From d84de83dcd0eaecf4e3862a1945c83d42760a193 Mon Sep 17 00:00:00 2001 From: Domen Su Date: Wed, 14 Sep 2022 22:49:12 +0000 Subject: [PATCH] Revert "Verify that the component is exported" Revert submission 19776394-safer-implicit-intents Reason for revert: DroidMonitor: Potential culprit for Bug b/246818637 - verifying through ABTD before revert submission. This is part of the standard investigation process, and does not mean your CL will be reverted. Reverted Changes: I66227a4fa:Update PackageManager test in Car to adapt to safe... I779f3d6ee:CTS tests for safer implicit intents I41c48a412:Verify that the component is exported Change-Id: I8484d317afc9a1d845b3394828062615b5fd2066 --- core/java/android/app/ActivityManager.java | 12 +--- .../content/pm/PackageManagerInternal.java | 8 --- .../server/am/ActivityManagerService.java | 68 ------------------- .../server/pm/PackageManagerInternalBase.java | 14 ---- .../server/pm/ResolveIntentHelper.java | 51 -------------- .../server/wm/ActivityTaskSupervisor.java | 2 +- .../server/wm/ActivityStarterTests.java | 2 - 7 files changed, 2 insertions(+), 155 deletions(-) diff --git a/core/java/android/app/ActivityManager.java b/core/java/android/app/ActivityManager.java index 30dbec7409928..e4c758e3d1bdc 100644 --- a/core/java/android/app/ActivityManager.java +++ b/core/java/android/app/ActivityManager.java @@ -4208,23 +4208,13 @@ public class ActivityManager { } }*/ - /** @hide - * Determines whether the given UID can access unexported components - * @param uid the calling UID - * @return true if the calling UID is ROOT or SYSTEM - */ - public static boolean canAccessUnexportedComponents(int uid) { - final int appId = UserHandle.getAppId(uid); - return (appId == Process.ROOT_UID || appId == Process.SYSTEM_UID); - } - /** @hide */ @UnsupportedAppUsage public static int checkComponentPermission(String permission, int uid, int owningUid, boolean exported) { // Root, system server get to do everything. final int appId = UserHandle.getAppId(uid); - if (canAccessUnexportedComponents(uid)) { + if (appId == Process.ROOT_UID || appId == Process.SYSTEM_UID) { return PackageManager.PERMISSION_GRANTED; } // Isolated processes don't get any permissions. diff --git a/services/core/java/android/content/pm/PackageManagerInternal.java b/services/core/java/android/content/pm/PackageManagerInternal.java index 0ce49d0baa973..3d8dc148b7e20 100644 --- a/services/core/java/android/content/pm/PackageManagerInternal.java +++ b/services/core/java/android/content/pm/PackageManagerInternal.java @@ -577,14 +577,6 @@ public abstract class PackageManagerInternal { @PrivateResolveFlags long privateResolveFlags, int userId, boolean resolveForStart, int filterCallingUid); - /** - * Resolves an exported activity intent, allowing instant apps to be resolved. - */ - public abstract ResolveInfo resolveIntentExported(Intent intent, String resolvedType, - @PackageManager.ResolveInfoFlagsBits long flags, - @PrivateResolveFlags long privateResolveFlags, int userId, boolean resolveForStart, - int filterCallingUid); - /** * Resolves a service intent, allowing instant apps to be resolved. */ diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java index 7e497fd101c1c..be0335e93d407 100644 --- a/services/core/java/com/android/server/am/ActivityManagerService.java +++ b/services/core/java/com/android/server/am/ActivityManagerService.java @@ -214,7 +214,6 @@ import android.appwidget.AppWidgetManager; import android.appwidget.AppWidgetManagerInternal; import android.compat.annotation.ChangeId; import android.compat.annotation.Disabled; -import android.compat.annotation.EnabledAfter; import android.content.AttributionSource; import android.content.AutofillOptions; import android.content.BroadcastReceiver; @@ -583,17 +582,6 @@ public class ActivityManagerService extends IActivityManager.Stub @Disabled private static final long DYNAMIC_RECEIVER_EXPLICIT_EXPORT_REQUIRED = 161145287L; - /** - * Apps targeting Android U and above will need to export components in order to invoke them - * through implicit intents. - * - * If a component is not exported and invoked, it will be removed from the list of receivers. - * This applies specifically to activities and broadcasts. - */ - @ChangeId - @EnabledAfter(targetSdkVersion = Build.VERSION_CODES.TIRAMISU) - public static final long IMPLICIT_INTENTS_ONLY_MATCH_EXPORTED_COMPONENTS = 229362273; - /** * The maximum number of bytes that {@link #setProcessStateSummary} accepts. * @@ -12343,58 +12331,6 @@ public class ActivityManagerService extends IActivityManager.Stub return false; } - /** - * Filters out non-exported components in a given list of broadcast filters - * @param intent the original intent - * @param callingUid the calling UID - * @param query the list of broadcast filters - * @param platformCompat the instance of platform compat - */ - private static void filterNonExportedComponents(Intent intent, int callingUid, - List query, PlatformCompat platformCompat, String callerPackage) { - if (query == null - || intent.getPackage() != null - || intent.getComponent() != null - || ActivityManager.canAccessUnexportedComponents(callingUid)) { - return; - } - for (int i = query.size() - 1; i >= 0; i--) { - String componentInfo; - ResolveInfo resolveInfo; - BroadcastFilter broadcastFilter; - if (query.get(i) instanceof ResolveInfo) { - resolveInfo = (ResolveInfo) query.get(i); - if (resolveInfo.getComponentInfo().exported) { - continue; - } - componentInfo = resolveInfo.getComponentInfo() - .getComponentName().flattenToShortString(); - } else if (query.get(i) instanceof BroadcastFilter) { - broadcastFilter = (BroadcastFilter) query.get(i); - if (broadcastFilter.exported) { - continue; - } - componentInfo = broadcastFilter.packageName; - } else { - continue; - } - if (!platformCompat.isChangeEnabledByUid( - IMPLICIT_INTENTS_ONLY_MATCH_EXPORTED_COMPONENTS, callingUid)) { - Slog.w(TAG, "Non-exported component not filtered out " - + "(will be filtered out once the app targets U+)- intent: " - + intent.getAction() + ", component: " - + componentInfo + ", sender: " - + callerPackage); - return; - } - Slog.w(TAG, "Non-exported component filtered out - intent: " - + intent.getAction() + ", component: " - + componentInfo + ", sender: " - + callerPackage); - query.remove(i); - } - } - /** * Main code for cleaning up a process when it has gone away. This is * called both as a result of the process dying, or directly when stopping @@ -14237,8 +14173,6 @@ public class ActivityManagerService extends IActivityManager.Stub } } - filterNonExportedComponents(intent, callingUid, registeredReceivers, - mPlatformCompat, callerPackage); int NR = registeredReceivers != null ? registeredReceivers.size() : 0; if (!ordered && NR > 0) { // If we are not serializing this broadcast, then send the @@ -14341,8 +14275,6 @@ public class ActivityManagerService extends IActivityManager.Stub if ((receivers != null && receivers.size() > 0) || resultTo != null) { BroadcastQueue queue = broadcastQueueForIntent(intent); - filterNonExportedComponents(intent, callingUid, receivers, - mPlatformCompat, callerPackage); BroadcastRecord r = new BroadcastRecord(queue, intent, callerApp, callerPackage, callerFeatureId, callingPid, callingUid, callerInstantApp, resolvedType, requiredPermissions, excludedPermissions, excludedPackages, appOp, brOptions, diff --git a/services/core/java/com/android/server/pm/PackageManagerInternalBase.java b/services/core/java/com/android/server/pm/PackageManagerInternalBase.java index 8f255fa266e56..e969d93465f85 100644 --- a/services/core/java/com/android/server/pm/PackageManagerInternalBase.java +++ b/services/core/java/com/android/server/pm/PackageManagerInternalBase.java @@ -466,20 +466,6 @@ abstract class PackageManagerInternalBase extends PackageManagerInternal { filterCallingUid); } - /** - * @deprecated similar to {@link resolveIntent} but limits the matches to exported components. - */ - @Override - @Deprecated - public final ResolveInfo resolveIntentExported(Intent intent, String resolvedType, - @PackageManager.ResolveInfoFlagsBits long flags, - @PackageManagerInternal.PrivateResolveFlags long privateResolveFlags, int userId, - boolean resolveForStart, int filterCallingUid) { - return getResolveIntentHelper().resolveIntentInternal(snapshot(), - intent, resolvedType, flags, privateResolveFlags, userId, resolveForStart, - filterCallingUid, true); - } - @Override @Deprecated public final ResolveInfo resolveService(Intent intent, String resolvedType, diff --git a/services/core/java/com/android/server/pm/ResolveIntentHelper.java b/services/core/java/com/android/server/pm/ResolveIntentHelper.java index f09e137f7c262..24ed6216f7fed 100644 --- a/services/core/java/com/android/server/pm/ResolveIntentHelper.java +++ b/services/core/java/com/android/server/pm/ResolveIntentHelper.java @@ -52,7 +52,6 @@ import android.util.Slog; import com.android.internal.app.ResolverActivity; import com.android.internal.util.ArrayUtils; -import com.android.server.am.ActivityManagerService; import com.android.server.compat.PlatformCompat; import com.android.server.pm.parsing.pkg.AndroidPackage; import com.android.server.pm.pkg.PackageStateInternal; @@ -101,38 +100,6 @@ final class ResolveIntentHelper { mInstantAppInstallerActivitySupplier = instantAppInstallerActivitySupplier; } - private static void filterNonExportedComponents(Intent intent, int filterCallingUid, - List query, PlatformCompat platformCompat, Computer computer) { - if (query == null - || intent.getPackage() != null - || intent.getComponent() != null - || ActivityManager.canAccessUnexportedComponents(filterCallingUid)) { - return; - } - AndroidPackage caller = computer.getPackage(filterCallingUid); - String callerPackage = caller == null ? "Not specified" : caller.getPackageName(); - for (int i = query.size() - 1; i >= 0; i--) { - if (!query.get(i).getComponentInfo().exported) { - if (!platformCompat.isChangeEnabledByUid( - ActivityManagerService.IMPLICIT_INTENTS_ONLY_MATCH_EXPORTED_COMPONENTS, - filterCallingUid)) { - Slog.w(TAG, "Non-exported component not filtered out " - + "(will be filtered out once the app targets U+)- intent: " - + intent.getAction() + ", component: " - + query.get(i).getComponentInfo() - .getComponentName().flattenToShortString() - + ", starter: " + callerPackage); - return; - } - Slog.w(TAG, "Non-exported component filtered out - intent: " - + intent.getAction() + ", component: " - + query.get(i).getComponentInfo().getComponentName().flattenToShortString() - + ", starter: " + callerPackage); - query.remove(i); - } - } - } - /** * Normally instant apps can only be resolved when they're visible to the caller. * However, if {@code resolveForStart} is {@code true}, all instant apps are visible @@ -142,20 +109,6 @@ final class ResolveIntentHelper { @PackageManager.ResolveInfoFlagsBits long flags, @PackageManagerInternal.PrivateResolveFlags long privateResolveFlags, int userId, boolean resolveForStart, int filterCallingUid) { - return resolveIntentInternal(computer, intent, resolvedType, flags, - privateResolveFlags, userId, resolveForStart, filterCallingUid, false); - } - - /** - * Normally instant apps can only be resolved when they're visible to the caller. - * However, if {@code resolveForStart} is {@code true}, all instant apps are visible - * since we need to allow the system to start any installed application. - * Allows picking exported components only. - */ - public ResolveInfo resolveIntentInternal(Computer computer, Intent intent, String resolvedType, - @PackageManager.ResolveInfoFlagsBits long flags, - @PackageManagerInternal.PrivateResolveFlags long privateResolveFlags, int userId, - boolean resolveForStart, int filterCallingUid, boolean exportedComponentsOnly) { try { Trace.traceBegin(TRACE_TAG_PACKAGE_MANAGER, "resolveIntent"); @@ -171,10 +124,6 @@ final class ResolveIntentHelper { final List query = computer.queryIntentActivitiesInternal(intent, resolvedType, flags, privateResolveFlags, filterCallingUid, userId, resolveForStart, true /*allowDynamicSplits*/); - if (exportedComponentsOnly) { - filterNonExportedComponents(intent, filterCallingUid, query, - mPlatformCompat, computer); - } Trace.traceEnd(TRACE_TAG_PACKAGE_MANAGER); final boolean queryMayBeFiltered = diff --git a/services/core/java/com/android/server/wm/ActivityTaskSupervisor.java b/services/core/java/com/android/server/wm/ActivityTaskSupervisor.java index 28cd0016b019c..dc91c1597128f 100644 --- a/services/core/java/com/android/server/wm/ActivityTaskSupervisor.java +++ b/services/core/java/com/android/server/wm/ActivityTaskSupervisor.java @@ -744,7 +744,7 @@ public class ActivityTaskSupervisor implements RecentTasks.Callbacks { // (e.g. AMS.startActivityAsUser). final long token = Binder.clearCallingIdentity(); try { - return mService.getPackageManagerInternalLocked().resolveIntentExported( + return mService.getPackageManagerInternalLocked().resolveIntent( intent, resolvedType, modifiedFlags, privateResolveFlags, userId, true, filterCallingUid); } finally { diff --git a/services/tests/wmtests/src/com/android/server/wm/ActivityStarterTests.java b/services/tests/wmtests/src/com/android/server/wm/ActivityStarterTests.java index 017de0f159e35..cd087e69bb0c6 100644 --- a/services/tests/wmtests/src/com/android/server/wm/ActivityStarterTests.java +++ b/services/tests/wmtests/src/com/android/server/wm/ActivityStarterTests.java @@ -371,8 +371,6 @@ public class ActivityStarterTests extends WindowTestsBase { doReturn(false).when(mMockPackageManager).isInstantAppInstallerComponent(any()); doReturn(null).when(mMockPackageManager).resolveIntent(any(), any(), anyLong(), anyLong(), anyInt(), anyBoolean(), anyInt()); - doReturn(null).when(mMockPackageManager).resolveIntentExported(any(), any(), - anyLong(), anyLong(), anyInt(), anyBoolean(), anyInt()); doReturn(new ComponentName("", "")).when(mMockPackageManager).getSystemUiServiceComponent(); // Never review permissions