From 5c99901e77437e403ba643c9dc839ee9659acada Mon Sep 17 00:00:00 2001 From: Robert Carr Date: Tue, 19 Feb 2019 10:05:00 -0800 Subject: [RESTRICT AUTOMERGE]: Exclude secure layers from most screenshots taken by the system server. In pre-P versions of Android, it was allowed to screenshot secure layers if the buffer queue producer which was the target of the screenshot was owned by the system (in this case SurfaceFlinger). This really was a synonym for: The screen rotation animation was allowed to capture secure layers, but the other code paths weren't. In O we mistakenly changed this check to always allow the system server to capture secure layers via the captureScreen path (the captureLayers path used for TaskSnapshots was unaffected). This can result in data leakage in cases where the system server takes screenshots on behalf of other parts of the system (e.g. for the assistant). To mitigate this we provide an explicit switch for the system server to specify whether it wishes to capture Secure layers. While this is dangerous, I think it is less dangerous than the previous implicit switch of capturing secure layers based on which type of BufferQueue was passed in. The flag defaults to not capturing secure layers and we set it to true in the one place we need it (for the screen rotation animation). Non privileged clients can still not capture secure layers at all directly. Test: SetFlagsSecureEUidSystem Bug: 120610669 Change-Id: I288ad3bbb0444306e90fe3bb15e51b447539dea5 --- libs/gui/SurfaceComposerClient.cpp | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) (limited to 'libs/gui/SurfaceComposerClient.cpp') diff --git a/libs/gui/SurfaceComposerClient.cpp b/libs/gui/SurfaceComposerClient.cpp index f3c6fd2f87..263c7ef9e0 100644 --- a/libs/gui/SurfaceComposerClient.cpp +++ b/libs/gui/SurfaceComposerClient.cpp @@ -768,18 +768,27 @@ status_t SurfaceComposerClient::getHdrCapabilities(const sp& display, status_t ScreenshotClient::capture(const sp& display, Rect sourceCrop, uint32_t reqWidth, uint32_t reqHeight, int32_t minLayerZ, int32_t maxLayerZ, bool useIdentityTransform, uint32_t rotation, - sp* outBuffer) { + bool captureSecureLayers, sp* outBuffer) { sp s(ComposerService::getComposerService()); if (s == NULL) return NO_INIT; status_t ret = s->captureScreen(display, outBuffer, sourceCrop, reqWidth, reqHeight, minLayerZ, maxLayerZ, useIdentityTransform, - static_cast(rotation)); + static_cast(rotation), + captureSecureLayers); if (ret != NO_ERROR) { return ret; } return ret; } +status_t ScreenshotClient::capture(const sp& display, Rect sourceCrop, uint32_t reqWidth, + uint32_t reqHeight, int32_t minLayerZ, int32_t maxLayerZ, + bool useIdentityTransform, uint32_t rotation, + sp* outBuffer) { + return capture(display, sourceCrop, reqWidth, reqHeight, + minLayerZ, maxLayerZ, useIdentityTransform, rotation, false, outBuffer); +} + status_t ScreenshotClient::captureLayers(const sp& layerHandle, Rect sourceCrop, float frameScale, sp* outBuffer) { sp s(ComposerService::getComposerService()); -- cgit v1.2.3-59-g8ed1b