From 25d237b8ea8f573c1d6c27f7d9e87b5ebd5b5429 Mon Sep 17 00:00:00 2001 From: Jason Monk Date: Fri, 19 Jun 2015 10:39:39 -0400 Subject: Fix security whole in lock task When flags NEW_TASK and CLEAR_TASK are set, the task gets reused which causes the lock task to be ignored. Add a special check for this to be a lock task violation. Bug: 20893212 Change-Id: Ibf3c71f40e197f0830410eb4e20429e901998378 --- .../java/com/android/server/am/ActivityStackSupervisor.java | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/services/core/java/com/android/server/am/ActivityStackSupervisor.java b/services/core/java/com/android/server/am/ActivityStackSupervisor.java index 9e33f2a99607..4e98576e6fb9 100644 --- a/services/core/java/com/android/server/am/ActivityStackSupervisor.java +++ b/services/core/java/com/android/server/am/ActivityStackSupervisor.java @@ -1915,7 +1915,12 @@ public final class ActivityStackSupervisor implements DisplayListener { ActivityRecord intentActivity = !launchSingleInstance ? findTaskLocked(r) : findActivityLocked(intent, r.info); if (intentActivity != null) { - if (isLockTaskModeViolation(intentActivity.task)) { + // When the flags NEW_TASK and CLEAR_TASK are set, then the task gets reused + // but still needs to be a lock task mode violation since the task gets + // cleared out and the device would otherwise leave the locked task. + if (isLockTaskModeViolation(intentActivity.task, + (launchFlags & (FLAG_ACTIVITY_NEW_TASK | FLAG_ACTIVITY_CLEAR_TASK)) + == (FLAG_ACTIVITY_NEW_TASK | FLAG_ACTIVITY_CLEAR_TASK))) { showLockTaskToast(); Slog.e(TAG, "startActivityUnchecked: Attempt to violate Lock Task Mode"); return ActivityManager.START_RETURN_LOCK_TASK_MODE_VIOLATION; @@ -3780,7 +3785,11 @@ public final class ActivityStackSupervisor implements DisplayListener { } boolean isLockTaskModeViolation(TaskRecord task) { - if (getLockedTaskLocked() == task) { + return isLockTaskModeViolation(task, false); + } + + boolean isLockTaskModeViolation(TaskRecord task, boolean isNewClearTask) { + if (getLockedTaskLocked() == task && !isNewClearTask) { return false; } final int lockTaskAuth = task.mLockTaskAuth; -- cgit v1.2.3-59-g8ed1b