Allowing arbitrary activityOptions during the creation of PendingIntent
is a source of security vulnerability. This CL removes activityOptions
from the call-site.
Bug: 209607104
Test: manual
Change-Id: Id262b9a0de58d8834c85d925cf84bb44b8b99742
Merged-In: Id262b9a0de58d8834c85d925cf84bb44b8b99742
[This is a resbumit, previous fix ag/I0aca484e5a0dd051bbeac379d30b0fb4ecfa2da0
was reverted because the incorrect resetFgsRestrictionLocked() call]
Foreground service started from background shall not have while-in-use
access like location/camera/microphone.
Previously we set mAllowWhileInUsePermissionInFgs only at service start
by startService() or bindService() command. But after
service start, the Service.startForeground() call may be some time later
and at that time the caller may not be in the foreground any more. This
CL will add further restriction on that.
1. If the first Service.startForeground() call is more than 10 seconds (can be
configured by DeviceConfig key "fgs_start_foreground_timeout") after the
Context.startService() call, check the service's app proc state and set
mAllowWhileInUsePermissionInFgs again.
2. At Service.stopForeground() call, mAllowWhileInUsePermissionInFgs
should be reset to false so FGS while-in-use permission is not allowed.
3. After Context.startForegroundService()(or Context.startService()) ->
Service.startForeground() -> Service.stopForeground(), the second or
more times Service.startForeground() is called, check the service's
app proc state and set mAllowWhileInUsePermissionInFgs again.
This CL is the backport of ag/Idc88f274c7a323d175d65bb47eca041772ae9bb7 from
S branch.
Bug: 183147114
Bug: 183204439
Test: atest cts/tests/app/src/android/app/cts/ActivityManagerFgsBgStartTest.java#testStartForegroundTimeout
Test: atest cts/tests/app/src/android/app/cts/ActivityManagerFgsBgStartTest.java#testSecondStartForeground
Change-Id: Ie8712b8efe85aa8a6769b811c85a29c4013e58b9
Merged-In: Idc88f274c7a323d175d65bb47eca041772ae9bb7
Toasts that do not have the trustedOverlay flag should not receive input.
These windows should not have any children, so force this hierarchy of
windows to drop all input by setting a flag on the toast window state
which will apply the DROP_INPUT flag on all windows with an input
channel. This is to prevent malicious apps from parenting surfaces with
input channels to the toast window.
Test: show toast and check if input feature flag DROP_INPUT id set via dumpsys
Bug: b/197296414
Merged-In: I316b76b685ca5030fd8aa91283555efcce4d6994
Change-Id: I316b76b685ca5030fd8aa91283555efcce4d6994
Introduces an API to drop input events on this SurfaceControl. This
policy will be inherited by its children. The caller must hold the
ACCESS_SURFACE_FLINGER permission.
Options include:
ALL: SurfaceControl and its children will not receive any
input regardless of whether it has a valid input channel.
These policies are used to enable features that allow for a less trusted
interaction model between apps. See the bug for more details.
Note: this backport doesn't include the oclude mode since its not
needed for the security fix.
Test: atest libgui_test InputDispatcherDropInputFeatureTest
Bug: 197296414
Merged-In: Ifcb4133306a43874e74e8fb0f42b60842daf6f25
Change-Id: Ifcb4133306a43874e74e8fb0f42b60842daf6f25
A malicious application could overlay the activity. The overlay is
able to be tapped through, which can trick the user into starting a
harmful activity.
The CL added the flag SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS for
the activity to prevent the tapjacking/overlay attack.
Bug: 205595291
Test: atest CtsHarmfulAppWarningHostTestCases
Change-Id: Ia1a1ae0dc451e04bf5c31e3cb8cf30a0d8e32991
(cherry picked from commit a04b3666b8)
A malicious application could overlay the activity. The overlay is
able to be tapped through, which can trick the user into starting a
harmful activity.
The CL added the flag SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS for
the activity to prevent the tapjacking/overlay attack.
Bug: 205595291
Test: atest CtsHarmfulAppWarningHostTestCases
Change-Id: Ia1a1ae0dc451e04bf5c31e3cb8cf30a0d8e32991
(cherry picked from commit a04b3666b8)
The test config takes longer than 900 seconds to run. Move it to a
dedicated group for running slow presubmit Test Mapping test.
Some more context is in the referenced bug, e.g, b/174495337
The group will work exactly the same as presubmit for now.
Bug: 174654670
Bug: 174495337
Fix: 215431363
Fix: 215549069
Test: treehugger
Change-Id: Id9769bbc625b42257af603d69098ae69c0fabb80
Merged-In: Id9769bbc625b42257af603d69098ae69c0fabb80
(cherry picked from commit ccc91c4fa9)
