Security Patches :D

Android.bp

@@ -255,6 +255,7 @@ filegroup {
         ":framework_native_aidl",
         ":gatekeeper_aidl",
         ":gsiservice_aidl",
+        ":guiconstants_aidl",
         ":incidentcompanion_aidl",
         ":installd_aidl",
         ":keystore_aidl",

apex/jobscheduler/framework/java/com/android/server/usage/AppStandbyInternal.java

@@ -146,6 +146,8 @@ void restrictApp(@NonNull String packageName, int userId,
 
     void setActiveAdminApps(Set<String> adminPkgs, int userId);
 
+    void setAdminProtectedPackages(Set<String> packageNames, int userId);
+
     void onAdminDataAvailable();
 
     void clearCarrierPrivilegedApps();

apex/jobscheduler/service/java/com/android/server/job/JobStore.java

@@ -687,6 +687,10 @@ public void run() {
                 }
             } catch (XmlPullParserException | IOException e) {
                 Slog.wtf(TAG, "Error jobstore xml.", e);
+            } catch (Exception e) {
+                // Crashing at this point would result in a boot loop, so live with a general
+                // Exception for system stability's sake.
+                Slog.wtf(TAG, "Unexpected exception", e);
             } finally {
                 if (mPersistInfo.countAllJobsLoaded < 0) { // Only set them once.
                     mPersistInfo.countAllJobsLoaded = numJobs;
@@ -817,6 +821,15 @@ private JobStatus restoreJobFromXml(boolean rtcIsGood, XmlPullParser parser)
             } catch (NumberFormatException e) {
                 Slog.d(TAG, "Error reading constraints, skipping.");
                 return null;
+            } catch (XmlPullParserException e) {
+                Slog.d(TAG, "Error Parser Exception.", e);
+                return null;
+            } catch (IOException e) {
+                Slog.d(TAG, "Error I/O Exception.", e);
+                return null;
+            } catch (IllegalArgumentException e) {
+                Slog.e(TAG, "Constraints contained invalid data", e);
+                return null;
             }
             parser.next(); // Consume </constraints>
 
@@ -912,8 +925,14 @@ private JobStatus restoreJobFromXml(boolean rtcIsGood, XmlPullParser parser)
                 return null;
             }
 
-            PersistableBundle extras = PersistableBundle.restoreFromXml(parser);
-            jobBuilder.setExtras(extras);
+            final PersistableBundle extras;
+            try {
+                extras = PersistableBundle.restoreFromXml(parser);
+                jobBuilder.setExtras(extras);
+            } catch (IllegalArgumentException e) {
+                Slog.e(TAG, "Persisted extras contained invalid data", e);
+                return null;
+            }
             parser.nextTag(); // Consume </extras>
 
             final JobInfo builtJob;
@@ -959,7 +978,8 @@ private JobInfo.Builder buildBuilderFromXml(XmlPullParser parser) throws NumberF
             return new JobInfo.Builder(jobId, cname);
         }
 
-        private void buildConstraintsFromXml(JobInfo.Builder jobBuilder, XmlPullParser parser) {
+        private void buildConstraintsFromXml(JobInfo.Builder jobBuilder, XmlPullParser parser)
+                throws XmlPullParserException, IOException {
             String val;
 
             final String netCapabilities = parser.getAttributeValue(null, "net-capabilities");

apex/jobscheduler/service/java/com/android/server/usage/AppStandbyController.java

@@ -233,6 +233,10 @@ static class Lock {}
     @GuardedBy("mActiveAdminApps")
     private final SparseArray<Set<String>> mActiveAdminApps = new SparseArray<>();
 
+    /** List of admin protected packages. Can contain {@link android.os.UserHandle#USER_ALL}. */
+    @GuardedBy("mAdminProtectedPackages")
+    private final SparseArray<Set<String>> mAdminProtectedPackages = new SparseArray<>();
+
     /**
      * Set of system apps that are headless (don't have any declared activities, enabled or
      * disabled). Presence in this map indicates that the app is a headless system app.
@@ -1019,6 +1023,9 @@ public void onUserRemoved(int userId) {
             synchronized (mActiveAdminApps) {
                 mActiveAdminApps.remove(userId);
             }
+            synchronized (mAdminProtectedPackages) {
+                mAdminProtectedPackages.remove(userId);
+            }
         }
     }
 
@@ -1108,6 +1115,10 @@ private int getAppMinBucket(String packageName, int appId, int userId) {
                 return STANDBY_BUCKET_EXEMPTED;
             }
 
+            if (isAdminProtectedPackages(packageName, userId)) {
+                return STANDBY_BUCKET_EXEMPTED;
+            }
+
             if (isActiveNetworkScorer(packageName)) {
                 return STANDBY_BUCKET_EXEMPTED;
             }
@@ -1510,6 +1521,17 @@ boolean isActiveDeviceAdmin(String packageName, int userId) {
         }
     }
 
+    private boolean isAdminProtectedPackages(String packageName, int userId) {
+        synchronized (mAdminProtectedPackages) {
+            if (mAdminProtectedPackages.contains(UserHandle.USER_ALL)
+                    && mAdminProtectedPackages.get(UserHandle.USER_ALL).contains(packageName)) {
+                return true;
+            }
+            return mAdminProtectedPackages.contains(userId)
+                    && mAdminProtectedPackages.get(userId).contains(packageName);
+        }
+    }
+
     @Override
     public void addActiveDeviceAdmin(String adminPkg, int userId) {
         synchronized (mActiveAdminApps) {
@@ -1533,6 +1555,17 @@ public void setActiveAdminApps(Set<String> adminPkgs, int userId) {
         }
     }
 
+    @Override
+    public void setAdminProtectedPackages(Set<String> packageNames, int userId) {
+        synchronized (mAdminProtectedPackages) {
+            if (packageNames == null || packageNames.isEmpty()) {
+                mAdminProtectedPackages.remove(userId);
+            } else {
+                mAdminProtectedPackages.put(userId, packageNames);
+            }
+        }
+    }
+
     @Override
     public void onAdminDataAvailable() {
         mAdminDataAvailableLatch.countDown();
@@ -1555,6 +1588,13 @@ Set<String> getActiveAdminAppsForTest(int userId) {
         }
     }
 
+    @VisibleForTesting
+    Set<String> getAdminProtectedPackagesForTest(int userId) {
+        synchronized (mAdminProtectedPackages) {
+            return mAdminProtectedPackages.get(userId);
+        }
+    }
+
     /**
      * Returns {@code true} if the supplied package is the device provisioning app. Otherwise,
      * returns {@code false}.

api/current.txt

@@ -438,6 +438,8 @@ package android {
     field public static final int collapseIcon = 16844031; // 0x10104ff
     field public static final int color = 16843173; // 0x10101a5
     field public static final int colorAccent = 16843829; // 0x1010435
+    field public static final int colorAccentBackground = 16844311; // 0x1010617
+    field public static final int colorAccentOverlay = 16844312; // 0x1010618
     field public static final int colorActivatedHighlight = 16843664; // 0x1010390
     field public static final int colorBackground = 16842801; // 0x1010031
     field public static final int colorBackgroundCacheHint = 16843435; // 0x10102ab
@@ -1657,6 +1659,7 @@ package android {
 
   public static final class R.color {
     ctor public R.color();
+    field public static final int accent_background_device_default = 17170461; // 0x106001d
     field public static final int background_dark = 17170446; // 0x106000e
     field public static final int background_light = 17170447; // 0x106000f
     field public static final int black = 17170444; // 0x106000c
@@ -12541,6 +12544,20 @@ package android.content.pm {
 
 package android.content.res {
 
+  public class AccentUtils {
+    ctor public AccentUtils();
+    method public int getBackgroundAccentColor(int);
+    method public int getDarkAccentColor(int);
+    method public int getLightAccentColor(int);
+    method public int getOverlayDarkAccentColor(int);
+    method public int getOverlayLightAccentColor(int);
+    method public boolean isResourceAccentBackground(@Nullable String);
+    method public boolean isResourceAccentOverlayDark(@Nullable String);
+    method public boolean isResourceAccentOverlayLight(@Nullable String);
+    method public boolean isResourceDarkAccent(@Nullable String);
+    method public boolean isResourceLightAccent(@Nullable String);
+  }
+
   public class AssetFileDescriptor implements java.io.Closeable android.os.Parcelable {
     ctor public AssetFileDescriptor(android.os.ParcelFileDescriptor, long, long);
     ctor public AssetFileDescriptor(android.os.ParcelFileDescriptor, long, long, android.os.Bundle);
@@ -12722,6 +12739,23 @@ package android.content.res {
     field public int uiMode;
   }
 
+  public class MonetWannabe {
+    ctor public MonetWannabe(@NonNull android.content.Context);
+    method @ColorInt public static int adjustAlpha(@ColorInt int, float);
+    method public int getAccentColor();
+    method public int getAccentColorBackground();
+    method public int getAccentColorOverlayDark();
+    method public int getAccentColorOverlayLight();
+    method public static int getInactiveAccent(@NonNull android.content.Context);
+    method public static boolean isMonetEnabled(@NonNull android.content.Context);
+    method public static int manipulateColor(int, float);
+    method public static boolean shouldForceLoad(@NonNull android.content.Context);
+    method public static int updateMonet(@NonNull android.content.Context);
+    field public static final int DEFAULT_COLOR_GEN = 16; // 0x10
+    field public static final float DEFAULT_DARK_ALTERATION = 0.8f;
+    field public static final float DEFAULT_LIGHT_ALTERATION = 0.7f;
+  }
+
   public class ObbInfo implements android.os.Parcelable {
     method public int describeContents();
     method public void writeToParcel(android.os.Parcel, int);
@@ -40776,6 +40810,7 @@ package android.provider {
     field public static final String BLUETOOTH_DISCOVERABILITY = "bluetooth_discoverability";
     field public static final String BLUETOOTH_DISCOVERABILITY_TIMEOUT = "bluetooth_discoverability_timeout";
     field @Deprecated public static final String BLUETOOTH_ON = "bluetooth_on";
+    field public static final String BUTTON_BACKLIGHT_ONLY_WHEN_PRESSED = "button_backlight_only_when_pressed";
     field public static final android.net.Uri CONTENT_URI;
     field @Deprecated public static final String DATA_ROAMING = "data_roaming";
     field public static final String DATE_FORMAT = "date_format";

core/java/android/accessibilityservice/AccessibilityService.java

@@ -1982,6 +1982,10 @@ private void sendServiceInfo() {
         IAccessibilityServiceConnection connection =
             AccessibilityInteractionClient.getInstance().getConnection(mConnectionId);
         if (mInfo != null && connection != null) {
+            if (!mInfo.isWithinParcelableSize()) {
+                throw new IllegalStateException(
+                        "Cannot update service info: size is larger than safe parcelable limits.");
+            }
             try {
                 connection.setServiceInfo(mInfo);
                 mInfo = null;

core/java/android/accessibilityservice/AccessibilityServiceInfo.java

@@ -39,6 +39,7 @@
 import android.graphics.drawable.Drawable;
 import android.hardware.fingerprint.FingerprintManager;
 import android.os.Build;
+import android.os.IBinder;
 import android.os.Parcel;
 import android.os.Parcelable;
 import android.os.RemoteException;
@@ -1028,6 +1029,15 @@ public int describeContents() {
         return 0;
     }
 
+    /** @hide */
+    public final boolean isWithinParcelableSize() {
+        final Parcel parcel = Parcel.obtain();
+        writeToParcel(parcel, 0);
+        final boolean result = parcel.dataSize() <= IBinder.MAX_IPC_SIZE;
+        parcel.recycle();
+        return result;
+    }
+
     public void writeToParcel(Parcel parcel, int flagz) {
         parcel.writeInt(eventTypes);
         parcel.writeStringArray(packageNames);

core/java/android/accounts/ChooseTypeAndAccountActivity.java

@@ -407,7 +407,7 @@ public void run(final AccountManagerFuture<Bundle> accountManagerFuture) {
                 mExistingAccounts = AccountManager.get(this).getAccountsForPackage(mCallingPackage,
                         mCallingUid);
                 intent.setFlags(intent.getFlags() & ~Intent.FLAG_ACTIVITY_NEW_TASK);
-                startActivityForResult(intent, REQUEST_ADD_ACCOUNT);
+                startActivityForResult(new Intent(intent), REQUEST_ADD_ACCOUNT);
                 return;
             }
         } catch (OperationCanceledException e) {

core/java/android/app/ActivityManager.java

@@ -3933,6 +3933,9 @@ public void restartPackage(String packageName) {
      * processes to reclaim memory; the system will take care of restarting
      * these processes in the future as needed.
      *
+     * <p class="note">Third party applications can only use this API to kill their own processes.
+     * </p>
+     *
      * @param packageName The name of the package whose processes are to
      * be killed.
      */

core/java/android/app/ActivityOptions.java

@@ -20,6 +20,8 @@
 import static android.app.ActivityTaskManager.SPLIT_SCREEN_CREATE_MODE_TOP_OR_LEFT;
 import static android.app.WindowConfiguration.ACTIVITY_TYPE_UNDEFINED;
 import static android.app.WindowConfiguration.WINDOWING_MODE_UNDEFINED;
+import static android.content.Intent.FLAG_ACTIVITY_NEW_TASK;
+import static android.content.Intent.FLAG_RECEIVER_FOREGROUND;
 import static android.view.Display.INVALID_DISPLAY;
 
 import android.annotation.NonNull;
@@ -61,7 +63,7 @@
  * {@link android.content.Context#startActivity(android.content.Intent, android.os.Bundle)
  * Context.startActivity(Intent, Bundle)} and related methods.
  */
-public class ActivityOptions {
+public class ActivityOptions extends ComponentOptions {
     private static final String TAG = "ActivityOptions";
 
     /**
@@ -963,13 +965,12 @@ public boolean getLaunchTaskBehind() {
     }
 
     private ActivityOptions() {
+        super();
     }
 
     /** @hide */
     public ActivityOptions(Bundle opts) {
-        // If the remote side sent us bad parcelables, they won't get the
-        // results they want, which is their loss.
-        opts.setDefusable(true);
+        super(opts);
 
         mPackageName = opts.getString(KEY_PACKAGE_NAME);
         try {
@@ -1373,7 +1374,9 @@ public void setPendingIntentLaunchFlags(@android.content.Intent.Flags int flags)
      * @hide
      */
     public int getPendingIntentLaunchFlags() {
-        return mPendingIntentLaunchFlags;
+        // b/243794108: Ignore all flags except the new task flag, to be reconsidered in b/254490217
+        return mPendingIntentLaunchFlags &
+                (FLAG_ACTIVITY_NEW_TASK | FLAG_RECEIVER_FOREGROUND);
     }
 
     /**
@@ -1575,8 +1578,9 @@ public void update(ActivityOptions otherOptions) {
      * object; you must not modify it, but can supply it to the startActivity
      * methods that take an options Bundle.
      */
+    @Override
     public Bundle toBundle() {
-        Bundle b = new Bundle();
+        Bundle b = super.toBundle();
         if (mPackageName != null) {
             b.putString(KEY_PACKAGE_NAME, mPackageName);
         }