Age | Commit message (Collapse) | Author |
|
17112345, 17155535, 17046148, 17183360, 17343385, 17408864, 17071224, 17592146, 16405924, 17567140, 16908080, 17147924] into sc-d2-release.
Change-Id: If7a5395ea18993acf6af4fb61dfaf28870d7e510
|
|
Fixes: 212467440
Test: atest OngoingCallControllerTest
Test: verified clicking the chip can still open valid activities.
Change-Id: I7707d01be37582461227edcecf5d559f2019c8a5
Merged-In: I7707d01be37582461227edcecf5d559f2019c8a5
(cherry picked from commit 08d94cbabb44207f1ebfddc76d9f11b6b328fdee)
(cherry picked from commit b029b005d8d4122d29cffc86b752fce13b1d4da6)
(cherry picked from commit ccac141cc774a76a2aaef76399fa6790252363cf)
Merged-In: I7707d01be37582461227edcecf5d559f2019c8a5
|
|
bug: 209814693
Bug: 217934478
Test: CTS
Change-Id: I8e4425a4e7de716f86b1f1f56ea605d93f357a57
Merged-In: I8e4425a4e7de716f86b1f1f56ea605d93f357a57
(cherry picked from commit f0f67b5a319efedbf8693b436a641fa65bc2d8be)
Merged-In: I8e4425a4e7de716f86b1f1f56ea605d93f357a57
|
|
Test: atest android.devicepolicy.cts.DevicePolicyManagerTest
Bug: 210469972
Change-Id: I1ea926194992cbce26e2245fec0e563b3010a02f
(cherry picked from commit b157e658a78d68c1f4d2a72d4a7b0aa39b1362ed)
Merged-In: I1ea926194992cbce26e2245fec0e563b3010a02f
|
|
To avoid a potential vulnerability, don't allow padding
with width or height larger than the maximum screen width.
Bug: 204316511
Test: added WallpaperManagerTest
Change-Id: I471fb3546bdd2f9aa07dd091fe841b2bc5c484d6
Merged-In: I471fb3546bdd2f9aa07dd091fe841b2bc5c484d6
(cherry picked from commit 72210c49405570dfb3b79220536ccb9e102b7f8c)
Merged-In: I471fb3546bdd2f9aa07dd091fe841b2bc5c484d6
|
|
NPE happens when there is an orphaned session which we've
tried to prevent in all cases.
Log an error message if this situation happens.
Bug: 227342978
Test: atest CtsRootPackageInstallerHostTestCases
Change-Id: Ia21323926bd9db1a6f05461904deb45b4c3dd0bc
(cherry picked from commit 07e31dfb1efabc8110d64819f26a06e12a35e020)
Merged-In: Ia21323926bd9db1a6f05461904deb45b4c3dd0bc
(cherry picked from commit 18179a8762ba14c44d287e853c9a1c38a3dfdddb)
Merged-In: Ia21323926bd9db1a6f05461904deb45b4c3dd0bc
|
|
This is a backport of ag/17005706.
This adds mitigations to prevent system files being exfiltrated
via the settings content provider when a content URI is provided
as a chosen user image.
The mitigations are:
1) Copy the image to a new URI rather than the existing takePictureUri
prior to cropping.
2) Only allow a system handler to respond to the CROP intent.
Bug: 187702830
Test: build and check functionality
Merged-In: Idf1ab60878d619ee30505d71e8afe31d8b0c0ebe
Change-Id: Ieee3f2d8057e648bde52a91463d517abb47f37eb
(cherry picked from commit bfb1cd5fd27c8d854336163540bb5b014ad504d1)
Merged-In: Ieee3f2d8057e648bde52a91463d517abb47f37eb
|
|
This addresses a security issue where the guest user can remove updates
for system apps.
With this CL, attempts to uninstall/downgrade system apps will fail if
attempted by a non-admin user.
This is a backport of ag/17352264.
Bug: 170646036
Test: manual, try uninstalling system app update as guest
Change-Id: I79c3bf303e729e00d8fb12c40330bc10c5ffec6e
Merged-In: I4e959e296cca9bbdfc8fccc5e5e0e654ca524165
(cherry picked from commit 6c870e157994519094e9e50ddf93e57a26779e22)
Merged-In: I79c3bf303e729e00d8fb12c40330bc10c5ffec6e
|
|
GateKeeperResponse has inconsistent writeToParcel() and
createFromParcel() methods, making it possible for a malicious app to
create a Bundle that changes contents after reserialization. Such
Bundles can be used to execute Intents with system privileges.
We fixed related issues previously for GateKeeperResponse class, but
one of the case was remaining when payload is byte array of size 0,
Fixing this case now.
Bug: 220303465
Test: With the POC provided in the bug.
Change-Id: Ida28d611edd674e76ed39dd8037f52abcba82586
Merged-In: Ida28d611edd674e76ed39dd8037f52abcba82586
(cherry picked from commit 46653a91c30245ca29d41d69174813979a910496)
Change-Id: I486348c7a01c6f59c952b20fb4a36429fff22958
(cherry picked from commit 5d2176df6923a8984e2b81d8eb4b728f01f1c760)
Merged-In: I486348c7a01c6f59c952b20fb4a36429fff22958
|
|
Test: manual
Bug: 216631962
Change-Id: I3d6d1be9d6c312fe0bf98f600ff8fc9c617f8ec3
(cherry picked from commit e20d8ae7104f3235c8a2d72c85d19644e2ac8d86)
Merged-In: I3d6d1be9d6c312fe0bf98f600ff8fc9c617f8ec3
|
|
Test: ZenModeHelperTest
Bug: 220735360
Change-Id: I3da105951af90007bf48dc6cf00aed3e28778b36
Merged-In: I3da105951af90007bf48dc6cf00aed3e28778b36
(cherry picked from commit c69747578155fc2b2b5a6d690b1e8263f281eb67)
Merged-In: I3da105951af90007bf48dc6cf00aed3e28778b36
|
|
When switching users and attempting to lock the device, the sysui main
thread becomes overwhelmed with events, creating a significant lag
between the time a message is posted and processed on the main
thread. This can be dangerous when these events are critical for
security, such as calls coming from PhoneWindowManager#lockNow() that
call KeyguardViewMediator#doKeyguardTimeout(). On older devices with
slower CPUs and less memory, the delay in processing can be
significant (15 - 30s).
The result of not prioritizing these events leads to a window of time
where a guest user can switch back to the owner, and gain access to
the owner's homescreen without needing to unlock the device with the
owner's credentials.
As a mitigation, prioritize two events originating in two specific
methods to make sure the device locks as soon as possible as well as
have the system server preemptively update its local cache.
Bug: 151095871
Test: Very manual race condition - follow steps listed in bug
Change-Id: I7585a0a5eeb308e0e32a4f77f581556d883b5cda
Merged-In: I7585a0a5eeb308e0e32a4f77f581556d883b5cda
(cherry picked from commit 28c53ab8bca26af58b45625c1ebba8b9051c107d)
(cherry picked from commit f8023c9829890ede1bdcbd04314d26c122b1f3f1)
(cherry picked from commit 256b5f08a89e441f7e01f87346945e9350fa7a3c)
Merged-In: I7585a0a5eeb308e0e32a4f77f581556d883b5cda
|
|
Bug: 219044664
Fixes: 219044664
Test: atest PackageManagerShellCommandTest
Change-Id: I27a0c5009b2d5f1ea51618b9acfa1e6ccee71296
Merged-In: I27a0c5009b2d5f1ea51618b9acfa1e6ccee71296
(cherry picked from commit 36b0e9e94c3af7e5f81b88d68447c890d1126498)
Merged-In: I27a0c5009b2d5f1ea51618b9acfa1e6ccee71296
|
|
Currently SliceManagerService#checkSlicePermission does not verify the
caller's identity. This leads to a security vulnerability because
checkSlicePermission does more than checking the permission as opposed
to simply return a boolean value -- it additionally grants slice access
under a certain condition. A malicious app can spoof the calling package
to acquire slice access.
This CL verifies the caller before granting slice access.
Bug: 208232850, 179699767
Test: manual
Change-Id: I2539c9ff5ea977c91bb58185c95280b4d533a520
Merged-In: I2539c9ff5ea977c91bb58185c95280b4d533a520
(cherry picked from commit 5bd2196c537ae42a5c1626bdc23c3c6db41fb97f)
(cherry picked from commit 3c92d74d7d74e1d781ae1b071da97b3b2cbc6be9)
Merged-In: I2539c9ff5ea977c91bb58185c95280b4d533a520
|
|
1. generateCrop() couldn't handle super huge size because BitmapRegionDecoder
will occupy too much native heap during process, We replace old decoder
with ImageDecoder
2. Fix overflow problem in debug message
3. Add a record file to note if ImageDecoder work well
Bug: 204087139
Test: Manually set wallpaper, no PDoS observed.
Change-Id: I59cf3c21edce836ffbe9f24a08b3a8e077c5fcf3
Merged-In: I59cf3c21edce836ffbe9f24a08b3a8e077c5fcf3
(cherry picked from commit 08d14944212a7026218bde79091f0d1d48bc1c79)
Merged-In: I59cf3c21edce836ffbe9f24a08b3a8e077c5fcf3
|
|
The top-focusable activity resides in the RESUMED state while the app
process is newly created and attached. The behavior may enable UI
hijacking attacks against apps implementing authentication.
This CL disallows the system to resume the activity for the case if it
is not visible or is occluded by other translucent tasks.
Bug: 211481342
Test: atest CtsWindowManagerDeviceTestCases:ActivityLifecycleTests
Change-Id: I7903494cf928b5b5613700262b7c5fff10f3c5a0
(cherry picked from commit 0a4f661ec6a18a0ddc47b6d9280a10b8d16c9457)
Merged-In: I7903494cf928b5b5613700262b7c5fff10f3c5a0
|
|
Require FINE_LOCATION_ACCESS to get the full service state broadcast,
otherwise send the location sanitized copy.
Test: manual verify with app
Bug: 210118427
Change-Id: Ibfa66624a4157b7c2c7d764e2b6bdb26ac5f1447
Merged-In: Ibfa66624a4157b7c2c7d764e2b6bdb26ac5f1447
(cherry picked from commit d852b695e7a93c973b8a3e8335c43a3724ef3847)
(cherry picked from commit 8bfc53154863752fe03d6374ed6876e8807167ce)
Merged-In: Ibfa66624a4157b7c2c7d764e2b6bdb26ac5f1447
|
|
Specifically getActiveNotifications and
getHistoricalNotifications
Test: atest NotificationManagerServiceTest
Bug: 214999128
Change-Id: I2eba0a592fa33ed25e1ac3919f1b2631e5db4258
Merged-In: I2eba0a592fa33ed25e1ac3919f1b2631e5db4258
(cherry picked from commit 73745b16e89b51dfe4328faa817ba50024382050)
Merged-In: I2eba0a592fa33ed25e1ac3919f1b2631e5db4258
|
|
Change-Id: I8e30841279f21542ebe9b297271842d1a408050b
|
|
SUPL emergency request can come into the framework
while in Dialing phone state before the call is
answered and goes to Active phone state.
The active sub being cached should be updated in
either Dialing state or Active state to ensure the SUPL
emergency request is made on the correct sub.
Test: manual
Bug: 211377690
Bug: 214088538
Change-Id: Ic2fa89b76a0e43caa1ea4470c38389c42f506148
(cherry picked from commit 7b0ab311f3572fe795598807466487b10495a3ce)
(cherry picked from commit cde6691a4daa1f23cf6cf1f7744c620914182d09)
Merged-In: Ic2fa89b76a0e43caa1ea4470c38389c42f506148
|
|
sc-d2-release.
Change-Id: I0d4485f0fd62aad0f110b0d22b22d07a0247e4bd
|
|
This reverts commit 340a7fdfa41bda515f31cb9f61072f151dfbe432.
Revert reason: Check if this causes AOC regression
Bug: 223124178
Change-Id: Ie40ae07492c8b968093a1f938c37ca39b7d205a9
(cherry picked from commit cebef5d5bdf6f59d5465465df0219b134e124df8)
Merged-In: Ie40ae07492c8b968093a1f938c37ca39b7d205a9
|
|
This reverts commit b464ef4dc204d4de70211289b32cd5cf2db53ce9.
Revert reason: Check if this causes AOC regression
Bug: 223124178
Change-Id: Ie7f9759b900e0a114eb047cceceecb0a99066a1a
(cherry picked from commit cb84b3ffe1a69105286f0efe1a49e5393680fb97)
Merged-In: Ie7f9759b900e0a114eb047cceceecb0a99066a1a
|
|
sets property in linear space.""
This reverts commit 26f62282acff2bce70b54404233fd0f2654ec3e2.
Revert reason: Check if this causes AOC regression
Bug: 223124178
Change-Id: I4861b3ed5e3bc234ee51c58e95e7a517ce5cbacc
(cherry picked from commit c96d601823b85e07eb0016163e7c9d300db66a59)
Merged-In: I4861b3ed5e3bc234ee51c58e95e7a517ce5cbacc
|
|
ramp in HLG space.""
This reverts commit e828f33713a4a9103f10fdc1affe21e144635c16.
Revert reason: Check if this causes AOC regression
Bug: 223124178
Change-Id: If01ec6728c1723d4763dc32b7b206dd2ee73335f
(cherry picked from commit 5fb150a5a1beaebb228eb6d01d69298b646eade2)
Merged-In: If01ec6728c1723d4763dc32b7b206dd2ee73335f
|
|
Change-Id: I887f8044fe8bd7f5f0f6b1f901208554f76b8d89
|
|
Regression from I62be9283a1d22119eceae5585960b5775a019153.
When dismiss keyguard from shell command, the wakeup signal should only
be used when dream activity is on top.
Bug: 219376804
Bug: 222429976
Test: atest KeyguardTests KeyguardLockedTests
Test: atest WindowManagerServiceTests
Change-Id: I4edab8588421b3e341cf3bde07e989ff5e651cfe
Merged-In: I4edab8588421b3e341cf3bde07e989ff5e651cfe
(cherry picked from commit 0063c2488e0eacb103ed33f2b1397a7d83c225d0)
Merged-In: I4edab8588421b3e341cf3bde07e989ff5e651cfe
|
|
This CL fixes a bug that could happen when animating a dialog out at the
same time as hiding the SystemUI shade, and that would make the phone
unusable until the shade is swiped down again. See b/223387276 for more
info.
Bug: 223387276
Test: Manual, see b/223387276#comment1
Change-Id: If251b00558a5ca9a927d1be2bb015f1c0acb2d57
(cherry picked from commit 631a7ef1a60a8d61077e1762e5a18cc53e8211f4)
Merged-In: If251b00558a5ca9a927d1be2bb015f1c0acb2d57
|
|
sc-d2-release.
Change-Id: Ifd727d5064de25b553aa423fd2453aa3055eb2e0
|
|
HLG space."
This reverts commit 682f01c6a92053a622bfb9acd3e78bf4690d3427.
Revert reason: Check if this causes AOC regression
Bug: 223124178
Change-Id: Ia410597785e9d0b636c69450ffb5ff6712253bd2
(cherry picked from commit 9b752ff2d972b2defec34fdeeb801533975e7262)
Merged-In: Ia410597785e9d0b636c69450ffb5ff6712253bd2
|
|
property in linear space."
This reverts commit 46ddcce6644b5209e0c1fb5342554ca7e507f707.
Revert reason: Check if this causes AOC regression
Bug: 223124178
Change-Id: I11d62ad3ebecb1df40858d9fe06fb1340830549d
(cherry picked from commit 557c9ddc97583e7fdbcf81da650ff5360c7b7f66)
Merged-In: I11d62ad3ebecb1df40858d9fe06fb1340830549d
|
|
This reverts commit 7ace3f267538f0f4ddec44f7711d3d268c4b58dc.
Revert reason: Check if this causes AOC regression
Bug: 223124178
Change-Id: Ia22b68ff8763cea754cfbd22fd7a46893f1f62ac
(cherry picked from commit 5ca0a453e2b269a6422a3943a599884869ae96ac)
Merged-In: Ia22b68ff8763cea754cfbd22fd7a46893f1f62ac
|
|
This reverts commit f24d549cc6f025c5559b257708954c5987595bde.
Revert reason: Check if this causes AOC regression
Bug: 223124178
Change-Id: I5dc8cf05746963131cc72b989fdc18b8789ffb31
(cherry picked from commit 0efb2453475fefb49327a0cf838fc6a9e469337a)
Merged-In: I5dc8cf05746963131cc72b989fdc18b8789ffb31
|
|
Change-Id: I68df5f9f1af0e9aefb815a39c133880dbd2130f0
|
|
This reverts commit 267ecd151e8e7ad313cbe1a511f18d2d78f2e459.
Reason for revert: regression b/223088536
Change-Id: I5e82ad358a8c7c7027415ab55c5d7e5bd3c05527
(cherry picked from commit d7fe18428fe3455e25fb1ed5e052d2e9b498f065)
Merged-In: I5e82ad358a8c7c7027415ab55c5d7e5bd3c05527
|
|
Change-Id: Ib8e4584756fab274fb3ac9a5ade0b936525d32dc
|
|
This was not being used and it was leaking ContentObservers
Test: heapdump, switching between splitshade and not splitshade many
times
Test: atest com.android.systemui.qs
Fixes: 218888308
Change-Id: I63501bf573e006f52379192b7b766283fea40dda
Merged-In: I63501bf573e006f52379192b7b766283fea40dda
(cherry picked from commit 32b7c35f24d29a4e87e386267c725549cc1b6259)
Merged-In: I63501bf573e006f52379192b7b766283fea40dda
|
|
Test: manual, atest NotificationManagerServiceTest
Fixes: 211005909
Change-Id: I2375b72cb60ee535dcb78aa0d064455c5247b4f6
(cherry picked from commit 2a35959ecdc793a0f522c8afd57cf24f3b73ad8d)
(cherry picked from commit f53f2ad864d022b8a81216e35068c6ce062d33c9)
Merged-In: I2375b72cb60ee535dcb78aa0d064455c5247b4f6
|
|
Test: atest DozeScreenStateTest
Fixes: 218885442
Change-Id: Ib6cbdf14c2a1ec6aedfb0924ed30983779f7d624
(cherry picked from commit 0d4aa6312abd05a2718e4fbd9c0ddd8ccfe55c3d)
Merged-In: Ib6cbdf14c2a1ec6aedfb0924ed30983779f7d624
|
|
Change-Id: I208dbedd0fd6d4cd512b0071e622b4364c5c9a6d
|
|
This has a horrifying and unpredictable side effect of triggering
post-unlock Runnables that are stored in StatusBar.java, which can
result in a blank screen on unlock in certain race conditions.
Test: unlock, launch an app during the unlock animation, press power, wake up at bad time
Test: I wrote a custom build to force the above scenario to verify this works
Fixes: 214647311
Merged-In: I00655c2e85c46bd0c52b77094757e155b1a6f9c9
Change-Id: I9261ab9f04cc06db379676dccca72e452ece98d7
(cherry picked from commit c3a2eeaed337f445424d3b086ee0d14f1d9358e1)
Merged-In: I9261ab9f04cc06db379676dccca72e452ece98d7
|
|
Change-Id: I87f4ad0a97f4adda889009307ae1ac0d4fb20b09
|
|
Most reproducible while the device is asleep on AoD for a period of
time. The system detects the double tap power gesture, and launches
the camera activity immediately. However, in the failing case,
DreamManagerService only stops the dream after the activity has been
launched. This setOccluded path has already happened when the call to
wakeup comes in and decides that the StatusBarState should equal
KEYGUARD, which is incorrect. This blocks the activity which is
running underneath. The correct state is SHADE. Add a check for
occlusion before deciding to show the keyguard
Fixes: 199349731
Test: launch camera over lockscreen
Change-Id: I817fcdc80db79ad95367dc7a49eadaa5e366c3ef
(cherry picked from commit 7a2abccf35a28accc7acc563a7c34a44f9bb2212)
(cherry picked from commit 267ecd151e8e7ad313cbe1a511f18d2d78f2e459)
Merged-In: I817fcdc80db79ad95367dc7a49eadaa5e366c3ef
|
|
Change-Id: I55125bb31804fb5237b26aaebb9e3e4e4f4d13ce
|
|
Currently trying to restore a read-only directory results in only the
directory being restored but not its contents. This causes problems for
some apps (see the associated bug). Skip restore of read-only directories
while we evaluate the priority of proper suport for this use case.
Bug: 194894879
Test: Manual:
1. Populate a read-only directory in an app's folder
(/data/user/0/<package-name>)
2. Run backup for the app
3. Clear app data (adb shell pm clear <package-name>
4. Run restore for the app
5. Inspect app folder to ensure all writable content is
restored.
Merged-In: I644a5784fb42352ba28ac944d3aa3564b0215a78
Change-Id: I644a5784fb42352ba28ac944d3aa3564b0215a78
(cherry picked from commit 98f8122702709355750e618ce434ab798864f885)
Merged-In:I644a5784fb42352ba28ac944d3aa3564b0215a78
|
|
sc-d2-release.
Change-Id: Ib13bd2e7af925334bf808729a901caf2a637be7d
|
|
Bug: 209948220
Test: manually check the sensor for BrightnessTracker using
dumpsys display.
Test: atest BrightnessTrackerTest
Change-Id: I20d93322cc42c28bc2c74c9ce048b0f550bb8127
(cherry picked from commit 817d2df3a73dfd8632690d36fdae9378d5d96b63)
Merged-In:I20d93322cc42c28bc2c74c9ce048b0f550bb8127
|
|
Add screen and ambient thresholds to the ddc.
Use these values as a minimum required change, so that brightness can be
more stable at lower light levels.
Bug: 205683328
Bug: 209948220
Test: adb shell dumpsys display
Test: atest AutomaticBrightnessControllerTest
Change-Id: I3af6d754899d75ed51964ed7ad140f1572ec41b0
(cherry picked from commit 821378695467acd97f64071bdbd251651748a987)
Merged-In:I3af6d754899d75ed51964ed7ad140f1572ec41b0
|
|
linear space.
This fixes the case where RampAnimator is used the first time and
immediately jumps to the target brightness. In that case the property
was set to a value that has not been converted back into linear
space, causing an incorrect initial brightness value.
To avoid these bugs, consolidate setting of the property into one
function.
Bug: 217289549
Test: Cannot reproduce bug.
Change-Id: I2ccdaa51ddba062fc5de1209470b90eb429280db
(cherry picked from commit 47461bb5aef25af6cdb6234e93c3daa99c166f6d)
Merged-In:I2ccdaa51ddba062fc5de1209470b90eb429280db
|
|
This switches the ramp animator logic to ramp in the perceptual HLG
space, thereby making ramping appear linear to the human eye.
Bug: 204252940
Test: Verified on Pixel 6 Pro that ramping is much more linear and
consistent.
Change-Id: I946e1570e654eb25aa334be827ca3d15cba21c48
(cherry picked from commit 692f088bba1a2b0e095cefba7f86298fa8531aba)
Merged-In:I946e1570e654eb25aa334be827ca3d15cba21c48
|