commit a07188111567974bc8a2c817825c28169c589535
author Pavel Grafov <pgrafov@google.com> Wed Dec 29 15:09:38 2021 +0000
committer Pavel Grafov <pgrafov@google.com> Wed Jan 05 15:43:48 2022 +0000
tree 3072700126581881d92469ef23b3a6d35713a791
parent 5b3b0c8a831c1ba269c21efc4b6a3ef9a00c5ad8

Make ManagedProvisioning hide non-system overlays

This is to prevent tapjacking where an app obscures the
provisioning activity and tricks the user into inflating a work
profile without consent.

Bug: 209611539
Test: manual
Change-Id: I4bda57bd80f34402e0a63554e719dceda60a296f
Merged-In: I4bda57bd80f34402e0a63554e719dceda60a296f

AndroidManifest.xml

diff --git a/AndroidManifest.xml b/AndroidManifest.xml
index 1357272..754bd0d 100644
--- a/AndroidManifest.xml
+++ b/AndroidManifest.xml
@@ -35,6 +35,7 @@
     <uses-permission android:name="android.permission.MANAGE_DEVICE_ADMINS" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE"/>
     <uses-permission android:name="android.permission.MANAGE_APP_OPS_MODES"/>
+    <uses-permission android:name="android.permission.HIDE_NON_SYSTEM_OVERLAY_WINDOWS"/>
 
     <uses-permission android:name="android.permission.CHANGE_COMPONENT_ENABLED_STATE" />
     <uses-permission android:name="android.permission.CHANGE_CONFIGURATION" />

src/com/android/managedprovisioning/common/SetupLayoutActivity.java

diff --git a/src/com/android/managedprovisioning/common/SetupLayoutActivity.java b/src/com/android/managedprovisioning/common/SetupLayoutActivity.java
index 88de305..a647a18 100644
--- a/src/com/android/managedprovisioning/common/SetupLayoutActivity.java
+++ b/src/com/android/managedprovisioning/common/SetupLayoutActivity.java
@@ -16,6 +16,8 @@
 
 package com.android.managedprovisioning.common;
 
+import static android.view.WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS;
+
 import static com.android.internal.logging.nano.MetricsProto.MetricsEvent.VIEW_UNKNOWN;
 import static com.android.managedprovisioning.provisioning.Constants.LOCK_TO_PORTRAIT_MODE;
 
@@ -79,6 +81,9 @@
             mThemeHelper.setupDynamicColors(this);
         }
         super.onCreate(savedInstanceState);
+
+        getWindow().addSystemFlags(SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS);
+
         mTimeLogger = new TimeLogger(this, getMetricsCategory());
         mTimeLogger.start();