.Manifest.permission.TEST_BIOMETRIC) @Override public void cleanupInternalState(int userId) { - Utils.checkPermission(mContext, TEST_BIOMETRIC); mFingerprint21.scheduleInternalCleanup(mSensorId, userId, new ClientMonitorCallback() { @Override diff --git a/services/core/java/com/android/server/biometrics/sensors/iris/IrisService.java b/services/core/java/com/android/server/biometrics/sensors/iris/IrisService.java index d684bb8439674..ff1e7628c0bd8 100644 --- a/services/core/java/com/android/server/biometrics/sensors/iris/IrisService.java +++ b/services/core/java/com/android/server/biometrics/sensors/iris/IrisService.java @@ -55,9 +55,9 @@ public class IrisService extends SystemService { * Receives the incoming binder calls from IrisManager. */ private final class IrisServiceWrapper extends IIrisService.Stub { + @android.annotation.EnforcePermission(android.Manifest.permission.USE_BIOMETRIC_INTERNAL) @Override // Binder call public void registerAuthenticators(@NonNull List hidlSensors) { - Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); // Some HAL might not be started before the system service and will cause the code below // to wait, and some of the operations below might take a significant amount of time to diff --git a/services/core/java/com/android/server/location/contexthub/ContextHubService.java b/services/core/java/com/android/server/location/contexthub/ContextHubService.java index 7100ac8f0d9f6..d0fd2cb58195f 100644 --- a/services/core/java/com/android/server/location/contexthub/ContextHubService.java +++ b/services/core/java/com/android/server/location/contexthub/ContextHubService.java @@ -440,9 +440,9 @@ public class ContextHubService extends IContextHubService.Stub { new ContextHubShellCommand(mContext, this).exec(this, in, out, err, args, callback, result); } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) @Override public int registerCallback(IContextHubCallback callback) throws RemoteException { - checkPermissions(); mCallbacksList.register(callback); Log.d(TAG, "Added callback, total callbacks " + @@ -450,15 +450,15 @@ public class ContextHubService extends IContextHubService.Stub { return 0; } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) @Override public int[] getContextHubHandles() throws RemoteException { - checkPermissions(); return ContextHubServiceUtil.createPrimitiveIntArray(mContextHubIdToInfoMap.keySet()); } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) @Override public ContextHubInfo getContextHubInfo(int contextHubHandle) throws RemoteException { - checkPermissions(); if (!mContextHubIdToInfoMap.containsKey(contextHubHandle)) { Log.e(TAG, "Invalid Context Hub handle " + contextHubHandle + " in getContextHubInfo"); return null; @@ -467,6 +467,7 @@ public class ContextHubService extends IContextHubService.Stub { return mContextHubIdToInfoMap.get(contextHubHandle); } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) /** * Returns a List of ContextHubInfo object describing the available hubs. * @@ -474,7 +475,6 @@ public class ContextHubService extends IContextHubService.Stub { */ @Override public List getContextHubs() throws RemoteException { - checkPermissions(); return mContextHubInfoList; } @@ -538,9 +538,9 @@ public class ContextHubService extends IContextHubService.Stub { }; } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) @Override public int loadNanoApp(int contextHubHandle, NanoApp nanoApp) throws RemoteException { - checkPermissions(); if (mContextHubWrapper == null) { return -1; } @@ -565,9 +565,9 @@ public class ContextHubService extends IContextHubService.Stub { return 0; } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) @Override public int unloadNanoApp(int nanoAppHandle) throws RemoteException { - checkPermissions(); if (mContextHubWrapper == null) { return -1; } @@ -590,17 +590,17 @@ public class ContextHubService extends IContextHubService.Stub { return 0; } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) @Override public NanoAppInstanceInfo getNanoAppInstanceInfo(int nanoAppHandle) throws RemoteException { - checkPermissions(); return mNanoAppStateManager.getNanoAppInstanceInfo(nanoAppHandle); } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) @Override public int[] findNanoAppOnHub( int contextHubHandle, NanoAppFilter filter) throws RemoteException { - checkPermissions(); ArrayList foundInstances = new ArrayList<>(); if (filter != null) { @@ -642,10 +642,10 @@ public class ContextHubService extends IContextHubService.Stub { return true; } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) @Override public int sendMessage(int contextHubHandle, int nanoAppHandle, ContextHubMessage msg) throws RemoteException { - checkPermissions(); if (mContextHubWrapper == null) { return -1; } @@ -824,6 +824,7 @@ public class ContextHubService extends IContextHubService.Stub { return mContextHubIdToInfoMap.containsKey(contextHubId); } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) /** * Creates and registers a client at the service for the specified Context Hub. * @@ -840,7 +841,6 @@ public class ContextHubService extends IContextHubService.Stub { public IContextHubClient createClient( int contextHubId, IContextHubClientCallback clientCallback, @Nullable String attributionTag, String packageName) throws RemoteException { - checkPermissions(); if (!isValidContextHubId(contextHubId)) { throw new IllegalArgumentException("Invalid context hub ID " + contextHubId); } @@ -853,6 +853,7 @@ public class ContextHubService extends IContextHubService.Stub { contextHubInfo, clientCallback, attributionTag, mTransactionManager, packageName); } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) /** * Creates and registers a PendingIntent client at the service for the specified Context Hub. * @@ -868,7 +869,6 @@ public class ContextHubService extends IContextHubService.Stub { public IContextHubClient createPendingIntentClient( int contextHubId, PendingIntent pendingIntent, long nanoAppId, @Nullable String attributionTag) throws RemoteException { - checkPermissions(); if (!isValidContextHubId(contextHubId)) { throw new IllegalArgumentException("Invalid context hub ID " + contextHubId); } @@ -878,6 +878,7 @@ public class ContextHubService extends IContextHubService.Stub { contextHubInfo, pendingIntent, nanoAppId, attributionTag, mTransactionManager); } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) /** * Loads a nanoapp binary at the specified Context hub. * @@ -890,7 +891,6 @@ public class ContextHubService extends IContextHubService.Stub { public void loadNanoAppOnHub( int contextHubId, IContextHubTransactionCallback transactionCallback, NanoAppBinary nanoAppBinary) throws RemoteException { - checkPermissions(); if (!checkHalProxyAndContextHubId( contextHubId, transactionCallback, ContextHubTransaction.TYPE_LOAD_NANOAPP)) { return; @@ -907,6 +907,7 @@ public class ContextHubService extends IContextHubService.Stub { mTransactionManager.addTransaction(transaction); } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) /** * Unloads a nanoapp from the specified Context Hub. * @@ -919,7 +920,6 @@ public class ContextHubService extends IContextHubService.Stub { public void unloadNanoAppFromHub( int contextHubId, IContextHubTransactionCallback transactionCallback, long nanoAppId) throws RemoteException { - checkPermissions(); if (!checkHalProxyAndContextHubId( contextHubId, transactionCallback, ContextHubTransaction.TYPE_UNLOAD_NANOAPP)) { return; @@ -930,6 +930,7 @@ public class ContextHubService extends IContextHubService.Stub { mTransactionManager.addTransaction(transaction); } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) /** * Enables a nanoapp at the specified Context Hub. * @@ -942,7 +943,6 @@ public class ContextHubService extends IContextHubService.Stub { public void enableNanoApp( int contextHubId, IContextHubTransactionCallback transactionCallback, long nanoAppId) throws RemoteException { - checkPermissions(); if (!checkHalProxyAndContextHubId( contextHubId, transactionCallback, ContextHubTransaction.TYPE_ENABLE_NANOAPP)) { return; @@ -953,6 +953,7 @@ public class ContextHubService extends IContextHubService.Stub { mTransactionManager.addTransaction(transaction); } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) /** * Disables a nanoapp at the specified Context Hub. * @@ -965,7 +966,6 @@ public class ContextHubService extends IContextHubService.Stub { public void disableNanoApp( int contextHubId, IContextHubTransactionCallback transactionCallback, long nanoAppId) throws RemoteException { - checkPermissions(); if (!checkHalProxyAndContextHubId( contextHubId, transactionCallback, ContextHubTransaction.TYPE_DISABLE_NANOAPP)) { return; @@ -976,6 +976,7 @@ public class ContextHubService extends IContextHubService.Stub { mTransactionManager.addTransaction(transaction); } + @android.annotation.EnforcePermission(android.Manifest.permission.ACCESS_CONTEXT_HUB) /** * Queries for a list of nanoapps from the specified Context hub. * @@ -986,7 +987,6 @@ public class ContextHubService extends IContextHubService.Stub { @Override public void queryNanoApps(int contextHubId, IContextHubTransactionCallback transactionCallback) throws RemoteException { - checkPermissions(); if (!checkHalProxyAndContextHubId( contextHubId, transactionCallback, ContextHubTransaction.TYPE_QUERY_NANOAPPS)) { return;