Fix issue with permission check for shortcuts and pendingIntent
When launching a PendingIntent, we have two sets of activity
options: One supplied from the caller that obtained the
pending intent, and those supplied from the caller that is
sending it. We need to perform the permission check depending
on which caller the options are coming from.
For that, we introduce SafeActivityOptions that records the
callingPid/callingUid when obtaining it and checks for the
permissions with the correct callingPid/callingUid, and
also supports merging both activity options.
In addition to that, fix shortcuts by not clearing caller
identity in LauncherAppsService.
Test: go/wm-smoke
Test: Install custom launcher APK with animation for shortcuts
enabled, make sure launch works properly.
Bug: 64674361
Change-Id: I9a854d43c65c8fa69bf16ccfbed86e8e681a095b
diff --git a/services/core/java/com/android/server/am/AppTaskImpl.java b/services/core/java/com/android/server/am/AppTaskImpl.java
index f821f6b..5f5a504 100644
--- a/services/core/java/com/android/server/am/AppTaskImpl.java
+++ b/services/core/java/com/android/server/am/AppTaskImpl.java
@@ -20,6 +20,7 @@
import static com.android.server.am.ActivityStackSupervisor.REMOVE_FROM_RECENTS;
import android.app.ActivityManager;
+import android.app.ActivityOptions;
import android.app.IAppTask;
import android.app.IApplicationThread;
import android.content.Intent;
@@ -93,10 +94,13 @@
public void moveToFront() {
checkCaller();
// Will bring task to front if it already has a root activity.
+ final int callingPid = Binder.getCallingPid();
+ final int callingUid = Binder.getCallingUid();
final long origId = Binder.clearCallingIdentity();
try {
synchronized (this) {
- mService.mStackSupervisor.startActivityFromRecents(mTaskId, null);
+ mService.mStackSupervisor.startActivityFromRecents(callingPid, callingUid, mTaskId,
+ null);
}
} finally {
Binder.restoreCallingIdentity(origId);
@@ -127,7 +131,8 @@
.setCaller(appThread)
.setCallingPackage(callingPackage)
.setResolvedType(resolvedType)
- .setMayWait(bOptions, callingUser)
+ .setActivityOptions(bOptions)
+ .setMayWait(callingUser)
.setInTask(tr)
.execute();
}