Merge tag 'android-security-11.0.0_r49' into int/11/fp3
Android security 11.0.0 release 49
* tag 'android-security-11.0.0_r49': (95 commits)
Changed INTERACT_ACROSS_PROFILES appop to be set per UID
TIF: fix issue of using caller-aware methods after clearCallingIdentity()
Backporting the change of ag/15629060 to rvc-dev
Bluetooth: Fix formatting in getAlias()
Fix parsing code parcelling errors
camera2: Fix exception swallowing in params classes createFromParcel
Revert "BG-FGS-start while-in-use permission restriction improve..."
Make sure that only the owner can call stopVpnProfile()
DO NOT MERGE Apply a maximum char count to the load label api
Send targeted broadcasts to prevent other apps from receiving them.
Guard DISABLE_PLUGIN with PLUGIN permission.
Fix a potential thread safety issue in VectorDrawable
Fix background bypass via notifications
Change ownership of the account request notification.
Revert "wifidisplay: restrict broadcast by the proper permission"
Use IntentFilter CREATOR directly for serializing ParsedIntentInfo
Don't export HeapDumpProvider.
Don't attach private Notification to A11yEvent when user locked
Avoid locking profile task when it is already lock
Improve ellipsize performance
...
Change-Id: I0c9d37e2aef58afdda1660f917872789d149ef26
diff --git a/core/java/android/app/slice/SliceProvider.java b/core/java/android/app/slice/SliceProvider.java
index 46be548..cef6ab0 100644
--- a/core/java/android/app/slice/SliceProvider.java
+++ b/core/java/android/app/slice/SliceProvider.java
@@ -153,11 +153,6 @@
*/
public static final String EXTRA_PKG = "pkg";
/**
- * @Deprecated provider pkg is now being extracted in SlicePermissionActivity
- * @hide
- */
- public static final String EXTRA_PROVIDER_PKG = "provider_pkg";
- /**
* @hide
*/
public static final String EXTRA_RESULT = "result";
@@ -520,7 +515,6 @@
com.android.internal.R.string.config_slicePermissionComponent)));
intent.putExtra(EXTRA_BIND_URI, sliceUri);
intent.putExtra(EXTRA_PKG, callingPackage);
- intent.putExtra(EXTRA_PROVIDER_PKG, context.getPackageName());
// Unique pending intent.
intent.setData(sliceUri.buildUpon().appendQueryParameter("package", callingPackage)
.build());
diff --git a/core/java/android/bluetooth/BluetoothDevice.java b/core/java/android/bluetooth/BluetoothDevice.java
index 85d4bee..3544857 100644
--- a/core/java/android/bluetooth/BluetoothDevice.java
+++ b/core/java/android/bluetooth/BluetoothDevice.java
@@ -1230,7 +1230,10 @@
if (alias == null) {
return getName();
}
- return alias;
+ return alias
+ .replace('\t', ' ')
+ .replace('\n', ' ')
+ .replace('\r', ' ');
} catch (RemoteException e) {
Log.e(TAG, "", e);
}
diff --git a/core/java/android/content/pm/parsing/ParsingPackageImpl.java b/core/java/android/content/pm/parsing/ParsingPackageImpl.java
index 2da93ca..295107a 100644
--- a/core/java/android/content/pm/parsing/ParsingPackageImpl.java
+++ b/core/java/android/content/pm/parsing/ParsingPackageImpl.java
@@ -1007,7 +1007,7 @@
sForInternedStringList.parcel(this.requestedPermissions, dest, flags);
sForInternedStringList.parcel(this.implicitPermissions, dest, flags);
sForStringSet.parcel(this.upgradeKeySets, dest, flags);
- dest.writeMap(this.keySetMapping);
+ ParsingPackageUtils.writeKeySetMapping(dest, this.keySetMapping);
sForInternedStringList.parcel(this.protectedBroadcasts, dest, flags);
dest.writeTypedList(this.activities);
dest.writeTypedList(this.receivers);
@@ -1026,7 +1026,7 @@
dest.writeBoolean(this.use32BitAbi);
dest.writeBoolean(this.visibleToInstantApps);
dest.writeBoolean(this.forceQueryable);
- dest.writeParcelableList(this.queriesIntents, flags);
+ dest.writeTypedList(this.queriesIntents, flags);
sForInternedStringList.parcel(this.queriesPackages, dest, flags);
sForInternedStringSet.parcel(this.queriesProviders, dest, flags);
dest.writeString(this.appComponentFactory);
@@ -1169,7 +1169,7 @@
this.requestedPermissions = sForInternedStringList.unparcel(in);
this.implicitPermissions = sForInternedStringList.unparcel(in);
this.upgradeKeySets = sForStringSet.unparcel(in);
- this.keySetMapping = in.readHashMap(boot);
+ this.keySetMapping = ParsingPackageUtils.readKeySetMapping(in);
this.protectedBroadcasts = sForInternedStringList.unparcel(in);
this.activities = in.createTypedArrayList(ParsedActivity.CREATOR);
diff --git a/core/java/android/content/pm/parsing/ParsingPackageUtils.java b/core/java/android/content/pm/parsing/ParsingPackageUtils.java
index ab0ed51..a56a3ea 100644
--- a/core/java/android/content/pm/parsing/ParsingPackageUtils.java
+++ b/core/java/android/content/pm/parsing/ParsingPackageUtils.java
@@ -84,6 +84,7 @@
import android.os.Build;
import android.os.Bundle;
import android.os.FileUtils;
+import android.os.Parcel;
import android.os.RemoteException;
import android.os.Trace;
import android.os.ext.SdkExtensions;
@@ -2835,6 +2836,68 @@
}
/**
+ * Writes the keyset mapping to the provided package. {@code null} mappings are permitted.
+ */
+ public static void writeKeySetMapping(@NonNull Parcel dest,
+ @NonNull Map<String, ArraySet<PublicKey>> keySetMapping) {
+ if (keySetMapping == null) {
+ dest.writeInt(-1);
+ return;
+ }
+
+ final int N = keySetMapping.size();
+ dest.writeInt(N);
+
+ for (String key : keySetMapping.keySet()) {
+ dest.writeString(key);
+ ArraySet<PublicKey> keys = keySetMapping.get(key);
+ if (keys == null) {
+ dest.writeInt(-1);
+ continue;
+ }
+
+ final int M = keys.size();
+ dest.writeInt(M);
+ for (int j = 0; j < M; j++) {
+ dest.writeSerializable(keys.valueAt(j));
+ }
+ }
+ }
+
+ /**
+ * Reads a keyset mapping from the given parcel at the given data position. May return
+ * {@code null} if the serialized mapping was {@code null}.
+ */
+ @NonNull
+ public static ArrayMap<String, ArraySet<PublicKey>> readKeySetMapping(@NonNull Parcel in) {
+ final int N = in.readInt();
+ if (N == -1) {
+ return null;
+ }
+
+ ArrayMap<String, ArraySet<PublicKey>> keySetMapping = new ArrayMap<>();
+ for (int i = 0; i < N; ++i) {
+ String key = in.readString();
+ final int M = in.readInt();
+ if (M == -1) {
+ keySetMapping.put(key, null);
+ continue;
+ }
+
+ ArraySet<PublicKey> keys = new ArraySet<>(M);
+ for (int j = 0; j < M; ++j) {
+ PublicKey pk = (PublicKey) in.readSerializable();
+ keys.add(pk);
+ }
+
+ keySetMapping.put(key, keys);
+ }
+
+ return keySetMapping;
+ }
+
+
+ /**
* Callback interface for retrieving information that may be needed while parsing
* a package.
*/
diff --git a/core/java/android/hardware/camera2/params/OutputConfiguration.java b/core/java/android/hardware/camera2/params/OutputConfiguration.java
index 226b8e5..c062f8c 100644
--- a/core/java/android/hardware/camera2/params/OutputConfiguration.java
+++ b/core/java/android/hardware/camera2/params/OutputConfiguration.java
@@ -631,13 +631,7 @@
new Parcelable.Creator<OutputConfiguration>() {
@Override
public OutputConfiguration createFromParcel(Parcel source) {
- try {
- OutputConfiguration outputConfiguration = new OutputConfiguration(source);
- return outputConfiguration;
- } catch (Exception e) {
- Log.e(TAG, "Exception creating OutputConfiguration from parcel", e);
- return null;
- }
+ return new OutputConfiguration(source);
}
@Override
diff --git a/core/java/android/hardware/camera2/params/SessionConfiguration.java b/core/java/android/hardware/camera2/params/SessionConfiguration.java
index 47a897c..010b083 100644
--- a/core/java/android/hardware/camera2/params/SessionConfiguration.java
+++ b/core/java/android/hardware/camera2/params/SessionConfiguration.java
@@ -143,13 +143,7 @@
new Parcelable.Creator<SessionConfiguration> () {
@Override
public SessionConfiguration createFromParcel(Parcel source) {
- try {
- SessionConfiguration sessionConfiguration = new SessionConfiguration(source);
- return sessionConfiguration;
- } catch (Exception e) {
- Log.e(TAG, "Exception creating SessionConfiguration from parcel", e);
- return null;
- }
+ return new SessionConfiguration(source);
}
@Override
diff --git a/core/java/android/hardware/camera2/params/VendorTagDescriptor.java b/core/java/android/hardware/camera2/params/VendorTagDescriptor.java
index 4845ec3..c62f6da 100644
--- a/core/java/android/hardware/camera2/params/VendorTagDescriptor.java
+++ b/core/java/android/hardware/camera2/params/VendorTagDescriptor.java
@@ -36,13 +36,7 @@
new Parcelable.Creator<VendorTagDescriptor>() {
@Override
public VendorTagDescriptor createFromParcel(Parcel source) {
- try {
- VendorTagDescriptor vendorDescriptor = new VendorTagDescriptor(source);
- return vendorDescriptor;
- } catch (Exception e) {
- Log.e(TAG, "Exception creating VendorTagDescriptor from parcel", e);
- return null;
- }
+ return new VendorTagDescriptor(source);
}
@Override
diff --git a/core/java/android/hardware/camera2/params/VendorTagDescriptorCache.java b/core/java/android/hardware/camera2/params/VendorTagDescriptorCache.java
index 450b70b..8d7615c 100644
--- a/core/java/android/hardware/camera2/params/VendorTagDescriptorCache.java
+++ b/core/java/android/hardware/camera2/params/VendorTagDescriptorCache.java
@@ -36,13 +36,7 @@
new Parcelable.Creator<VendorTagDescriptorCache>() {
@Override
public VendorTagDescriptorCache createFromParcel(Parcel source) {
- try {
- VendorTagDescriptorCache vendorDescriptorCache = new VendorTagDescriptorCache(source);
- return vendorDescriptorCache;
- } catch (Exception e) {
- Log.e(TAG, "Exception creating VendorTagDescriptorCache from parcel", e);
- return null;
- }
+ return new VendorTagDescriptorCache(source);
}
@Override
diff --git a/packages/CompanionDeviceManager/src/com/android/companiondevicemanager/DeviceChooserActivity.java b/packages/CompanionDeviceManager/src/com/android/companiondevicemanager/DeviceChooserActivity.java
index 5ac059b..ac15164 100644
--- a/packages/CompanionDeviceManager/src/com/android/companiondevicemanager/DeviceChooserActivity.java
+++ b/packages/CompanionDeviceManager/src/com/android/companiondevicemanager/DeviceChooserActivity.java
@@ -66,8 +66,8 @@
final DeviceFilterPair selectedDevice = getService().mDevicesFound.get(0);
setTitle(Html.fromHtml(getString(
R.string.confirmation_title,
- getCallingAppName(),
- selectedDevice.getDisplayName()), 0));
+ Html.escapeHtml(getCallingAppName()),
+ Html.escapeHtml(selectedDevice.getDisplayName())), 0));
mPairButton = findViewById(R.id.button_pair);
mPairButton.setOnClickListener(v -> onDeviceConfirmed(getService().mSelectedDevice));
getService().mSelectedDevice = selectedDevice;
@@ -76,7 +76,8 @@
setContentView(R.layout.device_chooser);
mPairButton = findViewById(R.id.button_pair);
mPairButton.setVisibility(View.GONE);
- setTitle(Html.fromHtml(getString(R.string.chooser_title, getCallingAppName()), 0));
+ setTitle(Html.fromHtml(getString(R.string.chooser_title,
+ Html.escapeHtml(getCallingAppName())), 0));
mDeviceListView = findViewById(R.id.device_list);
final DeviceDiscoveryService.DevicesAdapter adapter = getService().mDevicesAdapter;
mDeviceListView.setAdapter(adapter);
diff --git a/packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java b/packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java
index 57e6568..47adffc 100644
--- a/packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java
+++ b/packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java
@@ -52,6 +52,11 @@
mUri = getIntent().getParcelableExtra(SliceProvider.EXTRA_BIND_URI);
mCallingPkg = getIntent().getStringExtra(SliceProvider.EXTRA_PKG);
+ if (mUri == null) {
+ Log.e(TAG, SliceProvider.EXTRA_BIND_URI + " wasn't provided");
+ finish();
+ return;
+ }
try {
PackageManager pm = getPackageManager();
@@ -103,7 +108,7 @@
}
private void verifyCallingPkg() {
- final String providerPkg = getIntent().getStringExtra(SliceProvider.EXTRA_PROVIDER_PKG);
+ final String providerPkg = getIntent().getStringExtra("provider_pkg");
if (providerPkg == null || mProviderPkg.equals(providerPkg)) return;
final String callingPkg = getCallingPkg();
EventLog.writeEvent(0x534e4554, "159145361", getUid(callingPkg));
diff --git a/services/core/java/com/android/server/pm/CrossProfileAppsServiceImpl.java b/services/core/java/com/android/server/pm/CrossProfileAppsServiceImpl.java
index 3e9e45e..c3733c4 100644
--- a/services/core/java/com/android/server/pm/CrossProfileAppsServiceImpl.java
+++ b/services/core/java/com/android/server/pm/CrossProfileAppsServiceImpl.java
@@ -482,16 +482,16 @@
// this particular app-op to be modified without the broader app-op permissions.
mInjector.withCleanCallingIdentity(() ->
mInjector.getAppOpsManager()
- .setMode(OP_INTERACT_ACROSS_PROFILES, uid, packageName, newMode));
+ .setUidMode(OP_INTERACT_ACROSS_PROFILES, uid, newMode));
} else {
mInjector.getAppOpsManager()
- .setMode(OP_INTERACT_ACROSS_PROFILES, uid, packageName, newMode);
+ .setUidMode(OP_INTERACT_ACROSS_PROFILES, uid, newMode);
}
// Kill the UID before sending the broadcast to ensure that apps can be informed when
// their app-op has been revoked.
maybeKillUid(packageName, uid, hadPermission);
- sendCanInteractAcrossProfilesChangedBroadcast(packageName, uid, UserHandle.of(profileId));
- maybeLogSetInteractAcrossProfilesAppOp(packageName, newMode, logMetrics, uid);
+ sendCanInteractAcrossProfilesChangedBroadcast(packageName, UserHandle.of(profileId));
+ maybeLogSetInteractAcrossProfilesAppOp(packageName, newMode, logMetrics);
}
/**
@@ -509,7 +509,7 @@
}
private void maybeLogSetInteractAcrossProfilesAppOp(
- String packageName, @Mode int newMode, boolean logMetrics, int uid) {
+ String packageName, @Mode int newMode, boolean logMetrics) {
if (!logMetrics) {
return;
}
@@ -517,7 +517,7 @@
.createEvent(DevicePolicyEnums.SET_INTERACT_ACROSS_PROFILES_APP_OP)
.setStrings(packageName)
.setInt(newMode)
- .setBoolean(appDeclaresCrossProfileAttribute(uid))
+ .setBoolean(appDeclaresCrossProfileAttribute(packageName))
.write();
}
@@ -533,10 +533,10 @@
}
private void sendCanInteractAcrossProfilesChangedBroadcast(
- String packageName, int uid, UserHandle userHandle) {
+ String packageName, UserHandle userHandle) {
final Intent intent =
new Intent(ACTION_CAN_INTERACT_ACROSS_PROFILES_CHANGED).setPackage(packageName);
- if (appDeclaresCrossProfileAttribute(uid)) {
+ if (appDeclaresCrossProfileAttribute(packageName)) {
intent.addFlags(
Intent.FLAG_RECEIVER_INCLUDE_BACKGROUND | Intent.FLAG_RECEIVER_FOREGROUND);
} else {
@@ -553,8 +553,8 @@
.queryBroadcastReceiversAsUser(intent, /* flags= */ 0, userHandle);
}
- private boolean appDeclaresCrossProfileAttribute(int uid) {
- return mInjector.getPackageManagerInternal().getPackage(uid).isCrossProfile();
+ private boolean appDeclaresCrossProfileAttribute(String packageName) {
+ return mInjector.getPackageManagerInternal().getPackage(packageName).isCrossProfile();
}
@Override
diff --git a/services/core/java/com/android/server/tv/TvInputManagerService.java b/services/core/java/com/android/server/tv/TvInputManagerService.java
index 323ac7b..4668741 100755
--- a/services/core/java/com/android/server/tv/TvInputManagerService.java
+++ b/services/core/java/com/android/server/tv/TvInputManagerService.java
@@ -2005,10 +2005,9 @@
public void requestChannelBrowsable(Uri channelUri, int userId)
throws RemoteException {
final String callingPackageName = getCallingPackageName();
+ final int resolvedUserId = resolveCallingUserId(Binder.getCallingPid(),
+ Binder.getCallingUid(), userId, "requestChannelBrowsable");
final long identity = Binder.clearCallingIdentity();
- final int callingUid = Binder.getCallingUid();
- final int resolvedUserId = resolveCallingUserId(Binder.getCallingPid(), callingUid,
- userId, "requestChannelBrowsable");
try {
Intent intent = new Intent(TvContract.ACTION_CHANNEL_BROWSABLE_REQUESTED);
List<ResolveInfo> list = getContext().getPackageManager()