commit 8b8d3b45f9312ab2ee3611a55cad38d86c283d97
author Tsung-Mao Fang <tmfang@google.com> Fri Sep 30 15:27:06 2022 +0800
committer Tsung-Mao Fang <tmfang@google.com> Mon Oct 03 06:37:46 2022 +0000
tree 6652d15db6e7d7498cccffff2bfd1e6942173cd4
parent db09b990a089011279bca2716ae936f720a24608

Guard FallbackHome activity behind permission

An attacker can launch FallbackHome of the Settings app
to reset unlock time. This would prevent the device from
sleeping because it runs the following code:
PowerManager#userActivity().

However, running PowerManager.userActivity() requires
android.permission.DEVICE_POWER or android.permission.USER_ACTIVITY.

So, let's add a permission to guard this activity.

Test: Rebuilt a rom and see no side effect.
Bug: 246543238
Change-Id: I23a1e352f76cbec3e8c07a1b58b94615f2779121
(cherry picked from commit f5062c2df86bc1f1034e780c7b19c29f8acecab5)

AndroidManifest.xml

diff --git a/AndroidManifest.xml b/AndroidManifest.xml
index f51719b..db2d2b7 100644
--- a/AndroidManifest.xml
+++ b/AndroidManifest.xml
@@ -2943,6 +2943,7 @@
                   android:taskAffinity="com.android.settings.FallbackHome"
                   android:exported="true"
                   android:theme="@style/FallbackHome"
+                  android:permission="android.permission.DEVICE_POWER"
                   android:configChanges="keyboardHidden">
             <intent-filter android:priority="-1000">
                 <action android:name="android.intent.action.MAIN" />