commit be7785a5556fa1f047c860f6d26d7b7779ae4308
author Robin Lee <rgl@google.com> Thu Nov 24 13:04:44 2022 +0000
committer Robin Lee <rgl@google.com> Mon Nov 28 07:26:59 2022 +0000
tree 408531c2d87e989fdec0d4b4249bd12cf82a11c0
parent cc69ccbb8490b9d3b690378e0b669f7def7f3d7c

Prevent BAL from Wallpaper Picker

Background activity launch logic won't use pending intent
creator foreground state as long as the ActivityOptions have
been set up to prevent that.

This stops an app from registering itself as the handler for
ACTION_SET_WALLPAPER and sending a request to launch
itself indirectly into the foreground.

Change-Id: I4dbaee9cd85aa53d5d2aaf2e8b0734de13c1dafd
Test: BALBypassViaWallpaperChooser
Bug: 257953844

services/core/java/com/android/server/wallpaper/WallpaperManagerService.java

diff --git a/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java b/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
index 5d08461..4480d52 100644
--- a/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
+++ b/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
@@ -34,6 +34,7 @@
 
 import android.annotation.NonNull;
 import android.app.ActivityManager;
+import android.app.ActivityOptions;
 import android.app.AppGlobals;
 import android.app.AppOpsManager;
 import android.app.ILocalWallpaperColorConsumer;
@@ -3166,6 +3167,15 @@
                 }
             }
 
+            final ActivityOptions clientOptions = ActivityOptions.makeBasic();
+            clientOptions.setIgnorePendingIntentCreatorForegroundState(true);
+            PendingIntent clientIntent = PendingIntent.getActivityAsUser(
+                    mContext, 0, Intent.createChooser(
+                            new Intent(Intent.ACTION_SET_WALLPAPER),
+                            mContext.getText(com.android.internal.R.string.chooser_wallpaper)),
+                    PendingIntent.FLAG_IMMUTABLE, clientOptions.toBundle(),
+                    UserHandle.of(serviceUserId));
+
             // Bind the service!
             if (DEBUG) Slog.v(TAG, "Binding to:" + componentName);
             final int componentUid = mIPackageManager.getPackageUid(componentName.getPackageName(),
@@ -3174,11 +3184,7 @@
             intent.setComponent(componentName);
             intent.putExtra(Intent.EXTRA_CLIENT_LABEL,
                     com.android.internal.R.string.wallpaper_binding_label);
-            intent.putExtra(Intent.EXTRA_CLIENT_INTENT, PendingIntent.getActivityAsUser(
-                    mContext, 0,
-                    Intent.createChooser(new Intent(Intent.ACTION_SET_WALLPAPER),
-                            mContext.getText(com.android.internal.R.string.chooser_wallpaper)),
-                    PendingIntent.FLAG_IMMUTABLE, null, new UserHandle(serviceUserId)));
+            intent.putExtra(Intent.EXTRA_CLIENT_INTENT, clientIntent);
             if (!mContext.bindServiceAsUser(intent, newConn,
                     Context.BIND_AUTO_CREATE | Context.BIND_SHOWING_UI
                             | Context.BIND_FOREGROUND_SERVICE_WHILE_AWAKE