SurfaceFlinger: Only allow update of InputWindowInfo with permission.
This was intended to be in the original CL, but it looks like I never added it or
lost it at some point. This is important as otherwise clients could use modality flags,
global focus, etc...to escape their constraints. The model is the WM can "bless" a surface for input
with given flags (e.g. non-modal) and then the client can manipulate the geometry if it
happens to have the surfacecontrol, but within the constraints of the hierarchy.
Bug: 111440400
Test: Builds
Change-Id: Ifea0882bb26f9791aa2736895c900a05a02ba7cb
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 5df2876..3f6298f 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -3961,8 +3961,12 @@
if (layer->setSidebandStream(s.sidebandStream)) flags |= eTraversalNeeded;
}
if (what & layer_state_t::eInputInfoChanged) {
- layer->setInputInfo(s.inputInfo);
- flags |= eTraversalNeeded;
+ if (callingThreadHasUnscopedSurfaceFlingerAccess()) {
+ layer->setInputInfo(s.inputInfo);
+ flags |= eTraversalNeeded;
+ } else {
+ ALOGE("Attempt to update InputWindowInfo without permission ACCESS_SURFACE_FLINGER");
+ }
}
std::vector<sp<CallbackHandle>> callbackHandles;
if ((what & layer_state_t::eListenerCallbacksChanged) && (!s.listenerCallbacks.empty())) {