In onReceive of AppRestrictionsFragment.java, there is a possible way to
start a phone call without permissions due to a confused deputy.
This could lead to local escalation of privilege with no additional
execution privileges needed.
We should not allow the restrictionsIntent to startActivity simply
because it resolves to multiple activities.
Instead, we should call resolveActivity and check the result's package
name is same as current package name, then it is safe to startActivity.
Bug: 200688991
Test: manual verify
Change-Id: Iaa2d3a9497c3266babe0789961befc9776a4db7a
Merged-In: Iaa2d3a9497c3266babe0789961befc9776a4db7a
(cherry picked from commit 359512cd95)
- Only enable device can be discoverable when the user launch
"Connected Devices settings" through settings and systemui
Bug: 194695497
Test: make -j42 RunSettingsRoboTests and use test apk to manually test
to verify the device is not discoversable when open "Connected settings"
through test apk.
Change-Id: Ia04ab759b737acf30b782f5c5831dd59f25fb257
(cherry picked from commit d3abbb9821)
- Add SafetyNet log if the calling package is no the permission for
result
Test: checked eventlog in the bugreport
Bug: 185126813
Merged-In: I1535f6f2ded2445702df0d723518b773cd094164
Change-Id: I1535f6f2ded2445702df0d723518b773cd094164
(cherry picked from commit 199528d460)
- Use getCallingPackage() to get calling package.
- Check if the calling package has ACCESS_COARSE_LOCATION or
ACCESS_COARSE_LOCATION permission.
- Only set result data to permission granted callers
Bug: 185126813
Test: manual test
make RunSettingsRoboTests ROBOTEST_FILTER=WifiDialogActivityTest
Merged-In: If7ca069c842ed2bd1aed23f9d4041473c68a4dad
Change-Id: If7ca069c842ed2bd1aed23f9d4041473c68a4dad
(cherry picked from commit 71e728e934)
Bluetooth app will indicate BluetoothOppReceiver to receive
device picker intent. But for fix the security issue we
removed the setClassName() method in ag/14111132 to avoid attack.
It causes BluetoothOppReceiver cannot receive the intent.
This CL will compare to calling package name with launch package name.
If they are not equal, the setClassName() will not invoke.
Bug: 186490534
Bug: 179386960
Bug: 179386068
Test: make RunSettingsRoboTests -j56
Change-Id: Ia51528f2a44ab73edbc86899ca0846d3262fe1f0
(cherry picked from commit bb5be240c0)
Bluetooth app will indicate BluetoothOppReceiver to receive
device picker intent. But for fix the security issue we
removed the setClassName() method in ag/14111132 to avoid attack.
It causes BluetoothOppReceiver cannot receive the intent.
This CL will compare to calling package name with launch package name.
If they are not equal, the setClassName() will not invoke.
Bug: 186490534
Bug: 179386960
Bug: 179386068
Test: make RunSettingsRoboTests -j56
Change-Id: Ia51528f2a44ab73edbc86899ca0846d3262fe1f0
(cherry picked from commit bb5be240c0)
- Show restricted text in guest mode
- Screenshot:
https://screenshot.googleplex.com/6nYcmazMM46TxaB
Bug: 177573895
Test: manual test
make RunSettingsRoboTests \
ROBOTEST_FILTER=WifiNetworkDetailsFragmentTest
Change-Id: I5f857b2079e0f550e4be601d27dd54dac56b2f57
Merged-In: I5f857b2079e0f550e4be601d27dd54dac56b2f57
- Show restricted text in guest mode
- Screenshot:
https://screenshot.googleplex.com/6nYcmazMM46TxaB
Bug: 177573895
Test: manual test
make RunSettingsRoboTests \
ROBOTEST_FILTER=WifiNetworkDetailsFragmentTest
Change-Id: I5f857b2079e0f550e4be601d27dd54dac56b2f57
Merged-In: I5f857b2079e0f550e4be601d27dd54dac56b2f57
BluetoothPermissionActivity and DevicePickerFragment will send
broadcast to return the result to calling apps. As this broadcast
intent is from Settings with uid 1000, it will be sent to any
protected BroadcastReceivers in the device. It can make an attacker
send broadcast to protected BroadcastReceivers like factory reset intent
(android/com.android.server.MasterClearReceiver) via
BluetoothPermissionActivity or DevicePickerFragment.
This CL will not allow to set package name and class name to avoid
the attacker.
Bug: 179386960
Bug: 179386068
Test: make -j42 RunSettingsRoboTests and use test apk to manually test
to verify factory reset not started and no system UI notification.
Change-Id: Id27a78091ab578077853b8fbb97a4422cff0a158
(cherry picked from commit 8adedc6249)
BluetoothPermissionActivity and DevicePickerFragment will send
broadcast to return the result to calling apps. As this broadcast
intent is from Settings with uid 1000, it will be sent to any
protected BroadcastReceivers in the device. It can make an attacker
send broadcast to protected BroadcastReceivers like factory reset intent
(android/com.android.server.MasterClearReceiver) via
BluetoothPermissionActivity or DevicePickerFragment.
This CL will not allow to set package name and class name to avoid
the attacker.
Bug: 179386960
Bug: 179386068
Test: make -j42 RunSettingsRoboTests and use test apk to manually test
to verify factory reset not started and no system UI notification.
Change-Id: Id27a78091ab578077853b8fbb97a4422cff0a158
(cherry picked from commit 8adedc6249)
The root issue is that CharSequence is an interface.
String implements that interface, however, Spanned class
too which is a rich text format that can store HTML code.
The solution is enforce to use String type which won't include
any HTML function.
Test: Rebuilt apk and see the string without HTML style.
Bug: 179042963
Change-Id: I53b460b12da918e022d2f2934f114d205dbaadb0
Merged-In: I53b460b12da918e022d2f2934f114d205dbaadb0
(cherry picked from commit 0bf3c98b2f)
First, if the VPN is configured by an admin, the preference is
disabled and tapping on it will results in a policy disclouser
dialog.
In addition restriction checks in the dialog also check if the
VPN is admin-configured.
Bug: 179975048
Test: Manual, setting VPN in profile and primary user and via DPM API.
Test: make RunSettingsRoboTests -j
Merged-In: Id59d2ac2782e83601bc3093d3a092faea36ff5d9
Change-Id: Id59d2ac2782e83601bc3093d3a092faea36ff5d9
This reverts commit 32d5d3a3a3.
Bug: 174047492
Reason for revert:
Look like the WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS system flag is not supported in the pi-dev branch.
Change-Id: Iec3c28e8c148f83fc171d696b2fc67f359d03eb8
To improve security.
Bug: 181962311
Test: manual
Show an AlertDialog and observe if it will hide after below command.
adb shell am start -a android.intent.action.PICK_ACTIVITY -n com.android.settings/.ActivityPicker
Change-Id: I6e2845cc19dc012cba2933318a067bbb8db90a23
(cherry picked from commit 3b4853e109)
To improve security.
Bug: 181962311
Test: manual
Show an AlertDialog and observe if it will hide after below command.
adb shell am start -a android.intent.action.PICK_ACTIVITY -n com.android.settings/.ActivityPicker
Change-Id: I6e2845cc19dc012cba2933318a067bbb8db90a23
(cherry picked from commit 3b4853e109)
- Disallowed non system overlay windows
- Screenshot
https://screenshot.googleplex.com/77fJ9QN6pV4zFYc
Bug: 174047492
Test: manual test
Merged-In: Ia7acad6d456ce5ebea2d982d4cb063d4f28cbfff
Change-Id: Ia7acad6d456ce5ebea2d982d4cb063d4f28cbfff
(cherry picked from commit d47d8e4fc5)
- Disallowed non system overlay windows
- Screenshot
https://screenshot.googleplex.com/77fJ9QN6pV4zFYc
Bug: 174047492
Test: manual test
Merged-In: Ia7acad6d456ce5ebea2d982d4cb063d4f28cbfff
Change-Id: Ia7acad6d456ce5ebea2d982d4cb063d4f28cbfff
(cherry picked from commit d47d8e4fc5)
- Disallowed non system overlay windows
- Screenshot
https://screenshot.googleplex.com/77fJ9QN6pV4zFYc
Bug: 174047492
Test: manual test
Merged-In: Ia7acad6d456ce5ebea2d982d4cb063d4f28cbfff
Change-Id: Ia7acad6d456ce5ebea2d982d4cb063d4f28cbfff
(cherry picked from commit d47d8e4fc5)
