summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDa Xing <qiyueliuhuo813@gmail.com>2018-11-18 12:10:17 (GMT)
committerLuca Stefani <luca.stefani.ge1@gmail.com>2019-08-20 11:44:45 (GMT)
commitd1a8aade1dc2c99926e82e06e5eaab584c837cac (patch)
tree3cd646515098b68f9b1e69a161bb6aae5161489a
parent7f11f6fe38192d4fcb363c4543297f32ad26df89 (diff)
downloadframeworks_base-d1a8aade1dc2c99926e82e06e5eaab584c837cac.zip
frameworks_base-d1a8aade1dc2c99926e82e06e5eaab584c837cac.tar.gz
frameworks_base-d1a8aade1dc2c99926e82e06e5eaab584c837cac.tar.bz2
Crash app on foreground service notification error.
Resolved issue 118612296. On any notification error, the NMS silently cancels the notification, including foreground service notifications. Thus, an app could pass in a garbage notification deliberately and start a foreground service silently. This patch resolved this issue by judging the notification's flag, and if it is a foreground notification, still crash the app as previous platforms, and if it is a normal notification, don't crash the app. Background: In 3ad4cdd1, which was merged into Android 9 release, the crash behaviour is removed. But it is an important rule that foreground services guaranteed to show an ongoing notification. Test: Run the sample apk provided in the issue, it's main thread received a RemoteServiceException: Bad notification posted from package... as intended behaviour. Change-Id: I36ea0137ca6978ff401f64dccacb6f2edcadd7db Signed-off-by: Da Xing <qiyueliuhuo813@gmail.com>
-rw-r--r--services/core/java/com/android/server/notification/NotificationManagerService.java18
1 files changed, 16 insertions, 2 deletions
diff --git a/services/core/java/com/android/server/notification/NotificationManagerService.java b/services/core/java/com/android/server/notification/NotificationManagerService.java
index cec7e81..7e943c8 100644
--- a/services/core/java/com/android/server/notification/NotificationManagerService.java
+++ b/services/core/java/com/android/server/notification/NotificationManagerService.java
@@ -808,8 +808,22 @@ public class NotificationManagerService extends SystemService {
@Override
public void onNotificationError(int callingUid, int callingPid, String pkg, String tag, int id,
int uid, int initialPid, String message, int userId) {
- cancelNotification(callingUid, callingPid, pkg, tag, id, 0, 0, false, userId,
- REASON_ERROR, null);
+ final boolean fgService;
+ synchronized (mNotificationLock) {
+ NotificationRecord r = findNotificationLocked(pkg, tag, id, userId);
+ fgService = r != null && (r.getNotification().flags & FLAG_FOREGROUND_SERVICE) != 0;
+ }
+ cancelNotification(callingUid, callingPid, pkg, tag, id, 0, 0,
+ false, userId, REASON_ERROR, null);
+ if (fgService) {
+ // Still crash for foreground services, preventing the not-crash behaviour abused
+ // by apps to give us a garbage notification and silently start a fg service.
+ Binder.withCleanCallingIdentity(
+ () -> mAm.crashApplication(uid, initialPid, pkg, -1,
+ "Bad notification(tag=" + tag + ", id=" + id + ") posted from package "
+ + pkg + ", crashing app(uid=" + uid + ", pid=" + initialPid + "): "
+ + message));
+ }
}
@Override