The camera API, MediaStore.ACTION_IMAGE_CAPTURE requires apps to pass
a content:// URI with write permissions to the camera. Unfortunately,
apps haven't been doing this and we only started hitting problems in R
for two reasons:
1. The FileUriExposedException that should crash apps when they try to
share file:// URIs acroos binder is skipped. This is because, the
image_capture intent is passed across binder as a field in a
ChooserActivity Intent and the child intents are not checked for
file URI exposed
2. Prior to R, when camera gets a file:// URI, camera issues a file
open(2) in its process. This open(2) succeeds because the camera had
write_external_storage permission which gave it write access to all
files on external storage
Now, camera targets R and (2) fails because camera does not have write
access to files owned by other apps. To workaround, we do the
following in the apps process when it targets < R:
a. When we detect a file:// URI for the camera in an Intent, we create
the file on disk if it is not already created.
b. Scan the file to insert it in the database and retrieve a
content:// URI
c. Replace the file:// URI with the content URI in the image_capture
intent
This works because, the system will ensure the camera is granted write
access to the content URI.
Test: Manual
Bug: 156336269
Change-Id: I4849ff5e806a8207650ff7534846c36ecdc6d3c0
For Activity aliases, it's possible some values are already
set, which means they cannot be assumed to be 0, and can't be
overwritten if a attribute in the alias is undefined. For the
parsing v2 refactor, this was cleaned up to avoid
redundant != 0 checks, but those checks are indeed necessary.
This copies over the old logic and uses it exactly.
In some future cleanup, there should be a more structured way
of doing this, since it's not immediately obvious which values
are overridden or not. For example, description is always
overwritten even if no new value is provided in the alias.
This also fixes up the comparison tests and other bugs that
popped up because of them. The core issue was that when
auto-generating the dumpToString methods, the Alt+Insert
macro default selects all the fields in the current class,
but not all the parent classes, so some shared fields like
name/icon were not considered.
A notable case that was found when running the comparison tests
is that persistableMode is now "fixed" with v2. Previously,
a bug in PackageParser caused this value to be dropped if
the ActivityInfo object ever had to be copied. This is a change
from Q behavior, but there's no good way to reconcile this, and
it's better to be correct and consistent than broken, so this
fix was left in and excluded from the comparison tests.
Bug: 150106908
Test: manual run through steps in bug
Test: atest com.android.server.pm.parsing
Change-Id: I1301e28540314d0e643b73af7146c1a366eca6b5
Introduce meta-data tag "android.supports_size_changes" which will indicated that an activity works well with size changes like display changing size.
Test: Manual - Run by adding metadata to the app running with SizeCompatMode.
Bug: 155041354
Change-Id: I0f358f63c9e14c63294275c0bfcd08744bee1108
On Pixel 2 devices, /product is a symlink to /system/product. The
product partition has a higher partition precedence than the system
partition so the app should be installed as a system app on the product
partition.
This change also unifies methods for checking whether a file is within
a partition so we will paths will always be canonicalized before the
check.
Bug: 152522330
Test: update system app in system/product/privapp, uninstall updates,
verify that the app was scanned as privileged
Change-Id: I646a5f293b977a78daa2102b73f1d3122f774a2a
Currently when a package is installed / updated in a sharedUid the
signatures for the sharedUid are not updated unless the new package
adds a new signer to the lineage; in this case the new lineage is
assigned to the sharedUid without consideration for the existing
lineage. This leads to the following problems:
1. If the current sharedUid lineage is A -> B and the new package has
lineage B -> C then this is used for the sharedUid and A is lost from
the lineage.
2. If the new lineage revokes one or more capabilities from a previous
signer in the lineage these updated capabilities are ignored unless the
lineage added a new signer as well.
3. If the new lineage revokes the sharedUid capability from a previous
signing key in the lineage and another app is installed as part of the
sharedUid and signed with that key the new app's installation is allowed
to proceed.
4. If only a single app is installed as part of a sharedUid, and that
app is updated with a rotated key and a lineage that revokes the
previous signing key's sharedUid capability the update is blocked.
5. If an app is installed as part of the sharedUid and has a diverged
signer in the lineage (ie sharedUid lineage is Y -> A -> B and new app
lineage is Z -> A -> B -> C) the installation is allowed and Y is lost
from the lineage.
Problems 1 and 2 are addressed with the new SigningDetails
mergeLineageWith method that merges common signers between two lineages
and also updates their capabilities to the most restrictive between
the two lineages (capabilities are anded together). Problems 3 is
addressed by checking the signatures of each of the packages in the
sharedUid for any signed with an ancestor for which the sharedUid
capability may have been revoked. Problem 4 is addressed by checking
if the package being updated is the only one in the sharedUid; if so
the update to the new lineage is allowed to proceed. Problem 5 is
addressed by verifying the new app's lineage is the same, a subset, or
a superset of the other.
Bug: 152046935
Test: atest PkgInstallSignatureVerificationTest
Test: atest SigningDetailsTest
Test: atest PackageManagerTests
Test: atest PackageManagerTest
Change-Id: I420c309f522bb47b65ca40ee848024c85cd5804d
By adding a util method that prefers longlabel and
falls back to shortlabel.
Test: atest
Bug: 157140669
Change-Id: Ib7229b75b7a8ab87274e9aab1c7816129f04e505
This was moved to PackageCacher, but the old and unused counter
was not removed.
Bug: 154310064
Test: manual device reboots and logs cached count >0
Change-Id: I32fdb4b8fccd281fe61c64f231cb0ba154934679
Per b/147806409, the old code to delete snapshots by inode didn't work.
There is no point in storing mCeSnapshotInodes inside
PackageRollbackInfo. Let's remove related code.
TODO: fix ApexManager/Installer APIs that have unused parameter/return
values.
Bug: 154897348
Test: atest RollbackStoreTest RollbackUnitTest AppDataRollbackHelperTest
Change-Id: I66357c22607bfffbe4d9f55fc13c4c657d5f700c
This change updates the docs for the MATCH_UNINSTALLED flag to note that
without the QUERY_ALL_PACKAGES permission, uninstalled packages will not
be returned.
Bug: 149846504
Test: builds
Change-Id: Id0c5b7f29172bd334dc1b2a32ce1f4eb7b1f0bd3
It requires a permission which we can't force apps to take to
maintain backwards compatibility. We also arguably cannot because
it leaks visibility, although only for debuggable apps/non-release
builds.
Instead, there's a new static method for getting the raw targetSdk
to gate against and the check is done manually, ignoring
enabled/disabled state. This will cause a mismatch between certain
apps and some system services like AppIntegrityManager, but the
effects should be minimal if we assume that most people ship
valid APKs. At worse the integrity check will pass an APK that
PM will fail, which doesn't break the feature.
Bug: 156356591
Bug: 156778241
Test: manual device boots
Change-Id: I877a5061476b86b9d63c34e75f16b38be8c3e1c2
This change treats any filter with a mimegroup as if it matches all or
no mime types when matching for the purpose of app enumeration.
Fixes: 155379839
Test: atest IntentFilterTest
Change-Id: I358872082524a4001179bb145053d006622898a7
This change ensures that we don't take port into account when matching
queries tags against intent filters as port is not a supported value in
a queries intent tag. Adding support for this in a future release will
just limit the scope of the queries tag on thos releases; it will still
be ignored in this release.
Bug: 151638510
Test: atest IntentFilterTest
Change-Id: I69d77ae6bebf3984bfe8e8a0f6c2e9e91ee69298
Since running the front and back camera at the same time has been
possible since forever, there's no reason devices on older API levels
can't declare the FEATURE_CAMERA_CONCURRENT flag, even with the new
query APIs not present. Explicitly document that the flag can be set
on API level 29 or earlier, and what it means.
Test: m offline-sdk-docs
Bug: 77960042
Change-Id: I186cb53d95debcc62c98afdef8c629bd9c6a5919
