Skip to content

Commit 6aba151

Browse files
Rhed JaoAndroid Build Coastguard Worker
Rhed Jao
authored and
Android Build Coastguard Worker
committed
[RESTRICT AUTOMERGE] Fix bypass BG-FGS and BAL via package manager APIs
Opt-in for BAL of PendingIntent for following APIs: * PackageInstaller.uninstall() * PackageInstaller.installExistingPackage() * PackageInstaller.uninstallExistingPackage() * PackageInstaller.Session.commit() * PackageInstaller.Session.commitTransferred() * PackageManager.freeStorage() Bug: 230492955 Bug: 243377226 Test: atest android.security.cts.PackageInstallerTest Test: atest CtsStagedInstallHostTestCases Change-Id: I9b6f801d69ea6d2244a38dbe689e81afa4e798bf (cherry picked from commit 03b77ae) Merged-In: I9b6f801d69ea6d2244a38dbe689e81afa4e798bf
1 parent 0924de4 commit 6aba151

5 files changed

Lines changed: 72 additions & 9 deletions

File tree

‎core/java/android/content/IntentSender.java‎

Lines changed: 39 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import android.annotation.Nullable;
2020
import android.app.ActivityManager;
2121
import android.app.ActivityManager.PendingIntentInfo;
22+
import android.app.ActivityOptions;
2223
import android.compat.annotation.UnsupportedAppUsage;
2324
import android.os.Bundle;
2425
import android.os.Handler;
@@ -158,7 +159,7 @@ public void run() {
158159
*/
159160
public void sendIntent(Context context, int code, Intent intent,
160161
OnFinished onFinished, Handler handler) throws SendIntentException {
161-
sendIntent(context, code, intent, onFinished, handler, null);
162+
sendIntent(context, code, intent, onFinished, handler, null, null /* options */);
162163
}
163164

164165
/**
@@ -190,6 +191,42 @@ public void sendIntent(Context context, int code, Intent intent,
190191
public void sendIntent(Context context, int code, Intent intent,
191192
OnFinished onFinished, Handler handler, String requiredPermission)
192193
throws SendIntentException {
194+
sendIntent(context, code, intent, onFinished, handler, requiredPermission,
195+
null /* options */);
196+
}
197+
198+
/**
199+
* Perform the operation associated with this IntentSender, allowing the
200+
* caller to specify information about the Intent to use and be notified
201+
* when the send has completed.
202+
*
203+
* @param context The Context of the caller. This may be null if
204+
* <var>intent</var> is also null.
205+
* @param code Result code to supply back to the IntentSender's target.
206+
* @param intent Additional Intent data. See {@link Intent#fillIn
207+
* Intent.fillIn()} for information on how this is applied to the
208+
* original Intent. Use null to not modify the original Intent.
209+
* @param onFinished The object to call back on when the send has
210+
* completed, or null for no callback.
211+
* @param handler Handler identifying the thread on which the callback
212+
* should happen. If null, the callback will happen from the thread
213+
* pool of the process.
214+
* @param requiredPermission Name of permission that a recipient of the PendingIntent
215+
* is required to hold. This is only valid for broadcast intents, and
216+
* corresponds to the permission argument in
217+
* {@link Context#sendBroadcast(Intent, String) Context.sendOrderedBroadcast(Intent, String)}.
218+
* If null, no permission is required.
219+
* @param options Additional options the caller would like to provide to modify the sending
220+
* behavior. May be built from an {@link ActivityOptions} to apply to an activity start.
221+
*
222+
* @throws SendIntentException Throws CanceledIntentException if the IntentSender
223+
* is no longer allowing more intents to be sent through it.
224+
* @hide
225+
*/
226+
public void sendIntent(Context context, int code, Intent intent,
227+
OnFinished onFinished, Handler handler, String requiredPermission,
228+
@Nullable Bundle options)
229+
throws SendIntentException {
193230
try {
194231
String resolvedType = intent != null ?
195232
intent.resolveTypeIfNeeded(context.getContentResolver())
@@ -199,7 +236,7 @@ public void sendIntent(Context context, int code, Intent intent,
199236
onFinished != null
200237
? new FinishedDispatcher(this, onFinished, handler)
201238
: null,
202-
requiredPermission, null);
239+
requiredPermission, options);
203240
if (res < 0) {
204241
throw new SendIntentException();
205242
}

‎services/core/java/com/android/server/pm/InstallPackageHelper.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,7 @@
9494
import android.annotation.UserIdInt;
9595
import android.app.AppOpsManager;
9696
import android.app.ApplicationPackageManager;
97+
import android.app.BroadcastOptions;
9798
import android.app.backup.IBackupManager;
9899
import android.content.ContentResolver;
99100
import android.content.Context;
@@ -641,7 +642,10 @@ private static void onRestoreComplete(int returnCode, Context context, IntentSen
641642
fillIn.putExtra(PackageInstaller.EXTRA_STATUS,
642643
PackageManager.installStatusToPublicStatus(returnCode));
643644
try {
644-
target.sendIntent(context, 0, fillIn, null, null);
645+
final BroadcastOptions options = BroadcastOptions.makeBasic();
646+
options.setPendingIntentBackgroundActivityLaunchAllowed(false);
647+
target.sendIntent(context, 0, fillIn, null /* onFinished*/, null /* handler */,
648+
null /* requiredPermission */, options.toBundle());
645649
} catch (IntentSender.SendIntentException ignored) {
646650
}
647651
}

‎services/core/java/com/android/server/pm/PackageInstallerService.java‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
import android.app.ActivityManager;
2828
import android.app.AppGlobals;
2929
import android.app.AppOpsManager;
30+
import android.app.BroadcastOptions;
3031
import android.app.Notification;
3132
import android.app.NotificationManager;
3233
import android.app.PackageDeleteObserver;
@@ -1360,7 +1361,10 @@ public void onUserActionRequired(Intent intent) {
13601361
PackageInstaller.STATUS_PENDING_USER_ACTION);
13611362
fillIn.putExtra(Intent.EXTRA_INTENT, intent);
13621363
try {
1363-
mTarget.sendIntent(mContext, 0, fillIn, null, null);
1364+
final BroadcastOptions options = BroadcastOptions.makeBasic();
1365+
options.setPendingIntentBackgroundActivityLaunchAllowed(false);
1366+
mTarget.sendIntent(mContext, 0, fillIn, null /* onFinished*/,
1367+
null /* handler */, null /* requiredPermission */, options.toBundle());
13641368
} catch (SendIntentException ignored) {
13651369
}
13661370
}
@@ -1385,7 +1389,10 @@ public void onPackageDeleted(String basePackageName, int returnCode, String msg)
13851389
PackageManager.deleteStatusToString(returnCode, msg));
13861390
fillIn.putExtra(PackageInstaller.EXTRA_LEGACY_STATUS, returnCode);
13871391
try {
1388-
mTarget.sendIntent(mContext, 0, fillIn, null, null);
1392+
final BroadcastOptions options = BroadcastOptions.makeBasic();
1393+
options.setPendingIntentBackgroundActivityLaunchAllowed(false);
1394+
mTarget.sendIntent(mContext, 0, fillIn, null /* onFinished*/,
1395+
null /* handler */, null /* requiredPermission */, options.toBundle());
13891396
} catch (SendIntentException ignored) {
13901397
}
13911398
}

‎services/core/java/com/android/server/pm/PackageInstallerSession.java‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@
5454
import android.annotation.Nullable;
5555
import android.annotation.WorkerThread;
5656
import android.app.AppOpsManager;
57+
import android.app.BroadcastOptions;
5758
import android.app.Notification;
5859
import android.app.NotificationManager;
5960
import android.app.admin.DevicePolicyEventLogger;
@@ -4274,7 +4275,10 @@ private static void sendOnUserActionRequired(Context context, IntentSender targe
42744275
fillIn.putExtra(PackageInstaller.EXTRA_STATUS, PackageInstaller.STATUS_PENDING_USER_ACTION);
42754276
fillIn.putExtra(Intent.EXTRA_INTENT, intent);
42764277
try {
4277-
target.sendIntent(context, 0, fillIn, null, null);
4278+
final BroadcastOptions options = BroadcastOptions.makeBasic();
4279+
options.setPendingIntentBackgroundActivityLaunchAllowed(false);
4280+
target.sendIntent(context, 0, fillIn, null /* onFinished */,
4281+
null /* handler */, null /* requiredPermission */, options.toBundle());
42784282
} catch (IntentSender.SendIntentException ignored) {
42794283
}
42804284
}
@@ -4315,7 +4319,10 @@ private static void sendOnPackageInstalled(Context context, IntentSender target,
43154319
}
43164320
}
43174321
try {
4318-
target.sendIntent(context, 0, fillIn, null, null);
4322+
final BroadcastOptions options = BroadcastOptions.makeBasic();
4323+
options.setPendingIntentBackgroundActivityLaunchAllowed(false);
4324+
target.sendIntent(context, 0, fillIn, null /* onFinished */,
4325+
null /* handler */, null /* requiredPermission */, options.toBundle());
43194326
} catch (IntentSender.SendIntentException ignored) {
43204327
}
43214328
}
@@ -4349,7 +4356,10 @@ private static void sendPendingStreaming(Context context, IntentSender target, i
43494356
intent.putExtra(PackageInstaller.EXTRA_STATUS_MESSAGE, "Staging Image Not Ready");
43504357
}
43514358
try {
4352-
target.sendIntent(context, 0, intent, null, null);
4359+
final BroadcastOptions options = BroadcastOptions.makeBasic();
4360+
options.setPendingIntentBackgroundActivityLaunchAllowed(false);
4361+
target.sendIntent(context, 0, intent, null /* onFinished */,
4362+
null /* handler */, null /* requiredPermission */, options.toBundle());
43534363
} catch (IntentSender.SendIntentException ignored) {
43544364
}
43554365
}

‎services/core/java/com/android/server/pm/PackageManagerService.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@
5353
import android.app.ActivityManager;
5454
import android.app.AppOpsManager;
5555
import android.app.ApplicationPackageManager;
56+
import android.app.BroadcastOptions;
5657
import android.app.IActivityManager;
5758
import android.app.admin.IDevicePolicyManager;
5859
import android.app.admin.SecurityLog;
@@ -4798,7 +4799,11 @@ public void freeStorage(final String volumeUuid, final long freeStorageSize,
47984799
}
47994800
if (pi != null) {
48004801
try {
4801-
pi.sendIntent(null, success ? 1 : 0, null, null, null);
4802+
final BroadcastOptions options = BroadcastOptions.makeBasic();
4803+
options.setPendingIntentBackgroundActivityLaunchAllowed(false);
4804+
pi.sendIntent(null, success ? 1 : 0, null /* intent */,
4805+
null /* onFinished*/, null /* handler */,
4806+
null /* requiredPermission */, options.toBundle());
48024807
} catch (SendIntentException e) {
48034808
Slog.w(TAG, e);
48044809
}

0 commit comments

Comments
 (0)