From 5170c58c86b0685fb0064ce051bdb525308af6a0 Mon Sep 17 00:00:00 2001
From: ryanlwlin <ryanlwlin@google.com>
Date: Tue, 15 Jun 2021 14:54:16 +0800
Subject: [PATCH] fix package visibility for installed accessibility services

If the app targets API level 30, the returned installed
AccessibilityServiceInfo would based on its own package visiblity.
Using packageManagerInternal#filterAppAccess to determine whether
we need to fitler the service or not.

Bug: 179699353
Test: manual - use the test apk and check the log
      atest AppEnumerationTests
Change-Id: Ieea089e10410a9d9feeb4a741c871c43547b1861
---
 .../AccessibilityManagerService.java          | 26 ++++++++++++++-----
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
index 7eecc453a8ce8..5f95d8736d120 100644
--- a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
+++ b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
@@ -872,18 +872,32 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub
                     "userId=" + userId);
         }
 
+        final int resolvedUserId;
+        final List<AccessibilityServiceInfo> serviceInfos;
         synchronized (mLock) {
             // We treat calls from a profile as if made by its parent as profiles
             // share the accessibility state of the parent. The call below
             // performs the current profile parent resolution.
-            final int resolvedUserId = mSecurityPolicy
+            resolvedUserId = mSecurityPolicy
                     .resolveCallingUserIdEnforcingPermissionsLocked(userId);
-
-            if (Binder.getCallingPid() == OWN_PROCESS_ID) {
-                return new ArrayList<>(getUserStateLocked(resolvedUserId).mInstalledServices);
-            }
-            return getUserStateLocked(resolvedUserId).mInstalledServices;
+            serviceInfos = new ArrayList<>(
+                    getUserStateLocked(resolvedUserId).mInstalledServices);
         }
+
+        if (Binder.getCallingPid() == OWN_PROCESS_ID) {
+            return serviceInfos;
+        }
+        final PackageManagerInternal pm = LocalServices.getService(
+                PackageManagerInternal.class);
+        final int callingUid = Binder.getCallingUid();
+        for (int i = serviceInfos.size() - 1; i >= 0; i--) {
+            final AccessibilityServiceInfo serviceInfo = serviceInfos.get(i);
+            if (pm.filterAppAccess(serviceInfo.getComponentName().getPackageName(), callingUid,
+                    resolvedUserId)) {
+                serviceInfos.remove(i);
+            }
+        }
+        return serviceInfos;
     }
 
     @Override