diff options
| -rw-r--r-- | core/java/android/app/ActivityManagerNative.java | 39 | ||||
| -rw-r--r-- | core/java/android/app/IActivityManager.java | 6 | ||||
| -rw-r--r-- | services/java/com/android/server/am/ActivityManagerService.java | 15 |
3 files changed, 55 insertions, 5 deletions
diff --git a/core/java/android/app/ActivityManagerNative.java b/core/java/android/app/ActivityManagerNative.java index ec7714d61481..ba6cc32808d4 100644 --- a/core/java/android/app/ActivityManagerNative.java +++ b/core/java/android/app/ActivityManagerNative.java @@ -1068,6 +1068,23 @@ public abstract class ActivityManagerNative extends Binder implements IActivityM unregisterActivityWatcher(watcher); return true; } + + case START_ACTIVITY_IN_PACKAGE_TRANSACTION: + { + data.enforceInterface(IActivityManager.descriptor); + int uid = data.readInt(); + Intent intent = Intent.CREATOR.createFromParcel(data); + String resolvedType = data.readString(); + IBinder resultTo = data.readStrongBinder(); + String resultWho = data.readString(); + int requestCode = data.readInt(); + boolean onlyIfNeeded = data.readInt() != 0; + int result = startActivityInPackage(uid, intent, resolvedType, + resultTo, resultWho, requestCode, onlyIfNeeded); + reply.writeNoException(); + reply.writeInt(result); + return true; + } } return super.onTransact(code, data, reply, flags); @@ -2330,5 +2347,27 @@ class ActivityManagerProxy implements IActivityManager reply.recycle(); } + public int startActivityInPackage(int uid, + Intent intent, String resolvedType, IBinder resultTo, + String resultWho, int requestCode, boolean onlyIfNeeded) + throws RemoteException { + Parcel data = Parcel.obtain(); + Parcel reply = Parcel.obtain(); + data.writeInterfaceToken(IActivityManager.descriptor); + data.writeInt(uid); + intent.writeToParcel(data, 0); + data.writeString(resolvedType); + data.writeStrongBinder(resultTo); + data.writeString(resultWho); + data.writeInt(requestCode); + data.writeInt(onlyIfNeeded ? 1 : 0); + mRemote.transact(START_ACTIVITY_IN_PACKAGE_TRANSACTION, data, reply, 0); + reply.readException(); + int result = reply.readInt(); + reply.recycle(); + data.recycle(); + return result; + } + private IBinder mRemote; } diff --git a/core/java/android/app/IActivityManager.java b/core/java/android/app/IActivityManager.java index ee1b69b9af59..95b376cce673 100644 --- a/core/java/android/app/IActivityManager.java +++ b/core/java/android/app/IActivityManager.java @@ -262,6 +262,11 @@ public interface IActivityManager extends IInterface { public void unregisterActivityWatcher(IActivityWatcher watcher) throws RemoteException; + public int startActivityInPackage(int uid, + Intent intent, String resolvedType, IBinder resultTo, + String resultWho, int requestCode, boolean onlyIfNeeded) + throws RemoteException; + /* * Private non-Binder interfaces */ @@ -415,4 +420,5 @@ public interface IActivityManager extends IInterface { int UNBIND_BACKUP_AGENT_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+91; int REGISTER_ACTIVITY_WATCHER_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+92; int UNREGISTER_ACTIVITY_WATCHER_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+93; + int START_ACTIVITY_IN_PACKAGE_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+94; } diff --git a/services/java/com/android/server/am/ActivityManagerService.java b/services/java/com/android/server/am/ActivityManagerService.java index 442e9ce3fd1c..36d3c4ada02f 100644 --- a/services/java/com/android/server/am/ActivityManagerService.java +++ b/services/java/com/android/server/am/ActivityManagerService.java @@ -3522,8 +3522,6 @@ public final class ActivityManagerService extends ActivityManagerNative implemen intent = new Intent(intent); // Collect information about the target of the Intent. - // Must do this before locking, because resolving the intent - // may require launching a process to run its content provider. ActivityInfo aInfo; try { ResolveInfo rInfo = @@ -3657,17 +3655,24 @@ public final class ActivityManagerService extends ActivityManagerNative implemen } } - final int startActivityInPackage(int uid, + public final int startActivityInPackage(int uid, Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode, boolean onlyIfNeeded) { + + // This is so super not safe, that only the system (or okay root) + // can do it. + final int callingUid = Binder.getCallingUid(); + if (callingUid != 0 && callingUid != Process.myUid()) { + throw new SecurityException( + "startActivityInPackage only available to the system"); + } + final boolean componentSpecified = intent.getComponent() != null; // Don't modify the client's object! intent = new Intent(intent); // Collect information about the target of the Intent. - // Must do this before locking, because resolving the intent - // may require launching a process to run its content provider. ActivityInfo aInfo; try { ResolveInfo rInfo = |