From ec3c5f105f64ed56cd135edaf2f1b0011b0409e0 Mon Sep 17 00:00:00 2001
From: Charles Chen <liangyuchen@google.com>
Date: Sun, 15 Jan 2023 00:32:38 +0000
Subject: [PATCH] Verify BIND_VISUAL_QUERY_DETECTION permission

Verify the permission in the system server to protect
VisualQueryDetectionService and fix minor bugs.

Bug: 265540209
Test: Manual & atest CtsVoiceInteractionTestCases
Change-Id: I1a85fec4df50111cf4b2ef2e0c008607810f9043
---
 .../service/voice/VoiceInteractionService.java    |  4 ++--
 .../HotwordDetectionConnection.java               |  1 +
 .../VoiceInteractionManagerServiceImpl.java       | 15 +++++++++++++++
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/core/java/android/service/voice/VoiceInteractionService.java b/core/java/android/service/voice/VoiceInteractionService.java
index a5156ef78e9cb..4eb592527b289 100644
--- a/core/java/android/service/voice/VoiceInteractionService.java
+++ b/core/java/android/service/voice/VoiceInteractionService.java
@@ -719,8 +719,8 @@ public class VoiceInteractionService extends Service {
 
     private void onHotwordDetectorDestroyed(@NonNull HotwordDetector detector) {
         synchronized (mLock) {
-            if (mActiveVisualQueryDetector!= null &&
-                    detector == mActiveVisualQueryDetector.getInitializationDelegate()) {
+            if (mActiveVisualQueryDetector != null
+                    && detector == mActiveVisualQueryDetector.getInitializationDelegate()) {
                 mActiveVisualQueryDetector = null;
             }
             mActiveDetectors.remove(detector);
diff --git a/services/voiceinteraction/java/com/android/server/voiceinteraction/HotwordDetectionConnection.java b/services/voiceinteraction/java/com/android/server/voiceinteraction/HotwordDetectionConnection.java
index c37330586c9ef..665d5e7604253 100644
--- a/services/voiceinteraction/java/com/android/server/voiceinteraction/HotwordDetectionConnection.java
+++ b/services/voiceinteraction/java/com/android/server/voiceinteraction/HotwordDetectionConnection.java
@@ -635,6 +635,7 @@ final class HotwordDetectionConnection {
                     return;
                 }
             }
+            //TODO(b265535257): report error to either service only.
             synchronized (HotwordDetectionConnection.this.mLock) {
                 runForEachDetectorSessionLocked((session) -> {
                     session.reportErrorLocked(
diff --git a/services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerServiceImpl.java b/services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerServiceImpl.java
index 4ee33067cc12c..266087a1b9a01 100644
--- a/services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerServiceImpl.java
+++ b/services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerServiceImpl.java
@@ -673,6 +673,21 @@ class VoiceInteractionManagerServiceImpl implements VoiceInteractionSessionConne
             Slog.w(TAG, "Visual query detection service not in isolated process");
             throw new IllegalStateException("Visual query detection not in isolated process");
         }
+        if (!Manifest.permission.BIND_VISUAL_QUERY_DETECTION_SERVICE.equals(
+                visualQueryDetectionServiceInfo.permission)) {
+            Slog.w(TAG, "Visual query detection does not require permission "
+                    + Manifest.permission.BIND_VISUAL_QUERY_DETECTION_SERVICE);
+            throw new SecurityException("Visual query detection does not require permission "
+                    + Manifest.permission.BIND_VISUAL_QUERY_DETECTION_SERVICE);
+        }
+        if (mContext.getPackageManager().checkPermission(
+                Manifest.permission.BIND_VISUAL_QUERY_DETECTION_SERVICE,
+                mInfo.getServiceInfo().packageName) == PackageManager.PERMISSION_GRANTED) {
+            Slog.w(TAG, "Voice interaction service should not hold permission "
+                    + Manifest.permission.BIND_VISUAL_QUERY_DETECTION_SERVICE);
+            throw new SecurityException("Voice interaction service should not hold permission "
+                    + Manifest.permission.BIND_VISUAL_QUERY_DETECTION_SERVICE);
+        }
         if (sharedMemory != null && !sharedMemory.setProtect(OsConstants.PROT_READ)) {
             Slog.w(TAG, "Can't set sharedMemory to be read-only");
             throw new IllegalStateException("Can't set sharedMemory to be read-only");