From 8b8d3b45f9312ab2ee3611a55cad38d86c283d97 Mon Sep 17 00:00:00 2001 From: Tsung-Mao Fang Date: Fri, 30 Sep 2022 15:27:06 +0800 Subject: [PATCH] Guard FallbackHome activity behind permission An attacker can launch FallbackHome of the Settings app to reset unlock time. This would prevent the device from sleeping because it runs the following code: PowerManager#userActivity(). However, running PowerManager.userActivity() requires android.permission.DEVICE_POWER or android.permission.USER_ACTIVITY. So, let's add a permission to guard this activity. Test: Rebuilt a rom and see no side effect. Bug: 246543238 Change-Id: I23a1e352f76cbec3e8c07a1b58b94615f2779121 (cherry picked from commit f5062c2df86bc1f1034e780c7b19c29f8acecab5) --- AndroidManifest.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/AndroidManifest.xml b/AndroidManifest.xml index f51719b4dd3..db2d2b75a7c 100644 --- a/AndroidManifest.xml +++ b/AndroidManifest.xml @@ -2943,6 +2943,7 @@ android:taskAffinity="com.android.settings.FallbackHome" android:exported="true" android:theme="@style/FallbackHome" + android:permission="android.permission.DEVICE_POWER" android:configChanges="keyboardHidden">