From 40f616b1f654822b3ac7c13853212c63d91312d5 Mon Sep 17 00:00:00 2001 From: Craig Mautner Date: Tue, 17 Feb 2015 10:17:21 -0800 Subject: Do not make ActivityContainer available to apps. DO NOT MERGE A security leak was discovered whereby a malicious app could get the IActivityContainer object from one app and use it to inject events into another app. This fix removes the availability of the IActivityContainer and replaces its one use with a method for returning the information the IActivityContainer was used for. Fixes bug 19394591. Change-Id: Ib3cec25b25130cd8e098892c057742cfd575cfdd --- core/java/android/app/ActivityManagerNative.java | 29 +++++++--------------- core/java/android/app/ActivityThread.java | 6 ++--- core/java/android/app/IActivityManager.java | 5 ++-- .../android/server/am/ActivityManagerService.java | 10 ++++---- 4 files changed, 18 insertions(+), 32 deletions(-) diff --git a/core/java/android/app/ActivityManagerNative.java b/core/java/android/app/ActivityManagerNative.java index 4e2ff0bdb54f..a904460a0073 100644 --- a/core/java/android/app/ActivityManagerNative.java +++ b/core/java/android/app/ActivityManagerNative.java @@ -17,7 +17,6 @@ package android.app; import android.app.ActivityManager.StackInfo; -import android.app.ProfilerInfo; import android.content.ComponentName; import android.content.IIntentReceiver; import android.content.IIntentSender; @@ -2189,17 +2188,12 @@ public abstract class ActivityManagerNative extends Binder implements IActivityM return true; } - case GET_ACTIVITY_CONTAINER_TRANSACTION: { + case GET_ACTIVITY_DISPLAY_ID_TRANSACTION: { data.enforceInterface(IActivityManager.descriptor); IBinder activityToken = data.readStrongBinder(); - IActivityContainer activityContainer = getEnclosingActivityContainer(activityToken); + int displayId = getActivityDisplayId(activityToken); reply.writeNoException(); - if (activityContainer != null) { - reply.writeInt(1); - reply.writeStrongBinder(activityContainer.asBinder()); - } else { - reply.writeInt(0); - } + reply.writeInt(displayId); return true; } @@ -5169,26 +5163,21 @@ class ActivityManagerProxy implements IActivityManager reply.recycle(); } - public IActivityContainer getEnclosingActivityContainer(IBinder activityToken) - throws RemoteException { + @Override + public int getActivityDisplayId(IBinder activityToken) throws RemoteException { Parcel data = Parcel.obtain(); Parcel reply = Parcel.obtain(); data.writeInterfaceToken(IActivityManager.descriptor); data.writeStrongBinder(activityToken); - mRemote.transact(GET_ACTIVITY_CONTAINER_TRANSACTION, data, reply, 0); + mRemote.transact(GET_ACTIVITY_DISPLAY_ID_TRANSACTION, data, reply, 0); reply.readException(); - final int result = reply.readInt(); - final IActivityContainer res; - if (result == 1) { - res = IActivityContainer.Stub.asInterface(reply.readStrongBinder()); - } else { - res = null; - } + final int displayId = reply.readInt(); data.recycle(); reply.recycle(); - return res; + return displayId; } + @Override public IBinder getHomeActivityToken() throws RemoteException { Parcel data = Parcel.obtain(); Parcel reply = Parcel.obtain(); diff --git a/core/java/android/app/ActivityThread.java b/core/java/android/app/ActivityThread.java index dd49009281f3..647566a3904b 100644 --- a/core/java/android/app/ActivityThread.java +++ b/core/java/android/app/ActivityThread.java @@ -2312,10 +2312,7 @@ public final class ActivityThread { final DisplayManagerGlobal dm = DisplayManagerGlobal.getInstance(); try { - IActivityContainer container = - ActivityManagerNative.getDefault().getEnclosingActivityContainer(r.token); - final int displayId = - container == null ? Display.DEFAULT_DISPLAY : container.getDisplayId(); + int displayId = ActivityManagerNative.getDefault().getActivityDisplayId(r.token); if (displayId > Display.DEFAULT_DISPLAY) { Display display = dm.getRealDisplay(displayId, r.token); baseContext = appContext.createDisplayContext(display); @@ -2323,6 +2320,7 @@ public final class ActivityThread { } catch (RemoteException e) { } + // For debugging purposes, if the activity's package name contains the value of // the "debug.use-second-display" system property as a substring, then show // its content on a secondary display if there is one. diff --git a/core/java/android/app/IActivityManager.java b/core/java/android/app/IActivityManager.java index be26f3033459..1a8785b77141 100644 --- a/core/java/android/app/IActivityManager.java +++ b/core/java/android/app/IActivityManager.java @@ -435,8 +435,7 @@ public interface IActivityManager extends IInterface { public void deleteActivityContainer(IActivityContainer container) throws RemoteException; - public IActivityContainer getEnclosingActivityContainer(IBinder activityToken) - throws RemoteException; + public int getActivityDisplayId(IBinder activityToken) throws RemoteException; public IBinder getHomeActivityToken() throws RemoteException; @@ -746,7 +745,7 @@ public interface IActivityManager extends IInterface { int GET_PERSISTED_URI_PERMISSIONS_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+181; int APP_NOT_RESPONDING_VIA_PROVIDER_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+182; int GET_HOME_ACTIVITY_TOKEN_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+183; - int GET_ACTIVITY_CONTAINER_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+184; + int GET_ACTIVITY_DISPLAY_ID_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+184; int DELETE_ACTIVITY_CONTAINER_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+185; diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java index 8dfb3217c0af..3215144ac59a 100755 --- a/services/core/java/com/android/server/am/ActivityManagerService.java +++ b/services/core/java/com/android/server/am/ActivityManagerService.java @@ -55,6 +55,7 @@ import android.util.ArrayMap; import android.util.ArraySet; import android.util.SparseIntArray; +import android.view.Display; import com.android.internal.R; import com.android.internal.annotations.GuardedBy; import com.android.internal.app.IAppOpsService; @@ -8721,14 +8722,13 @@ public final class ActivityManagerService extends ActivityManagerNative } @Override - public IActivityContainer getEnclosingActivityContainer(IBinder activityToken) - throws RemoteException { + public int getActivityDisplayId(IBinder activityToken) throws RemoteException { synchronized (this) { ActivityStack stack = ActivityRecord.getStackLocked(activityToken); - if (stack != null) { - return stack.mActivityContainer; + if (stack != null && stack.mActivityContainer.isAttachedLocked()) { + return stack.mActivityContainer.getDisplayId(); } - return null; + return Display.DEFAULT_DISPLAY; } } -- cgit v1.2.3-59-g8ed1b