Do not allow moveToFront() and moveTaskToFront() when app is in background
Bug: 129063631
Test: Unable to start activity / move task in background
Change-Id: Icb5ebad3567b911719341f221483df1a1512109b
diff --git a/services/core/java/com/android/server/wm/ActivityTaskManagerService.java b/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
index b64abdb..2c27654 100644
--- a/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
+++ b/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
@@ -2280,25 +2280,48 @@
* TODO: Add mController hook
*/
@Override
- public void moveTaskToFront(int taskId, int flags, Bundle bOptions) {
+ public void moveTaskToFront(IApplicationThread appThread, String callingPackage, int taskId,
+ int flags, Bundle bOptions) {
mAmInternal.enforceCallingPermission(android.Manifest.permission.REORDER_TASKS, "moveTaskToFront()");
if (DEBUG_STACK) Slog.d(TAG_STACK, "moveTaskToFront: moving taskId=" + taskId);
synchronized (mGlobalLock) {
- moveTaskToFrontLocked(taskId, flags, SafeActivityOptions.fromBundle(bOptions),
- false /* fromRecents */);
+ moveTaskToFrontLocked(appThread, callingPackage, taskId, flags,
+ SafeActivityOptions.fromBundle(bOptions), false /* fromRecents */);
}
}
- void moveTaskToFrontLocked(int taskId, int flags, SafeActivityOptions options,
+ void moveTaskToFrontLocked(@Nullable IApplicationThread appThread,
+ @Nullable String callingPackage, int taskId, int flags, SafeActivityOptions options,
boolean fromRecents) {
- if (!checkAppSwitchAllowedLocked(Binder.getCallingPid(),
- Binder.getCallingUid(), -1, -1, "Task to front")) {
+ final int callingPid = Binder.getCallingPid();
+ final int callingUid = Binder.getCallingUid();
+ if (!isSameApp(callingUid, callingPackage)) {
+ String msg = "Permission Denial: moveTaskToFrontLocked() from pid="
+ + Binder.getCallingPid() + " as package " + callingPackage;
+ Slog.w(TAG, msg);
+ throw new SecurityException(msg);
+ }
+ if (!checkAppSwitchAllowedLocked(callingPid, callingUid, -1, -1, "Task to front")) {
SafeActivityOptions.abort(options);
return;
}
final long origId = Binder.clearCallingIdentity();
+ WindowProcessController callerApp = null;
+ if (appThread != null) {
+ callerApp = getProcessController(appThread);
+ }
+ final ActivityStarter starter = getActivityStartController().obtainStarter(
+ null /* intent */, "moveTaskToFront");
+ if (starter.shouldAbortBackgroundActivityStart(callingUid, callingPid, callingPackage, -1,
+ -1, callerApp, null, false, null)) {
+ boolean abort = !isBackgroundActivityStartsEnabled();
+ starter.showBackgroundActivityBlockedToast(abort, callingPackage);
+ if (abort) {
+ return;
+ }
+ }
try {
final TaskRecord task = mRootActivityContainer.anyTaskForId(taskId);
if (task == null) {
@@ -2330,6 +2353,26 @@
}
}
+ /**
+ * Return true if callingUid is system, or packageName belongs to that callingUid.
+ */
+ boolean isSameApp(int callingUid, @Nullable String packageName) {
+ try {
+ if (callingUid != 0 && callingUid != SYSTEM_UID) {
+ if (packageName == null) {
+ return false;
+ }
+ final int uid = AppGlobals.getPackageManager().getPackageUid(packageName,
+ PackageManager.MATCH_DEBUG_TRIAGED_MISSING,
+ UserHandle.getUserId(callingUid));
+ return UserHandle.isSameApp(callingUid, uid);
+ }
+ } catch (RemoteException e) {
+ // Should not happen
+ }
+ return true;
+ }
+
boolean checkAppSwitchAllowedLocked(int sourcePid, int sourceUid,
int callingPid, int callingUid, String name) {
if (mAppSwitchesAllowedTime < SystemClock.uptimeMillis()) {
@@ -5290,7 +5333,10 @@
return mAmInternal.isBackgroundActivityStartsEnabled();
}
- boolean isPackageNameWhitelistedForBgActivityStarts(String packageName) {
+ boolean isPackageNameWhitelistedForBgActivityStarts(@Nullable String packageName) {
+ if (packageName == null) {
+ return false;
+ }
return mAmInternal.isPackageNameWhitelistedForBgActivityStarts(packageName);
}