From 25b172abfdaa3e7b69e9c971c6384c0d6b79c4ce Mon Sep 17 00:00:00 2001 From: Dave Mankoff Date: Wed, 21 Jul 2021 10:08:04 -0400 Subject: [PATCH] Guard DISABLE_PLUGIN with PLUGIN permission. Fixes a p0 security bug. We already have the plugin permission defined in our manifest. Ensure that senders of the DISABLE_PLUGIN broadcast have that permission. Fixes: 193444889 Test: manual Change-Id: Iebaba435c17c5644c5357c0683858447f5ffb897 --- .../com/android/systemui/shared/plugins/PluginEnabler.java | 6 +++--- .../android/systemui/shared/plugins/PluginManagerImpl.java | 4 +++- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginEnabler.java b/packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginEnabler.java index 01b012d1fc84e..1c5da827eeb35 100644 --- a/packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginEnabler.java +++ b/packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginEnabler.java @@ -24,9 +24,9 @@ public interface PluginEnabler { int ENABLED = 0; int DISABLED_MANUALLY = 1; - int DISABLED_INVALID_VERSION = 1; - int DISABLED_FROM_EXPLICIT_CRASH = 2; - int DISABLED_FROM_SYSTEM_CRASH = 3; + int DISABLED_INVALID_VERSION = 2; + int DISABLED_FROM_EXPLICIT_CRASH = 3; + int DISABLED_FROM_SYSTEM_CRASH = 4; @IntDef({ENABLED, DISABLED_MANUALLY, DISABLED_INVALID_VERSION, DISABLED_FROM_EXPLICIT_CRASH, DISABLED_FROM_SYSTEM_CRASH}) diff --git a/packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginManagerImpl.java b/packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginManagerImpl.java index f5ed9da15fa30..2b4cdd6cf575d 100644 --- a/packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginManagerImpl.java +++ b/packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginManagerImpl.java @@ -197,10 +197,12 @@ public class PluginManagerImpl extends BroadcastReceiver implements PluginManage filter.addAction(Intent.ACTION_PACKAGE_CHANGED); filter.addAction(Intent.ACTION_PACKAGE_REPLACED); filter.addAction(Intent.ACTION_PACKAGE_REMOVED); + filter.addDataScheme("package"); + mContext.registerReceiver(this, filter); filter.addAction(PLUGIN_CHANGED); filter.addAction(DISABLE_PLUGIN); filter.addDataScheme("package"); - mContext.registerReceiver(this, filter); + mContext.registerReceiver(this, filter, PluginInstanceManager.PLUGIN_PERMISSION, null); filter = new IntentFilter(Intent.ACTION_USER_UNLOCKED); mContext.registerReceiver(this, filter); }