commit b72e6f6f30a27f1d5d04d7493976eff2224faee7
author Maarten Derks <maarten@fairphone.com> Mon Dec 13 15:24:27 2021 +0100
committer Maarten Derks <maarten@fairphone.com> Mon Dec 13 15:24:27 2021 +0100
tree 591553abeddcff2fce3a3ca7a2104e805c64b49b
parent 80f823ee313eda960bc3102848c86bbf4006ab29
parent 5991036b8d5bd3e45b05b6424f360cfe0a5c76a1

Merge branch 'security-aosp-qt-release' into int/10/fp2

* security-aosp-qt-release:
  DO NOT MERGE KeyChain protect against overlays.
  DO NOT MERGE Hide overlay on KeyChainActivity

Change-Id: I9a52c0522c2259a9a15d2a24c310fc4ea1ffe697

AndroidManifest.xml

diff --git a/AndroidManifest.xml b/AndroidManifest.xml
index 662b670..1722c7c 100755
--- a/AndroidManifest.xml
+++ b/AndroidManifest.xml
@@ -3,6 +3,8 @@
           package="com.android.keychain"
           android:sharedUserId="android.uid.system"
           >
+    <uses-permission android:name="android.permission.HIDE_NON_SYSTEM_OVERLAY_WINDOWS"/>
+
     <application android:label="@string/app_name"
             android:allowBackup="false"
             android:usesCleartextTraffic="false" >

src/com/android/keychain/KeyChainActivity.java

diff --git a/src/com/android/keychain/KeyChainActivity.java b/src/com/android/keychain/KeyChainActivity.java
index 4a4083a..f8cb0d3 100644
--- a/src/com/android/keychain/KeyChainActivity.java
+++ b/src/com/android/keychain/KeyChainActivity.java
@@ -65,6 +65,8 @@
 
 import javax.security.auth.x500.X500Principal;
 
+import static android.view.WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS;
+
 public class KeyChainActivity extends Activity {
     private static final String TAG = "KeyChain";
 
@@ -82,6 +84,12 @@
     // be done on the UI thread.
     private KeyStore mKeyStore = KeyStore.getInstance();
 
+    @Override
+    protected void onCreate(Bundle savedState) {
+        super.onCreate(savedState);
+        getWindow().addSystemFlags(SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS);
+    }
+
     @Override public void onResume() {
         super.onResume();
 
@@ -386,6 +394,9 @@
                 finish(null);
             }
         });
+        dialog.create();
+        // Prevents screen overlay attack.
+        dialog.getButton(DialogInterface.BUTTON_POSITIVE).setFilterTouchesWhenObscured(true);
         dialog.show();
     }