If private user data is send to an app the data provider should note an
app-op. This change adds a new API AppOpsManager#setNotedAppOpsCollector
that allows an app to get notified every time such an private data access
happens.
This will allow apps to monitor their own private data usage. Esp. with
big, old apps, distributed teams or 3rd party libraries it might not always
be clear what subsystems access private data.
There are three different situations how private data can be accessed and
an app op is noted:
1. Private data access inside a two-way binder call.
E.g. LocationManager#getLastKnownLocation. When we start a two way
binder transaction, we remember the calling uid via
AppOpsManager#collectNotedAppOps. Then when the data providing code
calls AppOpsManager#noteOp->AppOpsManager#markAppOpNoted the noted
app-op is remembered in
AppOpsManager#sAppOpsNotedInThisBinderTransaction. Then when returning
from the binder call, we add the list of noted app-ops to the
reply-parcel via AppOpsManager#prefixParcelWithAppOpsIfNeeded. On the
calling side we check if there were any app-ops noted in
AppOpsManager#readAndLogNotedAppops and then call the collector while
still in the binder code. This allows the collector e.g. collect a stack
trace which can be used to figure out what app code caused the
private data access.
2. Very complex apps might do permissions checks internal to themself.
I.e. an app notes an op for itself. We detect this case in
AppOpsManager#markAppOpNoted and immediately call the collector similar
to case (1).
3. Sometimes private data is accessed outside of a two-way binder call.
E.g. if an app registers a LocationListener an app-op is noted each time
a new location is send to the app. In this case it is not clear to the
framework which app-action triggered this app-op-note. Hence the data
provider has to describe in a AsyncNotedAppOp object when an why the
access happened. These objects are then send to the system server via
IAppOpsService#noteAsyncOp and then the collector in the app. There are
rare cases where a private data access happens before the app is running
(e.g. when a geo-fence is triggered). In this case we cache a small
amount of AsyncNotedAppOps (in AppOpsService#mUnforwardedAsyncNotedOps)
and deliver them when the app is ready for these events (in
AppOpsManager#setNotedAppOpsCollector).
Test: atest CtsAppOpsTestCases (includes new tests covering this
functionality)
Bug: 136505050
Change-Id: I96ded4a8d8d9bcb37a4555d9b1281cb57945ffa9
To prepare for enabling MissingNullability Metalava check this CL
works on adding missing nullability issues that metalava flags if
we tell it to flag new things since API 29.
This is not a complete CL, mostly addresses public api and
toString/equals for @SystemApi
Exempt-From-Owner-Approval: Large scale nullability clean up
Bug: 124515653
Test: make -j checkapi
Change-Id: I109260842cfc25f06e40694997fcbb4afa02c867
To prepare for enabling MissingNullability Metalava check this CL
works on adding missing nullability issues that metalava flags if
we tell it to flag new things since API 29.
This is not a complete CL, mostly addresses public api and
toString/equals for @SystemApi
Exempt-From-Owner-Approval: Large scale nullability clean up
Bug: 124515653
Test: make -j checkapi
Merged-In: I109260842cfc25f06e40694997fcbb4afa02c867
Change-Id: I109260842cfc25f06e40694997fcbb4afa02c867
This class is hanging around for UnsupportedApiUsage. Adding additional
APIs here which do nothing in order to satisfy the inherited interface.
Bug: 136027762
Test: compile :)
Change-Id: I47b57c6876afd77b47083bf905ade9951ff0b42d
The StorageSessionController has a StorageUserConnection to represent
the binding between the StoragemanagerService and the
ExternalStorageService for a user.
A StorageUserConnection can have multiple Sessions each representing a
mount for the user. The StorageUserConnection has an
ActiveConnection representing the active binding to the
ExternalStorageService.
If the ExternalStorageService goes down, the ActiveConnection becomes
'inactive' but the StorageManagerService will be notified to reset the
mount state of the device with the help of vold which will 're-activate'
the ActiveConnection.
This reset will among other things, kill any apps holding an open fd
on the FUSE mount and remount the FUSE mount, getting a new FUSE fd
as a result. The StorageSessionController will once again be notified
of new volume mounts and start sessions for them
Bug: 135341433
Test: adb shell setprop persist.sys.fuse && adb reboot && adb shell ls
/sdcard
Test: adb shell am crash com.android.providers.media && adb shell ls /sdcard
Change-Id: I72841a1d8012b1ca1cc88f29cb75127ea627c093
This CL introduces a way of blocking IPCs on the main thread.
This is enforced by StrictMode, and enabled on tests and eng
builds.
All current blocking IPCs were whitelisted and bugs will be
filed, in order to fix them for R.
Bug: 139360025
Test: adb logcat
Test: atest SystemUITests
Change-Id: I45af2619605ee36b6bae83ef080272c62754b654
Also changed AutofillManagerService and ContentCaptureManagerService to take advantage of these methods.
Test: manual verification
Test: atest CtsAutoFillServiceTestCases CtsContentCaptureServiceTestCases # on phone and Automotive
Bug: 133242016
Change-Id: I3e7f9d65a6ef1e8e6ec886a41b35733e463a6389
Instead of just relying on the regular iteration through the system
services inside dumpstate, add another API to IIncidentManager
dedicated for dumpstate.
- It is only callable by dumpstate() (check the calling uid)
- It has the same behavior as the current call inside dump()
Advantages:
- More explicit function name, right next to takeIncidentReport will
make it easier to keep them in sync.
- Nobody else can call it, make security easier.
- If dumpstate calls it explicitly, it can skip the 10 second timeout
- The regular dump() call should provide debugging data about
incidentd itself, for example timestamps for the most recent N
incident reports taken and the current state of the work directory,
allowing us to debug incidentd itself.
Bug: 137493082
Test: Manually trigger a bug report, and verify
/proto/incident_log.proto in the zip file.
Change-Id: I19139c765b53ede63d3beb3ea3ac40ada1aba42d
We have getContentUri() for entire collections of items, but we
only have ID-specific overloads for some of the MediaStore classes;
let's get them all added for consistency.
Remove primary/secondary directory logic, which was replaced by
new RELATIVE_PATH column before Q launched.
Bug: 137890034
Test: atest --test-mapping packages/providers/MediaProvider
Exempt-From-Owner-Approval: trivial API refactoring
Change-Id: Iae4e7fe57adff071c35af459e31223a1fd05fef2
Add manifest flag to prevent applications from using prerelease driver
accidentally. In this patch we also allow any debuggable device build to load
prerelease driver for all non-system and non-privileged applications.
BUG: 138132808
Test: Verified with prerelease driver.
Change-Id: If0abc89f709c8e34bd83a5c09c3c2047300b5ef2
On R, we want to optimize boot time by not starting system services for some types of users,
like a headless system user (which is the case for Automotive)
As a "guinea pig", it optimizes VoiceInteractionService for headless system user, so the 3rd-party app
service is not bound for user 0 (and hence its process is not launched).
This change improves boot time on Automotive in about 100ms.
Test: atest CtsVoiceInteractionTestCases CtsAssistTestCases # on walleye and Automotive
Test: manual verification on logcat
Bug: 133242016
Fixes: 137878080
Change-Id: Ib0a902855e32691a1d00bfa77ee82c8e2430977c
Include the RSS info into the meminfo output of dumpsys and
incident_report.
Bug: 117880513
Test: adb shell dumpsys meminfo
Test: cts-tradefed run cts-dev --module \
CtsIncidentHostTestCases --test \
com.android.server.cts.MemInfoIncidentTest
Change-Id: Id1058e279b7ca6925b59a6a523e0f0d14d830761
In preparation of moving the jobscheduler framework code to its
own jar.
Bug: 138793378
Test: dumpsys batterystats -c | grep jbc and make sure the line looks correct
Change-Id: I9938c99e37bd44e522e5f8d8e95772e69d5be492
