From c06ace7acc0fd909d86e9bf5a7caa0f6686e6d69 Mon Sep 17 00:00:00 2001
From: Patrick Baumann <patb@google.com>
Date: Fri, 27 May 2022 18:35:17 +0000
Subject: [PATCH] Add visibility special casing for sdk sandbox

This change adds special visibility enforcement to the apps filter for
SDK sandbox uids. If we encounter an SDK sandbox UID, we'll bypass
traditional visibility checks and instead just enforce that the target
is forceQueryable. All else besides the client app will be blocked.

Test: atest AppsFilterImplTest
Bug: 234129698
Change-Id: Ic42d46232841294a0fd148e5f29d1ff5ec4261c8
---
 .../com/android/server/pm/AppsFilterBase.java |  3 ++
 .../android/server/pm/AppsFilterImplTest.java | 40 +++++++++++++++++++
 2 files changed, 43 insertions(+)

diff --git a/services/core/java/com/android/server/pm/AppsFilterBase.java b/services/core/java/com/android/server/pm/AppsFilterBase.java
index 78e7b0a177647..7ca1978b2031a 100644
--- a/services/core/java/com/android/server/pm/AppsFilterBase.java
+++ b/services/core/java/com/android/server/pm/AppsFilterBase.java
@@ -321,6 +321,9 @@ public abstract class AppsFilterBase implements AppsFilterSnapshot {
                     || targetPkgSetting.getAppId() < Process.FIRST_APPLICATION_UID
                     || callingAppId == targetPkgSetting.getAppId()) {
                 return false;
+            } else if (Process.isSdkSandboxUid(callingAppId)) {
+                // we only allow sdk sandbox processes access to forcequeryable packages
+                return !isForceQueryable(targetPkgSetting.getAppId());
             }
             if (mCacheReady) { // use cache
                 if (!shouldFilterApplicationUsingCache(callingUid,
diff --git a/services/tests/servicestests/src/com/android/server/pm/AppsFilterImplTest.java b/services/tests/servicestests/src/com/android/server/pm/AppsFilterImplTest.java
index 9674ebd756778..facbe80bde678 100644
--- a/services/tests/servicestests/src/com/android/server/pm/AppsFilterImplTest.java
+++ b/services/tests/servicestests/src/com/android/server/pm/AppsFilterImplTest.java
@@ -1336,6 +1336,46 @@ public class AppsFilterImplTest {
 
     }
 
+    @Test
+    public void testSdkSandbox_canSeeForceQueryable() throws Exception {
+        final AppsFilterImpl appsFilter =
+                new AppsFilterImpl(mFeatureConfigMock, new String[]{}, false, null,
+                        mMockHandler);
+        simulateAddBasicAndroid(appsFilter);
+        appsFilter.onSystemReady(mPmInternal);
+
+        PackageSetting target = simulateAddPackage(appsFilter,
+                pkg("com.some.package").setForceQueryable(true), DUMMY_TARGET_APPID,
+                setting -> setting.setPkgFlags(ApplicationInfo.FLAG_SYSTEM));
+
+        int callingUid = 20123;
+        assertTrue(Process.isSdkSandboxUid(callingUid));
+
+        assertFalse(
+                appsFilter.shouldFilterApplication(mSnapshot, callingUid,
+                        null /* callingSetting */, target, SYSTEM_USER));
+    }
+
+    @Test
+    public void testSdkSandbox_cannotSeeNonForceQueryable() throws Exception {
+        final AppsFilterImpl appsFilter =
+                new AppsFilterImpl(mFeatureConfigMock, new String[]{}, false, null,
+                        mMockHandler);
+        simulateAddBasicAndroid(appsFilter);
+        appsFilter.onSystemReady(mPmInternal);
+
+        PackageSetting target = simulateAddPackage(appsFilter,
+                pkg("com.some.package"), DUMMY_TARGET_APPID,
+                setting -> setting.setPkgFlags(ApplicationInfo.FLAG_SYSTEM));
+
+        int callingUid = 20123;
+        assertTrue(Process.isSdkSandboxUid(callingUid));
+
+        assertTrue(
+                appsFilter.shouldFilterApplication(mSnapshot, callingUid,
+                        null /* callingSetting */, target, SYSTEM_USER));
+    }
+
     private List<Integer> toList(int[] array) {
         ArrayList<Integer> ret = new ArrayList<>(array.length);
         for (int i = 0; i < array.length; i++) {