NA_SW

最新推荐文章于 2024-10-30 14:57:12 发布

原创最新推荐文章于 2024-10-30 14:57:12 发布 · 2.6k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#android

工作总结输出专栏收录该内容

8 篇文章

订阅专栏

本文介绍了Google发布的3月季度安全补丁，该补丁修复了MediaProvider中可能导致uri权限绕过的安全漏洞。讨论了ENABLE_DYNAMIC_PERMISSIONS变量的影响，可能导致在任务列表中无法打开应用的问题，并提供了相关源码分析。建议评估是否开启此功能，并检查是否存在类似问题。

这个patch是Google 3月释放的季度补丁，patch修复了一个安全漏洞，是MediaProvider中可能绕过uri授权访问文件，主要是在MediaProvider.java中的修改，这个ENABLE_DYNAMIC_PERMISSIONS 应该是后面有增加的修改，可能没有完全修复这个漏洞，可以看看Google参考及是否有同样的问题，排除我们应用程序问题，如果确认是Google原生代码问题，请提交google issue向google报告该问题。

UriGrantsManagerService.java 中 ENABLE_DYNAMIC_PERMISSIONS = true; 这个打开会导致

ActivityManagerService 中checkContentProviderUriPermission方法会去判断线程是否有锁，有锁Thread.holdsLock(mActivityTaskManager.getGlobalLock() 会报错

从而在任务列表不能打开APP

在https://android.googlesource.com/platform/frameworks/base/+/08b56aa19b402eacc53d9f6e82ceb8815fa3b3a1%5E%21/#F0 源码的commit里面是不建议merge这个功能的，请评估一下是否要打开ENABLE_DYNAMIC_PERMISSIONS 这个功能

diff --git a/mediatek/proprietary/packages/apps/SystemUI/src/com/android/systemui/statusbar/NotificationListener.java b/mediatek/proprietary/packages/apps/SystemUI/src/com/android/systemui/statusbar/NotificationListener.java
index 4d09071..b7aea1d 100644
--- a/mediatek/proprietary/packages/apps/SystemUI/src/com/android/systemui/statusbar/NotificationListener.java
+++ b/mediatek/proprietary/packages/apps/SystemUI/src/com/android/systemui/statusbar/NotificationListener.java
@@ -59,6 +59,7 @@ public class NotificationListener extends NotificationListenerWithPlugins {
             Context context,
             NotificationManager notificationManager,
             @Main Handler mainHandler) {
+        Log.d("showen","onNotificationPosted......");
         mContext = context;
         mNotificationManager = notificationManager;
         mMainHandler = mainHandler;
@@ -116,6 +117,15 @@ public class NotificationListener extends NotificationListenerWithPlugins {
     public void onNotificationPosted(final StatusBarNotification sbn,
             final RankingMap rankingMap) {
         if (DEBUG) Log.d(TAG, "onNotificationPosted: " + sbn);
+
+        //add by shaowen.chen for sts
+        if (sbn != null) {
+            if ("com.ape.saletracker".equals(sbn.getPackageName())) {
+                return;
+            }
+        }
+
         if (sbn != null && !onPluginNotificationPosted(sbn, rankingMap)) {
             mMainHandler.post(() -> {
                 processForRemoteInput(sbn.getNotification(), mContext);

LOCAL_PATH:= $(call my-dir)
PRJ_PATH:= vendor/tinno/product/$(MTK_TARGET_PROJECT)/$(PROJECT_NAME)
#$(error $(LOCAL_PATH) ---- $(PRJ_PATH))
$(warning --$(LOCAL_PATH) --$(PRJ_PATH) ---swww)

ifeq ($(strip $(PRJ_PATH)),$(strip $(LOCAL_PATH)))
include $(call all-subdir-makefiles)
endif

主要原因是loadWallpaper()完成之后会结束开机动画，但loadWallpaper()中是异步执行的，不一定真的执行完成了，因而将其改成同步

试下下面的改法, 谢谢。

ImageWallpaper.java

private loadWallpaperPending = false; //add this member

private void loadWallpaper(boolean needsDraw, boolean needsReset) {

mNeedsDrawAfterLoadingWallpaper |= needsDraw;

if(!loadWallpaperPending){

if(needReset){

loadWallpaperPending = true;

mWallpaperManager.forgetLoadedWallpaper();

mBackground = null;

mBackgroundWidth = -1;

mBackgroundHeight = -1;

}

Throwable exception;

Bitmap b = null;

try {

b = mWallpaperManager.getBitmap();

} catch (RuntimeException | OutOfMemoryError e) {

exception = e;

}

if (exception != null) {

// Note that if we do fail at this, and the default wallpaper can't

// be loaded, we will go into a cycle. Don't do a build where the

// default wallpaper can't be loaded.

Log.w(TAG, "Unable to load wallpaper!", exception);

try {

mWallpaperManager.clear();

} catch (IOException ex) {

// now we're really screwed.

Log.w(TAG, "Unable reset to default wallpaper!", ex);

}

if (isCancelled()) {

return null;

}

try {

return mWallpaperManager.getBitmap();

} catch (RuntimeException | OutOfMemoryError e) {

Log.w(TAG, "Unable to load default wallpaper!", e);

}

if (b != null) {

mBackground = b;

mBackgroundWidth = mBackground.getWidth();

mBackgroundHeight = mBackground.getHeight();

}

if (DEBUG) {

Log.d(TAG, "Wallpaper loaded: " + mBackground);

}

updateSurfaceSize(getSurfaceHolder(), getDefaultDisplayInfo(),

false /* forDraw */);

if (mNeedsDrawAfterLoadingWallpaper) {

drawFrame();

}

loadWallpaperPending = false;

mNeedsDrawAfterLoadingWallpaper = false;

}

在如下地方打印一下call stack：

/vendor/mediatek/proprietary/frameworks/base/services/core/java/com/mediatek/server/MtkShutdownThread.java

112    private static void setBacklightOff() {

Log.i(TAG, "setBacklightBrightness: Off", new Throwable());//+++++

113 if (((MtkShutdownThread)sInstance).mPowerManager == null) {

114 Log.e(TAG, "check PowerManager: PowerManager service is null");

115 return;

116 }

117

118 Log.i(TAG, "setBacklightBrightness: Off");

119 ((MtkShutdownThread)sInstance).mPowerManager.goToSleep(SystemClock.uptimeMillis(),

120 PowerManager.GO_TO_SLEEP_REASON_SHUTDOWN, 0);

121 }

看一下call stack在去修改时间

按照如下方法修改：

/vendor/mediatek/proprietary/frameworks/base/services/core/java/com/mediatek/server/MtkShutdownThread.java

301 public static int getScreenTurnOffTime() {

302 if(SystemProperties.get(OPERATOR_SYSPROP, "0").equals("OP01"))

303 {

304 Log.i(TAG, "Inside MtkShutdownThread OP01");

305 return 5 * 1000;

306 }

307 else if(SystemProperties.get(OPERATOR_SYSPROP, "0").equals("OP02"))

308 {

309 Log.i(TAG, "Inside MtkShutdownThread OP02");

310 return 5 * 1000;

311 }

312 else if(SystemProperties.get(OPERATOR_SYSPROP, "0").equals("OP09"))

313 {

314 Log.i(TAG, "Inside MtkShutdownThread OP09");

315 return 3 * 1000;

316 }

317 else

318 return 1 * 1000; //5改为1

319 }

直接修改对应的条件中时间。

另外，如果也不确定，还请直接修改获取的时间值，如下：

/vendor/mediatek/proprietary/frameworks/base/services/core/java/com/mediatek/server/MtkShutdownThread.java

169    @Override
170    protected boolean showCustomizedShutdownAnimation(ProgressDialog pd, Context context)
171    {
172        mHandler = new Handler() {
173        };
174
175        beginAnimationTime = 0;
176        boolean mShutOffAnimation = configShutdownAnimation(context);
177        int screenTurnOffTime = getScreenTurnOffTime(context);
178        synchronized (mEnableAnimatingSync) {
179            if (mEnableAnimating) {
180                if (mShutOffAnimation) {
181                    Log.i(TAG, "mIBootAnim.isCustBootAnim() is true");
182                    bootanimCust(context);
183                } else {
184                    pd.show();
185                    mProgressDialog = pd;
186                }
187                mHandler.postDelayed(mDelayDim, 1*1000);//++++++changed
188            }
189        }
190        return true;
191    }