commit 8577610ffd0b5db4589cb66badb86c855414d915
author Guojing Yuan <guojing@google.com> Wed Aug 06 10:25:49 2025 -0700
committer Guojing Yuan <guojing@google.com> Tue Aug 19 12:57:07 2025 -0700
tree 0c2bdc2319dd12f7ad06fe7077fbcf61a92b7403
parent eab68f80f44aa2a9219fcfc0d4858c34ddfdc9a7

Restrict automatic NLS revocation to specific device profiles.

When a companion device association is removed, only revoke Notification Listener Service access if the association's device profile is one of the predefined profiles that typically require NLS access, such as Watch, Glasses, App Streaming, or Computer.

Bug: 421919075
Flag: EXEMPT bugfix
Test: CTS
Change-Id: Ie98a90b5cb3c040873a1d4b9b1159ba6ff0d6309
Merged-In: Icd3cdb3234a516ff7f752f39d7b1d8e6f5cde1ef

services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java

diff --git a/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java b/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java
index 194789b..37da5b8 100644
--- a/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java
+++ b/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java
@@ -38,6 +38,7 @@
 import static com.android.server.companion.PermissionsUtils.enforceCallerIsSystemOr;
 import static com.android.server.companion.PermissionsUtils.enforceCallerIsSystemOrCanInteractWithUserId;
 import static com.android.server.companion.PermissionsUtils.sanitizeWithCallerChecks;
+import static com.android.server.companion.RolesUtils.NLS_PROFILES;
 import static com.android.server.companion.RolesUtils.removeRoleHolderForAssociation;
 
 import static java.util.Objects.requireNonNull;
@@ -442,17 +443,20 @@
             // Revoke NLS if the last association has been removed for the package
             Binder.withCleanCallingIdentity(() -> {
                 if (mAssociationStore.getAssociationsForPackage(userId, packageName).isEmpty()) {
-                    NotificationManager nm = getContext().getSystemService(
-                        NotificationManager.class);
-                    Intent nlsIntent = new Intent(
-                            NotificationListenerService.SERVICE_INTERFACE);
-                    List<ResolveInfo> matchedServiceList = getContext().getPackageManager()
-                            .queryIntentServicesAsUser(nlsIntent, /* flags */ 0, userId);
-                    for (ResolveInfo service : matchedServiceList) {
-                        if (service.getComponentInfo().getComponentName().getPackageName()
-                                .equals(packageName)) {
-                            nm.setNotificationListenerAccessGranted(
-                                    service.getComponentInfo().getComponentName(), false);
+                    if (association.getDeviceProfile() != null
+                        && NLS_PROFILES.contains(association.getDeviceProfile())) {
+                        NotificationManager nm = getContext().getSystemService(
+                                NotificationManager.class);
+                        Intent nlsIntent = new Intent(
+                                NotificationListenerService.SERVICE_INTERFACE);
+                        List<ResolveInfo> matchedServiceList = getContext().getPackageManager()
+                                .queryIntentServicesAsUser(nlsIntent, /* flags */ 0, userId);
+                        for (ResolveInfo service : matchedServiceList) {
+                            if (service.getComponentInfo().getComponentName().getPackageName()
+                                    .equals(packageName)) {
+                                nm.setNotificationListenerAccessGranted(
+                                        service.getComponentInfo().getComponentName(), false, false);
+                            }
                         }
                     }
                 }

services/companion/java/com/android/server/companion/RolesUtils.java

diff --git a/services/companion/java/com/android/server/companion/RolesUtils.java b/services/companion/java/com/android/server/companion/RolesUtils.java
index 163f614..aef9719 100644
--- a/services/companion/java/com/android/server/companion/RolesUtils.java
+++ b/services/companion/java/com/android/server/companion/RolesUtils.java
@@ -17,6 +17,10 @@
 package com.android.server.companion;
 
 import static android.app.role.RoleManager.MANAGE_HOLDERS_FLAG_DONT_KILL_APP;
+import static android.companion.AssociationRequest.DEVICE_PROFILE_APP_STREAMING;
+import static android.companion.AssociationRequest.DEVICE_PROFILE_COMPUTER;
+import static android.companion.AssociationRequest.DEVICE_PROFILE_GLASSES;
+import static android.companion.AssociationRequest.DEVICE_PROFILE_WATCH;
 
 import static com.android.server.companion.CompanionDeviceManagerService.DEBUG;
 import static com.android.server.companion.CompanionDeviceManagerService.TAG;
@@ -33,12 +37,19 @@
 import android.util.Slog;
 
 import java.util.List;
+import java.util.Set;
 import java.util.function.Consumer;
 
 /** Utility methods for accessing {@link RoleManager} APIs. */
 @SuppressLint("LongLogTag")
 final class RolesUtils {
 
+    public static final Set<String> NLS_PROFILES = Set.of(
+            DEVICE_PROFILE_WATCH,
+            DEVICE_PROFILE_GLASSES,
+            DEVICE_PROFILE_APP_STREAMING,
+            DEVICE_PROFILE_COMPUTER);
+
     static boolean isRoleHolder(@NonNull Context context, @UserIdInt int userId,
             @NonNull String packageName, @NonNull String role) {
         final RoleManager roleManager = context.getSystemService(RoleManager.class);