commit 7e7e1c55fe669e9e2e415cc31541bfc6c99cec21
author Evan Severson <evanseverson@google.com> Wed Apr 29 11:45:56 2020 -0700
committer Sterling Huber <hubers@google.com> Fri Oct 16 16:35:44 2020 +0000
tree 0a9197e808208bbbb8db0b4de922e207992b83a0
parent 6c855d397f9ab24794bfd2e1cebb3cce7886132a

RESTRICT AUTOMERGE
Don't allow tapjacking permissioncontroller

Use the filterTouchesWhenObscured attribute throughout the permission
controller.

Bug: 155287782
Test: Manual using PoC app from b/154015447#comment1
Change-Id: I205395fdcabe68055df15ce9414468a833a0807c

AndroidManifest.xml

diff --git a/AndroidManifest.xml b/AndroidManifest.xml
index 67e0b4c..9a094d6 100644
--- a/AndroidManifest.xml
+++ b/AndroidManifest.xml
@@ -133,7 +133,7 @@
         <activity android:name=".permission.ui.GrantPermissionsActivity"
                 android:configChanges="orientation|keyboardHidden|screenSize"
                 android:excludeFromRecents="true"
-                android:theme="@style/GrantPermissions"
+                android:theme="@style/GrantPermissions.FilterTouches"
                 android:visibleToInstantApps="true">
             <intent-filter android:priority="1">
                 <action android:name="android.content.pm.action.REQUEST_PERMISSIONS" />
@@ -145,7 +145,7 @@
                   android:configChanges="orientation|keyboardHidden|screenSize"
                   android:excludeFromRecents="true"
                   android:label="@string/app_permissions"
-                  android:theme="@style/Settings"
+                  android:theme="@style/Settings.FilterTouches"
                   android:permission="android.permission.GRANT_RUNTIME_PERMISSIONS">
             <intent-filter android:priority="1">
                 <action android:name="android.intent.action.MANAGE_PERMISSIONS" />

res/values/themes.xml

diff --git a/res/values/themes.xml b/res/values/themes.xml
index 649b303..b07b103 100644
--- a/res/values/themes.xml
+++ b/res/values/themes.xml
@@ -42,6 +42,7 @@
         <item name="android:textAppearanceMedium">@style/MediumText</item>
         <item name="android:textAppearanceSmall">@style/SmallText</item>
         <item name="android:titleTextStyle">@style/TitleText</item>
+        <item name="android:filterTouchesWhenObscured">true</item>
     </style>
 
     <style name="DialogWhenLargeNoAnimation" parent="DialogWhenLarge">
@@ -58,4 +59,20 @@
     </style>
 
 
+
+
+<!-- Do not allow OEMs to overlay these themes.
+ Must Guarantee that filterTouches is set for these activities -->
+    <style name="FilterTouches">
+        <item name="android:filterTouchesWhenObscured">true</item>
+    </style>
+
+    <style name="Settings.FilterTouches">
+        <item name="android:filterTouchesWhenObscured">true</item>
+    </style>
+
+    <style name="GrantPermissions.FilterTouches">
+        <item name="android:filterTouchesWhenObscured">true</item>
+    </style>
+
 </resources>