Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[automerge] DO NOT MERGE: ActivityManager#killBackgroundProcesses can kill caller's own app only 2p: d1c95670b2

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/20312179

Bug: 239423414
Bug: 223376078
Change-Id: I37419bc54c884138615a7d11fe7b0952b27d87ca
Merged-In: I35d20539ffac055a6d61260445620f45584bd9c5
Merged-In: Ieed6af77da1bc31cfecc5272b9f97971db7ae7b2
Merged-In: I8b8a427ee87339cc038e53adc0912283b05d2cfc
This commit is contained in:
Presubmit Automerger Backend
2022-11-01 21:51:06 +00:00
parent aba2a82d08 d1c95670b2
commit f8d8060209
3 changed files with 38 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
core/java/android/app/ActivityManager.java
View File

@@ -3666,6 +3666,9 @@ public class ActivityManager {
* processes to reclaim memory; the system will take care of restarting
* these processes in the future as needed.
*
* <p class="note">Third party applications can only use this API to kill their own processes.
* </p>
*
* @param packageName The name of the package whose processes are to
* be killed.
*/

6
core/res/AndroidManifest.xml
View File

@@ -2815,7 +2815,11 @@
android:protectionLevel="normal" />
<!-- Allows an application to call
{@link android.app.ActivityManager#killBackgroundProcesses}.
{@link android.app.ActivityManager#killBackgroundProcesses}.
<p class="note">Third party applications can only use this API to kill their own
processes.</p>
<p>Protection level: normal
-->
<permission android:name="android.permission.KILL_BACKGROUND_PROCESSES"

32
services/core/java/com/android/server/am/ActivityManagerService.java
View File

@@ -3588,8 +3588,20 @@ public class ActivityManagerService extends IActivityManager.Stub
Slog.w(TAG, msg);
throw new SecurityException(msg);
}
final int callingUid = Binder.getCallingUid();
final int callingPid = Binder.getCallingPid();
final int callingAppId = UserHandle.getAppId(callingUid);
userId = mUserController.handleIncomingUser(Binder.getCallingPid(), Binder.getCallingUid(),
ProcessRecord proc;
synchronized (mPidsSelfLocked) {
proc = mPidsSelfLocked.get(callingPid);
}
final boolean hasKillAllPermission = PERMISSION_GRANTED == checkPermission(
android.Manifest.permission.FORCE_STOP_PACKAGES, callingPid, callingUid)
|| UserHandle.isCore(callingUid)
|| (proc != null && proc.info.isSystemApp());
userId = mUserController.handleIncomingUser(callingPid, callingUid,
userId, true, ALLOW_FULL_ONLY, "killBackgroundProcesses", null);
final int[] userIds = mUserController.expandUserId(userId);
@@ -3604,7 +3616,7 @@ public class ActivityManagerService extends IActivityManager.Stub
targetUserId));
} catch (RemoteException e) {
}
if (appId == -1) {
if (appId == -1 || (!hasKillAllPermission && appId != callingAppId)) {
Slog.w(TAG, "Invalid packageName: " + packageName);
return;
}
@@ -3672,6 +3684,22 @@ public class ActivityManagerService extends IActivityManager.Stub
throw new SecurityException(msg);
}
final int callingUid = Binder.getCallingUid();
final int callingPid = Binder.getCallingPid();
ProcessRecord proc;
synchronized (mPidsSelfLocked) {
proc = mPidsSelfLocked.get(callingPid);
}
if (callingUid >= FIRST_APPLICATION_UID
&& (proc == null || !proc.info.isSystemApp())) {
final String msg = "Permission Denial: killAllBackgroundProcesses() from pid="
+ callingPid + ", uid=" + callingUid + " is not allowed";
Slog.w(TAG, msg);
// Silently return to avoid existing apps from crashing.
return;
}
final long callingId = Binder.clearCallingIdentity();
try {
synchronized (this) {