commit 96e0524c48c6e58af7d15a2caf35082186fc8de2
author Nan Wu <wnan@google.com> Thu Jun 22 14:27:51 2023 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Wed Oct 11 22:48:03 2023 +0000
tree 5cad508c8af82435aed4fc476f69805c69fd5b5f
parent 58fa254a5d1aee2206de90d5396c01e177483e3a

Rescind BAL privilege when ShortcutService sends the callback PI

When AppWidgetManager.requestPinAppWidget is called from a client,
The passed in callback PendingIntent is called from the system
server. This allows the PendingIntent to be able to bypass BAL
checks.

Bug: 278722815
Test: manual test. BackgroundActivityLaunchTest. Regression like
      RequestPinAppWidgetTest, PeopleSpaceWidgetManagerTest, etc.
(cherry picked from commit eb90469587d908ac89121baf4f4dca3d1da5b817)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:0a0778e96d7da3fa8169abdf9261ed62809539fa)
Merged-In: I2df9de272192c9a149a9ff519c96e6e0e8304040
Change-Id: I2df9de272192c9a149a9ff519c96e6e0e8304040

services/core/java/com/android/server/pm/ShortcutService.java

diff --git a/services/core/java/com/android/server/pm/ShortcutService.java b/services/core/java/com/android/server/pm/ShortcutService.java
index 5b3514c..710e0b7 100644
--- a/services/core/java/com/android/server/pm/ShortcutService.java
+++ b/services/core/java/com/android/server/pm/ShortcutService.java
@@ -15,6 +15,7 @@
  */
 package com.android.server.pm;
 
+import static android.app.ActivityOptions.MODE_BACKGROUND_ACTIVITY_START_DENIED;
 import static android.provider.DeviceConfig.NAMESPACE_SYSTEMUI;
 
 import android.Manifest.permission;
@@ -24,6 +25,7 @@
 import android.annotation.UserIdInt;
 import android.app.ActivityManager;
 import android.app.ActivityManagerInternal;
+import android.app.ActivityOptions;
 import android.app.AppGlobals;
 import android.app.IUidObserver;
 import android.app.IUriGrantsManager;
@@ -4407,8 +4409,11 @@
             return;
         }
         try {
+            ActivityOptions options = ActivityOptions.makeBasic()
+                    .setPendingIntentBackgroundActivityStartMode(
+                            MODE_BACKGROUND_ACTIVITY_START_DENIED);
             intentSender.sendIntent(mContext, /* code= */ 0, extras,
-                    /* onFinished=*/ null, /* handler= */ null);
+                    /* onFinished=*/ null, /* handler= */ null, null, options.toBundle());
         } catch (SendIntentException e) {
             Slog.w(TAG, "sendIntent failed().", e);
         }