Commit Graph

33882 Commits

Author SHA1 Message Date
lumark
748bcb047c [RESTRICT AUTOMERGE] Restrict app transition maximum duration am: 36bcc77337 am: dcc38988ee
Change-Id: Ied1793dbc8d7b58170e22729aa351c582c894ffa
2020-05-05 21:32:53 +00:00
lumark
dcc38988ee [RESTRICT AUTOMERGE] Restrict app transition maximum duration am: 36bcc77337
Change-Id: Ia049c055935fdc0ceb0369cf131e7d166e5522f6
2020-05-05 21:04:59 +00:00
Chris Tate
6da62f7e0e Merge "Verify all possible hosts that match web nav" into oc-dev am: 0d01b03776
Change-Id: I81ea478e735c5c3d571835a99edb1547885d76ab
2020-04-07 17:52:30 +00:00
Chris Tate
097d107125 Merge "Verify all possible hosts that match web nav" into oc-mr1-dev 2020-04-07 17:40:31 +00:00
Chris Tate
0d01b03776 Merge "Verify all possible hosts that match web nav" into oc-dev 2020-04-07 17:40:04 +00:00
Linus Tufvesson
d903a3ef4c RESTRICT AUTOMERGE am: 59ba151854
Change-Id: Ic48f81f9259cb5bb2a3af3befcd5ef9a630c4766
2020-04-03 09:44:26 +00:00
Linus Tufvesson
0c6de1676d Merge "RESTRICT AUTOMERGE" into oc-mr1-dev 2020-04-03 09:27:20 +00:00
Linus Tufvesson
55dcec46fb Merge "RESTRICT AUTOMERGE" into oc-dev 2020-04-03 09:27:08 +00:00
Linus Tufvesson
59ba151854 RESTRICT AUTOMERGE
This reverts commit 0bb93d4b1c.

Reason for revert: Breaks apps using Presentation in combination with private virtual displays

Bug: 141745510
Change-Id: I6673946137d6b12fa725e6df1c936068dedc3787
2020-04-01 13:31:51 +00:00
Linus Tufvesson
41215b67a3 RESTRICT AUTOMERGE
This reverts commit 7d4adf4d46.

Reason for revert: Breaks apps using Presentation in combination with private virtual displays

Bug: 141745510
Change-Id: I15ded4f1a7cf152e331c853c128c91db173f3cd7
2020-04-01 13:31:34 +00:00
lumark
36bcc77337 [RESTRICT AUTOMERGE] Restrict app transition maximum duration
As WindowState#startAnimation for restricting window animation duration
(currently is 10 secs),

For security reason, we also need to restrict app transition animation
duration as 3 secs to prevent malicious app may set a long duration or
infinity repeat counts through ActivityOption#makeCustomAnimation or
Activity#overridePendingTransition with custom animation set.

Bug: 145728687
Test: manual as issue provided test app
Change-Id: I39051d6e4d2b681ce2becbafe14aab3f3d8ebf6b
2020-03-31 23:38:36 +00:00
Christopher Tate
a481c86cd3 Verify all possible hosts that match web nav
Even if an <intent-filter> matches non-web schemes in addition to http
or https, make sure to include its cited hosts in the autoVerify
evaluation.

Bug: 150038428
Test: atest OsHostTests#testIntentFilterHostValidation
Change-Id: If9ef0fc53d96e6581c56d86f89fe63bc9a5fb89a
Merged-In: If9ef0fc53d96e6581c56d86f89fe63bc9a5fb89a
(cherry picked from commit 1fba0f897f)
2020-03-31 18:01:21 +00:00
Christopher Tate
18e46e36eb Verify all possible hosts that match web nav
Even if an <intent-filter> matches non-web schemes in addition to http
or https, make sure to include its cited hosts in the autoVerify
evaluation.

Bug: 150038428
Test: atest OsHostTests#testIntentFilterHostValidation
Change-Id: If9ef0fc53d96e6581c56d86f89fe63bc9a5fb89a
Merged-In: If9ef0fc53d96e6581c56d86f89fe63bc9a5fb89a
(cherry picked from commit 1fba0f897f)
2020-03-31 17:56:29 +00:00
TreeHugger Robot
6d992d651b Merge "Revert "Revoke 'always' web handler status when not autoverifying"" into oc-dev am: 41d1927c3f am: 3e2270de45
Change-Id: I43f76e0d351518960a01ce71419680d21714c9b6
2020-03-30 20:32:57 +00:00
TreeHugger Robot
3e2270de45 Merge "Revert "Revoke 'always' web handler status when not autoverifying"" into oc-dev am: 41d1927c3f
Change-Id: Ia488fcc0dd49b8262246d41c24b61dc59b8e35bf
2020-03-30 20:09:34 +00:00
TreeHugger Robot
41d1927c3f Merge "Revert "Revoke 'always' web handler status when not autoverifying"" into oc-dev 2020-03-30 19:55:03 +00:00
Chris Tate
92561d210d Revert "Revoke 'always' web handler status when not autoverifying"
This reverts commit 6cf5f92825.

Reason for revert: Inadvertently broke link handling stickiness even for well behaved apps

Bug: 146204120
Test: install app that handles web urls; set to 'always' in Settings;
install same apk again.  Verify that app is still in 'always' state via
'adb shell dumpsys package d'

Merged-In: I2b108064794b961904811c5d9f54c37dd2c7f482
Merged-In: If9046cb420961b8ef0333e9f1115eb69fb92242e
Change-Id: I03a121c0c1284c965bb87ee426eb0376681cf7d8
2020-03-30 17:51:18 +00:00
Automerger Merge Worker
2e254bb81e RESTRICT AUTOMERGE Use consistent calling uid and package in navigateUpTo am: 1c9bf5cc54
Change-Id: Ie38d9bf7ac60dd60a2dc1d0aef798ddc01fe19f7
2020-03-11 09:07:05 +00:00
TreeHugger Robot
6c1414ffac Merge "RESTRICT AUTOMERGE Use consistent calling uid and package in navigateUpTo" into oc-dev 2020-03-11 08:53:52 +00:00
Riddle Hsu
1c9bf5cc54 RESTRICT AUTOMERGE Use consistent calling uid and package in navigateUpTo
Originally, if the caller of navigateUpTo is alive, even the calling
uid is set to the caller who launched the existing destination activity,
the uid from caller process has higher priority to replace the given
calling uid. So this change doesn't modify the existing behavior if
the caller process is valid. Besides, the case of delivering new intent
uses the source record as calling identity too, so the case of starting
new activity should be consistent.

Also forbid attaching null application thread to avoid unexpected state
in process record.

Bug: 144285917
Test: bit FrameworksServicesTests:ActivityStackTests
Test: bit CtsSecurityTestCases:ActivityManagerTest# \
      testActivityManager_attachNullApplication
Merged-In: I60732f430256d37cb926d08d093581f051c4afed
Change-Id: I60732f430256d37cb926d08d093581f051c4afed
2020-03-11 06:28:55 +00:00
Automerger Merge Worker
d6f71caed5 RESTRICT AUTOMERGE am: 0bb93d4b1c
Change-Id: I7569bed67b835e6f9e86ca2b0dc1b3e6309545c7
2020-03-11 05:08:32 +00:00
TreeHugger Robot
3e2869e2c0 Merge "RESTRICT AUTOMERGE Block TYPE_PRESENTATION windows on default display" into oc-mr1-dev 2020-03-11 04:53:42 +00:00
TreeHugger Robot
133e0a7eea Merge "RESTRICT AUTOMERGE Block TYPE_PRESENTATION windows on default display" into oc-dev 2020-03-11 04:53:16 +00:00
Automerger Merge Worker
0d8b222051 RESTRICT AUTOMERGE Create separated tasks for different apps from startActivities am: 2be3ba4973
Change-Id: I3429cb8f1ecd7e211ebee8ef3b739d9d4342fdad
2020-03-10 21:01:51 +00:00
TreeHugger Robot
4f486e9f0b Merge "RESTRICT AUTOMERGE Use consistent calling uid and package in navigateUpTo" into oc-mr1-dev 2020-03-10 17:09:54 +00:00
TreeHugger Robot
834e880978 Merge "RESTRICT AUTOMERGE Create separated tasks for different apps from startActivities" into oc-mr1-dev 2020-03-10 15:06:13 +00:00
Riddle Hsu
973ecc619c RESTRICT AUTOMERGE Create separated tasks for different apps from startActivities
Assume there are 2 applications A, B with different uids.
There are 4 activities A1, A2, B1, B2 with default task
affinity and launch mode.

After A1 called startActivities(B1, A2, B2):
 Original   : Task(A1, B1, A2, B2)
 This Change: Task(A1, B1), Task(A2, B2)
In other words, the source caller cannot launch its activity
above the activity of other application in the same task, and
it can still launch activity of other application in its task.

Bug: 145669109
Test: run cts --test android.server.cts.StartActivityTests \
      -m CtsServicesHostTestCases
Change-Id: I97bd875146a52f62b8fe82235487ccefb2955e8e
2020-03-10 15:04:47 +00:00
Linus Tufvesson
0bb93d4b1c RESTRICT AUTOMERGE
Block TYPE_PRESENTATION windows on default display

... and any other display that isn't considered a public presentation
display, as per Display.isPublicPresentation()

Bug: 141745510
Test: manual test via test app
Change-Id: I2aaab1903dee54190338f7b6e49888aa51437108
2020-03-09 20:57:08 +00:00
Linus Tufvesson
7d4adf4d46 RESTRICT AUTOMERGE
Block TYPE_PRESENTATION windows on default display

... and any other display that isn't considered a public presentation
display, as per Display.isPublicPresentation()

Bug: 141745510
Test: manual test via test app
Change-Id: I2aaab1903dee54190338f7b6e49888aa51437108
2020-03-09 20:54:52 +00:00
Riddle Hsu
0d7e27af30 RESTRICT AUTOMERGE Use consistent calling uid and package in navigateUpTo
Originally, if the caller of navigateUpTo is alive, even the calling
uid is set to the caller who launched the existing destination activity,
the uid from caller process has higher priority to replace the given
calling uid. So this change doesn't modify the existing behavior if
the caller process is valid. Besides, the case of delivering new intent
uses the source record as calling identity too, so the case of starting
new activity should be consistent.

Also forbid attaching null application thread to avoid unexpected state
in process record.

Bug: 144285917
Test: bit FrameworksServicesTests:com.android.server.am.ActivityStackTests
Change-Id: I60732f430256d37cb926d08d093581f051c4afed
2020-03-03 07:38:01 +00:00
Riddle Hsu
2be3ba4973 RESTRICT AUTOMERGE Create separated tasks for different apps from startActivities
Assume there are 2 applications A, B with different uids.
There are 4 activities A1, A2, B1, B2 with default task
affinity and launch mode.

After A1 called startActivities(B1, A2, B2):
 Original   : Task(A1, B1, A2, B2)
 This Change: Task(A1, B1), Task(A2, B2)
In other words, the source caller cannot launch its activity
above the activity of other application in the same task, and
it can still launch activity of other application in its task.

Bug: 145669109
Test: run cts --test android.server.cts.StartActivityTests \
      -m CtsServicesHostTestCases
Change-Id: I97bd875146a52f62b8fe82235487ccefb2955e8e
2020-02-24 10:02:57 +00:00
Christopher Tate
874c974f73 DO NOT MERGE - Kill apps outright for API contract violations
...rather than relying on in-app code to perform the shutdown.

Backport of security fix.

Bug: 128649910
Bug: 140108616
Test: manual
Test: atest OsHostTests#testForegroundServiceBadNotification
Change-Id: I94d9de50bb03c33666471e3dbd9c721e9278f7cb
Merged-In: I94d9de50bb03c33666471e3dbd9c721e9278f7cb
2020-02-07 01:33:28 +00:00
Automerger Merge Worker
0cf31cf467 Merge "Revoke 'always' web handler status when not autoverifying" into oc-dev am: ab012da3a2
Change-Id: I9515e311ff75532171bd893ddc6f3971a1fdea0c
2020-02-01 01:12:41 +00:00
Chris Tate
f98fee618c Merge "Revoke 'always' web handler status when not autoverifying" into oc-mr1-dev 2020-02-01 01:01:36 +00:00
Chris Tate
ab012da3a2 Merge "Revoke 'always' web handler status when not autoverifying" into oc-dev 2020-02-01 01:01:34 +00:00
Automerger Merge Worker
5b6d8d7724 Merge "Fix security problem on PermissionMonitor#hasPermission" into oc-dev am: 5e0b069876 am: 81db8d8a83
Change-Id: I5660cafce05a0e3c6edff03bd645d8df329c5d50
2020-01-09 13:53:42 +00:00
Automerger Merge Worker
81db8d8a83 Merge "Fix security problem on PermissionMonitor#hasPermission" into oc-dev am: 5e0b069876
Change-Id: I4c255820617a86afdfa239febdd46fff7d082381
2020-01-09 13:40:20 +00:00
TreeHugger Robot
5e0b069876 Merge "Fix security problem on PermissionMonitor#hasPermission" into oc-dev 2020-01-09 13:25:46 +00:00
Christopher Tate
ef5220e5b2 Revoke 'always' web handler status when not autoverifying
If an app has previously used autoVerify to make claims about its status
re handling web navigation intents, but is updated such that it no
longer makes those claims, step down its "official handler" status as
though it had never invoked autoVerify in the first place.

Bug: 146204120
Test: manual: as described in bug; observe policy before/after via
      'adb shell dumpsys package d'
Test: atest CtsOsHostTestCases
Change-Id: I58502d1b32d793aba9aa772fa2ad5ac38acca48a
Merged-In: I58502d1b32d793aba9aa772fa2ad5ac38acca48a
2020-01-08 18:50:59 -08:00
Automerger Merge Worker
929c2c5e1b Merge changes I8ae4e331,Id4e37c3e,If0fd4834 into oc-dev am: e422bc0c8f am: 43d5e3bb62
Change-Id: I5df542202c561a4ed931b918ccbaed317a8ba942
2020-01-09 01:04:14 +00:00
Automerger Merge Worker
d46ef183b1 Use KNOWN_PACKAGES when shared lib consumers am: 08315953bc am: e580843476
Change-Id: I64af9ee49999f2de11f1a6779e116357649f63b2
2020-01-09 01:03:58 +00:00
Automerger Merge Worker
3e28284fb8 Handles null outInfo in deleteSystemPackageLI am: 6afabce549 am: ae901aceda
Change-Id: I2741bc7999cd2b1c1e16b982791f72e3023361c7
2020-01-09 01:03:45 +00:00
Automerger Merge Worker
43d5e3bb62 Merge changes I8ae4e331,Id4e37c3e,If0fd4834 into oc-dev am: e422bc0c8f
Change-Id: I7efbfda4517e46abf406fd53487836704a941a2e
2020-01-09 00:08:31 +00:00
Automerger Merge Worker
e580843476 Use KNOWN_PACKAGES when shared lib consumers am: 08315953bc
Change-Id: I3ab4cc8d36bd79f3b7342cf0d0fa3056d08988e7
2020-01-09 00:08:14 +00:00
Automerger Merge Worker
ae901aceda Handles null outInfo in deleteSystemPackageLI am: 6afabce549
Change-Id: I077e6febea84013403feb65842ae99bc449ac737
2020-01-09 00:08:02 +00:00
Bryan Ferris
e422bc0c8f Merge changes I8ae4e331,Id4e37c3e,If0fd4834 into oc-dev
* changes:
  Fixes NPE when preparing app data during init
  Use KNOWN_PACKAGES when shared lib consumers
  Handles null outInfo in deleteSystemPackageLI
2020-01-08 22:46:45 +00:00
Patrick Baumann
5d3fc339b5 Fixes NPE when preparing app data during init
When deleting an unused static shared library on Q, the user manager was
fetched via mContext.getSystemService. At this time during boot, the
service wasn't registered and so null was returned. This has already
been addressed in R with a move to injecting dependencies in the
PackageManagerService constructor.

Bug: 142083996
Bug: 141413692
Test: manual; remove static dependency on eng Q build and reboot
Change-Id: I8ae4e331d09b4734c54cdc6887b273705dce88b1
Merged-In: I8ae4e331d09b4734c54cdc6887b273705dce88b1
2020-01-08 22:46:16 +00:00
Patrick Baumann
08315953bc Use KNOWN_PACKAGES when shared lib consumers
This change ensures we find ALL known packages that could be consuming a
shared library, not only currently installed ones. Without this check,
the system may get into a state in which we have currently uninstalled
but on-device apps that depend on a shared library that does not exist
on device.

This change also leaves static shared library packages on device even if
it's not installed for any of the remaining users as it could still be
used, but marked uninstalled for users in which it is consumed.

Bug: 141413692
Bug: 142083996
Test: Manual; attempt to remove shared lib after marking its consumer uninstalled.
Test: atest StaticSharedLibsHostTests
Change-Id: Id4e37c3e4d3ea3ad5fddae5d2c7305e56f50eeea
Merged-In: Id4e37c3e4d3ea3ad5fddae5d2c7305e56f50eeea
2020-01-08 22:45:56 +00:00
Christopher Tate
6cf5f92825 Revoke 'always' web handler status when not autoverifying
If an app has previously used autoVerify to make claims about its status
re handling web navigation intents, but is updated such that it no
longer makes those claims, step down its "official handler" status as
though it had never invoked autoVerify in the first place.

Bug: 146204120
Test: manual: as described in bug; observe policy before/after via
      'adb shell dumpsys package d'
Test: atest CtsOsHostTestCases
Change-Id: I58502d1b32d793aba9aa772fa2ad5ac38acca48a
Merged-In: I58502d1b32d793aba9aa772fa2ad5ac38acca48a
2020-01-07 17:49:18 -08:00
Patrick Baumann
6afabce549 Handles null outInfo in deleteSystemPackageLI
This change adds null checks before accessing outInfo in
deleteSystemPackageLI.

Bug: 142083996
Bug: 141413692
Test: manual; remove static dependency on eng build and reboot
Change-Id: If0fd48343e89cbb77ccd25826656194195d5b0cd
(cherry picked from commit 1747101650)
Merged-In: If0fd48343e89cbb77ccd25826656194195d5b0cd
2020-01-07 22:56:56 +00:00