commit 52e8922e8a769e8af9ff8e9d0adb7a4d5c8b085b
author Galia Peycheva <galinap@google.com> Tue Feb 18 23:41:43 2020 +0100
committer Galia Peycheva <galinap@google.com> Tue Feb 25 07:57:09 2020 +0000
tree 04385679bc90e35d063f50d14c23e1a9b07bba25
parent 6861e91b84fb444f6a04256bd5d564730660efeb

Add startDreamActivity request verification

The ActivityTaskManagerTestService has a special method to start a
DreamActivity. This CL adds a verification check before the activity is
started to check that the caller is the currently active dream
component.

Bug: 133216167

Test: atest DreamManagerServiceTest

Merged-In: Id71b4cbc57c6569f58b6d906cc8361c104a507dc
Change-Id: Id71b4cbc57c6569f58b6d906cc8361c104a507dc
(cherry picked from commit 20dc51820ae813788819a916277268fe571bbbf3)

services/core/java/com/android/server/wm/ActivityTaskManagerService.java

diff --git a/services/core/java/com/android/server/wm/ActivityTaskManagerService.java b/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
index dfc9aa8..1f2a9c7 100644
--- a/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
+++ b/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
@@ -213,6 +213,7 @@
 import android.os.storage.StorageManager;
 import android.provider.Settings;
 import android.service.dreams.DreamActivity;
+import android.service.dreams.DreamManagerInternal;
 import android.service.voice.IVoiceInteractionSession;
 import android.service.voice.VoiceInteractionManagerInternal;
 import android.sysprop.DisplayProperties;
@@ -1233,12 +1234,25 @@
 
     @Override
     public boolean startDreamActivity(Intent intent) {
+        final WindowProcessController process = mProcessMap.getProcess(Binder.getCallingPid());
+        final long origId = Binder.clearCallingIdentity();
+
+        // The dream activity is only called for non-doze dreams.
+        final ComponentName currentDream = LocalServices.getService(DreamManagerInternal.class)
+                .getActiveDreamComponent(/* doze= */ false);
+
+        if (currentDream == null || currentDream.getPackageName() == null
+                || !currentDream.getPackageName().equals(process.mInfo.packageName)) {
+            Slog.e(TAG, "Calling package is not the current dream package. "
+                    + "Aborting startDreamActivity...");
+            return false;
+        }
+
         final ActivityInfo a = new ActivityInfo();
         a.theme = com.android.internal.R.style.Theme_Dream;
         a.exported = true;
         a.name = DreamActivity.class.getName();
 
-        final WindowProcessController process = mProcessMap.getProcess(Binder.getCallingPid());
 
         a.packageName = process.mInfo.packageName;
         a.applicationInfo = process.mInfo;
@@ -1253,7 +1267,6 @@
         a.colorMode = ActivityInfo.COLOR_MODE_DEFAULT;
         a.flags |= ActivityInfo.FLAG_EXCLUDE_FROM_RECENTS;
 
-        final long origId = Binder.clearCallingIdentity();
         try {
             getActivityStartController().obtainStarter(intent, "dream")
                     .setActivityInfo(a)