commit f5062c2df86bc1f1034e780c7b19c29f8acecab5
author Tsung-Mao Fang <tmfang@google.com> Fri Sep 30 15:27:06 2022 +0800
committer Tsung-Mao Fang <tmfang@google.com> Fri Sep 30 15:31:47 2022 +0800
tree db9a1c05729c8b9c56b437b41fe86d8b0d59fc91
parent 0039fb35cdfb3e919cdcc604ee648a709a7933bd

Guard FallbackHome activity behind permission

An attacker can launch FallbackHome of the Settings app
to reset unlock time. This would prevent the device from
sleeping because it runs the following code:
PowerManager#userActivity().

However, running PowerManager.userActivity() requires
android.permission.DEVICE_POWER or android.permission.USER_ACTIVITY.

So, let's add a permission to guard this activity.

Test: Rebuilt a rom and see no side effect.
Bug: 246543238
Change-Id: I23a1e352f76cbec3e8c07a1b58b94615f2779121

AndroidManifest.xml

diff --git a/AndroidManifest.xml b/AndroidManifest.xml
index 0be2e2e..ebfbe6f 100644
--- a/AndroidManifest.xml
+++ b/AndroidManifest.xml
@@ -3013,6 +3013,7 @@
                   android:taskAffinity="com.android.settings.FallbackHome"
                   android:exported="true"
                   android:theme="@style/FallbackHome"
+                  android:permission="android.permission.DEVICE_POWER"
                   android:configChanges="keyboardHidden">
             <intent-filter android:priority="-1000">
                 <action android:name="android.intent.action.MAIN" />