Skip to content
This repository was archived by the owner on Dec 23, 2024. It is now read-only.

Commit 7e6c6ad

Browse files
SkewedZeppelinSkewedZeppelin
committed
16.0: June ASB picks
Signed-off-by: Tavi <[email protected]>
1 parent 416482f commit 7e6c6ad

File tree

7 files changed

+363
-1
lines changed

7 files changed

+363
-1
lines changed

‎Patches/LineageOS-16.0/android_frameworks_base/394877.patch‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
From 361c828f654b646f968644dbadf8a1f5f8ad67d8 Mon Sep 17 00:00:00 2001
2+
From: Valentin Iftime <[email protected]>
3+
Date: Thu, 1 Feb 2024 13:58:49 +0100
4+
Subject: [PATCH] [BACKPORT] Verify URI permission for channel sound update
5+
from NotificationListenerService
6+
7+
Check that a privileged NotificationListenerService (CDM) has the permission to access the sound URI
8+
when updating a notification channel.
9+
10+
Test: atest com.android.server.notification.NotificationManagerServiceTest#testUpdateNotificationChannelFromPrivilegedListener_noSoundUriPermission
11+
Bug: 317357401
12+
(cherry picked from commit 9b7bbbf5ad542ecf9ecbf8cd819b468791b443c0)
13+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:f090c0538a27d8658d8a860046d5c5e931302341)
14+
Merged-In: Ic7d2e96e43565e98d2aa29b8f2ba35c142387ba9
15+
Change-Id: Ic7d2e96e43565e98d2aa29b8f2ba35c142387ba9
16+
---
17+
.../NotificationManagerService.java | 22 +++++++
18+
.../NotificationManagerServiceTest.java | 57 +++++++++++++++++++
19+
2 files changed, 79 insertions(+)
20+
21+
diff --git a/services/core/java/com/android/server/notification/NotificationManagerService.java b/services/core/java/com/android/server/notification/NotificationManagerService.java
22+
index a1e8cd15fd7ee..e793dc024156a 100755
23+
--- a/services/core/java/com/android/server/notification/NotificationManagerService.java
24+
+++ b/services/core/java/com/android/server/notification/NotificationManagerService.java
25+
@@ -3668,6 +3668,10 @@ public void updateNotificationChannelFromPrivilegedListener(INotificationListene
26+
Preconditions.checkNotNull(user);
27+
28+
verifyPrivilegedListener(token, user);
29+
+
30+
+ final NotificationChannel originalChannel = mRankingHelper.getNotificationChannel(
31+
+ pkg, getUidForPackageAndUser(pkg, user), channel.getId(), true);
32+
+ verifyPrivilegedListenerUriPermission(Binder.getCallingUid(), channel, originalChannel);
33+
updateNotificationChannelInt(pkg, getUidForPackageAndUser(pkg, user), channel, true);
34+
}
35+
36+
@@ -3709,6 +3713,24 @@ private void verifyPrivilegedListener(INotificationListener token, UserHandle us
37+
}
38+
}
39+
40+
+ private void verifyPrivilegedListenerUriPermission(int sourceUid,
41+
+ @NonNull NotificationChannel updateChannel,
42+
+ @Nullable NotificationChannel originalChannel) {
43+
+ // Check that the NLS has the required permissions to access the channel
44+
+ final Uri soundUri = updateChannel.getSound();
45+
+ final Uri originalSoundUri =
46+
+ (originalChannel != null) ? originalChannel.getSound() : null;
47+
+ if (soundUri != null && !Objects.equals(originalSoundUri, soundUri)) {
48+
+ Binder.withCleanCallingIdentity(() -> {
49+
+ mAm.checkGrantUriPermission(sourceUid, null,
50+
+ ContentProvider.getUriWithoutUserId(soundUri),
51+
+ Intent.FLAG_GRANT_READ_URI_PERMISSION,
52+
+ ContentProvider.getUserIdFromUri(soundUri,
53+
+ UserHandle.getUserId(sourceUid)));
54+
+ });
55+
+ }
56+
+ }
57+
+
58+
private int getUidForPackageAndUser(String pkg, UserHandle user) throws RemoteException {
59+
int uid = 0;
60+
long identity = Binder.clearCallingIdentity();
61+
diff --git a/services/tests/uiservicestests/src/com/android/server/notification/NotificationManagerServiceTest.java b/services/tests/uiservicestests/src/com/android/server/notification/NotificationManagerServiceTest.java
62+
index 379290bcf0ad0..db83d8f1a4f07 100644
63+
--- a/services/tests/uiservicestests/src/com/android/server/notification/NotificationManagerServiceTest.java
64+
+++ b/services/tests/uiservicestests/src/com/android/server/notification/NotificationManagerServiceTest.java
65+
@@ -1681,6 +1681,63 @@ public void testUpdateNotificationChannelFromPrivilegedListener_badUser() throws
66+
eq(NotificationListenerService.NOTIFICATION_CHANNEL_OR_GROUP_UPDATED));
67+
}
68+
69+
+ @Test
70+
+ public void testUpdateNotificationChannelFromPrivilegedListener_noSoundUriPermission()
71+
+ throws Exception {
72+
+ mService.setPreferencesHelper(mPreferencesHelper);
73+
+ List<String> associations = new ArrayList<>();
74+
+ associations.add("a");
75+
+ when(mCompanionMgr.getAssociations(PKG, UserHandle.getUserId(mUid)))
76+
+ .thenReturn(associations);
77+
+ when(mPreferencesHelper.getNotificationChannel(eq(PKG), anyInt(),
78+
+ eq(mTestNotificationChannel.getId()), anyBoolean()))
79+
+ .thenReturn(mTestNotificationChannel);
80+
+ final Uri soundUri = Uri.parse("content://media/test/sound/uri");
81+
+ final NotificationChannel updatedNotificationChannel = new NotificationChannel(
82+
+ TEST_CHANNEL_ID, TEST_CHANNEL_ID, IMPORTANCE_DEFAULT);
83+
+ updatedNotificationChannel.setSound(soundUri,
84+
+ updatedNotificationChannel.getAudioAttributes());
85+
+ doThrow(new SecurityException("no access")).when(mUgmInternal)
86+
+ .checkGrantUriPermission(eq(Process.myUid()), any(), eq(soundUri),
87+
+ anyInt(), eq(Process.myUserHandle().getIdentifier()));
88+
+ assertThrows(SecurityException.class,
89+
+ () -> mBinderService.updateNotificationChannelFromPrivilegedListener(null, PKG,
90+
+ Process.myUserHandle(), updatedNotificationChannel));
91+
+ verify(mPreferencesHelper, never()).updateNotificationChannel(
92+
+ anyString(), anyInt(), any(), anyBoolean());
93+
+ verify(mListeners, never()).notifyNotificationChannelChanged(eq(PKG),
94+
+ eq(Process.myUserHandle()), eq(mTestNotificationChannel),
95+
+ eq(NotificationListenerService.NOTIFICATION_CHANNEL_OR_GROUP_UPDATED));
96+
+ }
97+
+
98+
+ @Test
99+
+ public void testUpdateNotificationChannelFromPrivilegedListener_noSoundUriPermission_sameSound()
100+
+ throws Exception {
101+
+ mService.setPreferencesHelper(mPreferencesHelper);
102+
+ List<String> associations = new ArrayList<>();
103+
+ associations.add("a");
104+
+ when(mCompanionMgr.getAssociations(PKG, UserHandle.getUserId(mUid)))
105+
+ .thenReturn(associations);
106+
+ when(mPreferencesHelper.getNotificationChannel(eq(PKG), anyInt(),
107+
+ eq(mTestNotificationChannel.getId()), anyBoolean()))
108+
+ .thenReturn(mTestNotificationChannel);
109+
+ final Uri soundUri = Settings.System.DEFAULT_NOTIFICATION_URI;
110+
+ final NotificationChannel updatedNotificationChannel = new NotificationChannel(
111+
+ TEST_CHANNEL_ID, TEST_CHANNEL_ID, IMPORTANCE_DEFAULT);
112+
+ updatedNotificationChannel.setSound(soundUri,
113+
+ updatedNotificationChannel.getAudioAttributes());
114+
+ doThrow(new SecurityException("no access")).when(mUgmInternal)
115+
+ .checkGrantUriPermission(eq(Process.myUid()), any(), eq(soundUri),
116+
+ anyInt(), eq(Process.myUserHandle().getIdentifier()));
117+
+ mBinderService.updateNotificationChannelFromPrivilegedListener(
118+
+ null, PKG, Process.myUserHandle(), updatedNotificationChannel);
119+
+ verify(mPreferencesHelper, times(1)).updateNotificationChannel(
120+
+ anyString(), anyInt(), any(), anyBoolean());
121+
+ verify(mListeners, never()).notifyNotificationChannelChanged(eq(PKG),
122+
+ eq(Process.myUserHandle()), eq(mTestNotificationChannel),
123+
+ eq(NotificationListenerService.NOTIFICATION_CHANNEL_OR_GROUP_UPDATED));
124+
+ }
125+
+
126+
@Test
127+
public void testGetNotificationChannelFromPrivilegedListener_success() throws Exception {
128+
mService.setRankingHelper(mRankingHelper);

‎Patches/LineageOS-16.0/android_frameworks_base/394878.patch‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
From 2d2a31353a07daf096aa9e2ca09e18ad2773b1ba Mon Sep 17 00:00:00 2001
2+
From: Dmitry Dementyev <[email protected]>
3+
Date: Tue, 26 Mar 2024 10:31:44 -0700
4+
Subject: [PATCH] Add more checkKeyIntent checks to AccountManagerService.
5+
6+
Another verification is needed after Bundle modification.
7+
Bug: 321941232
8+
Test: manual
9+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:36db8a1d61a881f89fdd3911886adcda6e1f0d7f)
10+
Merged-In: I9e45d758a2320328da5664b6341eafe6f285f297
11+
Change-Id: I9e45d758a2320328da5664b6341eafe6f285f297
12+
---
13+
.../android/server/accounts/AccountManagerService.java | 10 ++++++++++
14+
1 file changed, 10 insertions(+)
15+
16+
diff --git a/services/core/java/com/android/server/accounts/AccountManagerService.java b/services/core/java/com/android/server/accounts/AccountManagerService.java
17+
index 4e4c261d0cc46..19e1a4c55120a 100644
18+
--- a/services/core/java/com/android/server/accounts/AccountManagerService.java
19+
+++ b/services/core/java/com/android/server/accounts/AccountManagerService.java
20+
@@ -3453,6 +3453,11 @@ public void onResult(Bundle result) {
21+
22+
// Strip auth token from result.
23+
result.remove(AccountManager.KEY_AUTHTOKEN);
24+
+ if (!checkKeyIntent(Binder.getCallingUid(), result)) {
25+
+ onError(AccountManager.ERROR_CODE_INVALID_RESPONSE,
26+
+ "invalid intent in bundle returned");
27+
+ return;
28+
+ }
29+
30+
if (Log.isLoggable(TAG, Log.VERBOSE)) {
31+
Log.v(TAG,
32+
@@ -5039,6 +5044,11 @@ public void onResult(Bundle result) {
33+
} else {
34+
if (mStripAuthTokenFromResult) {
35+
result.remove(AccountManager.KEY_AUTHTOKEN);
36+
+ if (!checkKeyIntent(Binder.getCallingUid(), result)) {
37+
+ onError(AccountManager.ERROR_CODE_INVALID_RESPONSE,
38+
+ "invalid intent in bundle returned");
39+
+ return;
40+
+ }
41+
}
42+
if (Log.isLoggable(TAG, Log.VERBOSE)) {
43+
Log.v(TAG, getClass().getSimpleName()

‎Patches/LineageOS-16.0/android_frameworks_base/394879.patch‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
From a568a9144f1a804e4ac136522dfcd1f8aaae81a3 Mon Sep 17 00:00:00 2001
2+
From: Chris Wailes <[email protected]>
3+
Date: Thu, 18 Apr 2019 18:25:57 -0700
4+
Subject: [PATCH] Adds additional sanitization for Zygote command arguments.
5+
6+
Previously we were only insuring that the arguments provided to the
7+
Zygote didn't contain any newlines. This adds additional checks for
8+
carriage returns and standalone integer arguments to protect against
9+
malicious argument and packet injection respectively.
10+
11+
Bug: 130164289
12+
Test: m & flash & boot & check logs
13+
Change-Id: I4055c50d52db0047c02c11096710fd07b429660c
14+
Merged-In: I4055c50d52db0047c02c11096710fd07b429660c
15+
(cherry picked from commit c99198249f8bb79487d4f9f0f45b5b2fefaba41a)
16+
---
17+
core/java/android/os/ZygoteProcess.java | 9 +++++++--
18+
1 file changed, 7 insertions(+), 2 deletions(-)
19+
20+
diff --git a/core/java/android/os/ZygoteProcess.java b/core/java/android/os/ZygoteProcess.java
21+
index 6994033a963a8..904ec46859fa4 100644
22+
--- a/core/java/android/os/ZygoteProcess.java
23+
+++ b/core/java/android/os/ZygoteProcess.java
24+
@@ -16,6 +16,7 @@
25+
26+
package android.os;
27+
28+
+import android.annotation.NonNull;
29+
import android.net.LocalSocket;
30+
import android.net.LocalSocketAddress;
31+
import android.util.Log;
32+
@@ -278,15 +279,19 @@ private static String getAbiList(BufferedWriter writer, DataInputStream inputStr
33+
*/
34+
@GuardedBy("mLock")
35+
private static Process.ProcessStartResult zygoteSendArgsAndGetResult(
36+
- ZygoteState zygoteState, ArrayList<String> args)
37+
+ ZygoteState zygoteState, @NonNull ArrayList<String> args)
38+
throws ZygoteStartFailedEx {
39+
try {
40+
// Throw early if any of the arguments are malformed. This means we can
41+
// avoid writing a partial response to the zygote.
42+
int sz = args.size();
43+
for (int i = 0; i < sz; i++) {
44+
+ // Making two indexOf calls here is faster than running a manually fused loop due
45+
+ // to the fact that indexOf is a optimized intrinsic.
46+
if (args.get(i).indexOf('\n') >= 0) {
47+
- throw new ZygoteStartFailedEx("embedded newlines not allowed");
48+
+ throw new ZygoteStartFailedEx("Embedded newlines not allowed");
49+
+ } else if (args.get(i).indexOf('\r') >= 0) {
50+
+ throw new ZygoteStartFailedEx("Embedded carriage returns not allowed");
51+
}
52+
}
53+

‎Patches/LineageOS-16.0/android_frameworks_base/394880.patch‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
From 00ff56bb646c525192f06cbeed96c3dc78d45795 Mon Sep 17 00:00:00 2001
2+
From: Hans Boehm <[email protected]>
3+
Date: Tue, 2 Jan 2024 16:53:13 -0800
4+
Subject: [PATCH] Check hidden API exemptions
5+
6+
Refuse to deal with newlines and null characters in
7+
HiddenApiSettings.update(). Also disallow nulls in process start
8+
arguments.
9+
10+
Bug: 316153291
11+
Test: Treehugger for now
12+
(cherry picked from commit 7ba059e2cf0a2c20f9a849719cdc32b12c933a44)
13+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:60669aa49aba34c0950d6246bd95b54f91a3c8e8)
14+
Merged-In: I83cd60e46407a4a082f9f3c80e937dbd522dbac4
15+
Change-Id: I83cd60e46407a4a082f9f3c80e937dbd522dbac4
16+
---
17+
core/java/android/os/ZygoteProcess.java | 2 ++
18+
1 file changed, 2 insertions(+)
19+
20+
diff --git a/core/java/android/os/ZygoteProcess.java b/core/java/android/os/ZygoteProcess.java
21+
index 904ec46859fa4..aab1d9d578031 100644
22+
--- a/core/java/android/os/ZygoteProcess.java
23+
+++ b/core/java/android/os/ZygoteProcess.java
24+
@@ -292,6 +292,8 @@ private static Process.ProcessStartResult zygoteSendArgsAndGetResult(
25+
throw new ZygoteStartFailedEx("Embedded newlines not allowed");
26+
} else if (args.get(i).indexOf('\r') >= 0) {
27+
throw new ZygoteStartFailedEx("Embedded carriage returns not allowed");
28+
+ } else if (args.get(i).indexOf('\u0000') >= 0) {
29+
+ throw new ZygoteStartFailedEx("Embedded nulls not allowed");
30+
}
31+
}
32+

‎Patches/LineageOS-16.0/android_frameworks_base/394881.patch‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
From a73947c4826f59babc2368754e478942eb9b28a1 Mon Sep 17 00:00:00 2001
2+
From: Ameer Armaly <[email protected]>
3+
Date: Fri, 8 Mar 2024 19:41:06 +0000
4+
Subject: [PATCH] AccessibilityManagerService: remove uninstalled services from
5+
enabled list after service update.
6+
7+
Bug: 326485767
8+
Test: atest AccessibilityEndToEndTest#testUpdateServiceWithoutIntent_disablesService
9+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:5405514a23edcba0cf30e6ec78189e3f4e7d95cf)
10+
Merged-In: I5e59296fcad68e62b34c74ee5fd80b6ad6b46fa1
11+
Change-Id: I5e59296fcad68e62b34c74ee5fd80b6ad6b46fa1
12+
---
13+
.../AccessibilityManagerService.java | 23 +++++++++++++++++++
14+
1 file changed, 23 insertions(+)
15+
16+
diff --git a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
17+
index fd87be3e5649f..39ac2f3c1bdbf 100644
18+
--- a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
19+
+++ b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
20+
@@ -1553,10 +1553,13 @@ private void updateServicesLocked(UserState userState) {
21+
boolean isUnlockingOrUnlocked = LocalServices.getService(UserManagerInternal.class)
22+
.isUserUnlockingOrUnlocked(userState.mUserId);
23+
24+
+ // Store the list of installed services.
25+
+ mTempComponentNameSet.clear();
26+
for (int i = 0, count = userState.mInstalledServices.size(); i < count; i++) {
27+
AccessibilityServiceInfo installedService = userState.mInstalledServices.get(i);
28+
ComponentName componentName = ComponentName.unflattenFromString(
29+
installedService.getId());
30+
+ mTempComponentNameSet.add(componentName);
31+
32+
AccessibilityServiceConnection service = componentNameToServiceMap.get(componentName);
33+
34+
@@ -1602,6 +1605,26 @@ private void updateServicesLocked(UserState userState) {
35+
if (audioManager != null) {
36+
audioManager.setAccessibilityServiceUids(mTempIntArray);
37+
}
38+
+
39+
+ // If any services have been removed, remove them from the enabled list and the touch
40+
+ // exploration granted list.
41+
+ boolean anyServiceRemoved =
42+
+ userState.mEnabledServices.removeIf((comp) -> !mTempComponentNameSet.contains(comp))
43+
+ || userState.mTouchExplorationGrantedServices.removeIf(
44+
+ (comp) -> !mTempComponentNameSet.contains(comp));
45+
+ if (anyServiceRemoved) {
46+
+ // Update the enabled services setting.
47+
+ persistComponentNamesToSettingLocked(
48+
+ Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES,
49+
+ userState.mEnabledServices,
50+
+ userState.mUserId);
51+
+ // Update the touch exploration granted services setting.
52+
+ persistComponentNamesToSettingLocked(
53+
+ Settings.Secure.TOUCH_EXPLORATION_GRANTED_ACCESSIBILITY_SERVICES,
54+
+ userState.mTouchExplorationGrantedServices,
55+
+ userState.mUserId);
56+
+ }
57+
+ mTempComponentNameSet.clear();
58+
updateAccessibilityEnabledSetting(userState);
59+
}
60+

‎Patches/LineageOS-16.0/android_frameworks_base/394882.patch‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
From 538cc6c384985f272dc7ab6c7cc7222a59b4c341 Mon Sep 17 00:00:00 2001
2+
From: Guojing Yuan <[email protected]>
3+
Date: Thu, 14 Dec 2023 19:30:04 +0000
4+
Subject: [PATCH] [BACKPORT] Check permissions for CDM shell commands
5+
6+
Override handleShellCommand instead of onShellCommand because
7+
Binder.onShellCommand checks the necessary permissions of the caller.
8+
9+
Backport by [email protected]:
10+
In Pie, method handleShellCommand does not exist, only Binder.onShellCommand, in which
11+
the caller uid check isn't yet implemented. Backport: Take over the uid check from A11
12+
and implement it in the method override.
13+
14+
Bug: 313428840
15+
16+
Test: manually tested CDM shell commands
17+
(cherry picked from commit 1761a0fee9c2cd9787bbb7fbdbe30b4c2b03396e)
18+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:8d008c61451dba86aa9f14c6bcd661db2cea4856)
19+
Merged-In: I5539b3594feb5544c458c0fd1061b51a0a808900
20+
Change-Id: I5539b3594feb5544c458c0fd1061b51a0a808900
21+
---
22+
.../server/companion/CompanionDeviceManagerService.java | 5 +++++
23+
1 file changed, 5 insertions(+)
24+
25+
diff --git a/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java b/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java
26+
index 087fe8560fc80..8ffb53f8a3b9d 100644
27+
--- a/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java
28+
+++ b/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java
29+
@@ -345,6 +345,11 @@ private void checkUsesFeature(String pkg, int userId) {
30+
public void onShellCommand(FileDescriptor in, FileDescriptor out, FileDescriptor err,
31+
String[] args, ShellCallback callback, ResultReceiver resultReceiver)
32+
throws RemoteException {
33+
+ final int callingUid = Binder.getCallingUid();
34+
+ if (callingUid != Process.ROOT_UID && callingUid != Process.SHELL_UID) {
35+
+ resultReceiver.send(-1, null);
36+
+ throw new RemoteException("Shell commands are only callable by ADB");
37+
+ }
38+
new ShellCmd().exec(this, in, out, err, args, callback, resultReceiver);
39+
}
40+
}

0 commit comments

Comments
 (0)