This is the problem where various things are listening for broadcasts
(such as battery status, PIN/PUK/Network) that an application can send
to cause harm to the system.
Solving this is tricky because many of these broadcasts are sticky,
and I have never figured out how to do permissions with sticky
broadcasts in a sane way. So instead, I am going to punt on the
general problem and just brute force it:
There is new a way for system components to declare specific
broadcast actions to be protected, which means that only the system
and the phone can send them. This is good enough for now. None
of it is exposed in the public API so we can make something a little
less stupid in the future if we ever need to.
This adds a new <path-permission> tag you can use inside of a <provide>
to define additional path-based permissions that broaden the global
read and write permissions. The initial use for this will be global
search, so that a content provider that is protected by permissions
can make a part of itself available to global search under another
permission. This addresses the issue with global search not being able
to request permissions it would need of providers it doesn't know
about at build time.
Merge commit 'dbcd9c34f378a93c1e7e8c91e035782daf66e5f4'
* commit 'dbcd9c34f378a93c1e7e8c91e035782daf66e5f4':
The BACKUP permission should have the signatureOrSystem protectionLevel,
This CL does the following:
+ adds an AbsoluteFileBackupHelper class for managing backup of files
known by absolute path, not based off of the app's getFilesDir() root
+ bumps up the collection interval from its testing-only default of 1 second
to 3 minutes
+ adds a SystemBackupAgent class to the main system package and names it as
the android:backupAgent for the main OS package. Right now this agent
only backs up & restores the wallpaper file.
+ amend the Wallpaper Service to inform the Backup Manager when the wallpaper
changes.
On the subject of the 3-minute collection interval before the backup actually
occurs: this can be short-circuited from an adb shell. Running the command
'bmgr run' will cause the Backup Manager to kick off any pending backup
operations immediately.
Merge commit '727f36c6a1c70ba5519ec9ce2da9ab1cf303a2ef'
* commit '727f36c6a1c70ba5519ec9ce2da9ab1cf303a2ef':
process: Fix bug where if a thread exited while we were changing its control
Fix the build: Remove ADD_SYSTEM_SERVICE, which I had accidentally
Merge commit '3dcea047c5c7a61a56f618815e298d7bd38e2678'
* commit '3dcea047c5c7a61a56f618815e298d7bd38e2678':
Remove obsolete FOTA_UPDATE permission (which should never have been
reintroduced in an errant and clumsy git merge operation.
Also remove permission label and description strings for now-deleted
permissions FOTA_UPDATE and (within the SettingsProvider package)
WRITE_GSERVICES.
made public, and wouldn't be used by any third party applications,
and no longer does anything regardless).
Also remove the WRITE_GSERVICES permission from the SettingsProvider
package's manifest (the declaration there was redundant with the one
in the core manifest, where all the other settings-related permissions
live -- no other core package includes its own permission definitions).
Merge commit '181fafaf48208978b8ba2022683ffa78aaeddde1'
* commit '181fafaf48208978b8ba2022683ffa78aaeddde1':
Retool the backup process to use a new 'BackupAgent' class
Backups will be handled by launching the application in a special
mode under which no activities or services will be started, only
the BackupAgent subclass named in the app's android:backupAgent
manifest property. This takes the place of the BackupService class
used earlier during development.
In the cases of *full* backup or restore, an application that does
not supply its own BackupAgent will be launched in a restricted
manner; in particular, it will be using the default Application
class rather than any manifest-declared one. This ensures that the
app is not running any code that may try to manipulate its data
while the backup system reads/writes its data set.
Merge commit '1e2e44e900cb9a25d548e27a20d65292a7f321bc'
* commit '1e2e44e900cb9a25d548e27a20d65292a7f321bc':
Fix wifi multicast API for public use.
Revert "Bug fixes and performance improvements"
This change replaces ILocationCollector with a more general mechanism that
passes locations received from a provider to all other providers.
The network location provider now uses this to implement the location collector.
In the future, this could be used to inject network locations to the GPS
as aiding data.
This change also removes the now obsolete permission INSTALL_LOCATION_COLLECTOR.
Signed-off-by: Mike Lockwood <lockwood@android.com>
Merge commit '95fc68f24a2a93e5664e2234abcfe479d385cc05'
* commit '95fc68f24a2a93e5664e2234abcfe479d385cc05':
Fix issue where apps could prevent the user from going home.
Now we have a 5-second time after home is pressed, during which
only the home app (and the status bar) can switch to another app.
After that time, any start activity requests that occurred will
be executed, to allow things like alarms to be displayed. Also
if during that time the user launches another app, the pending
starts will be executed without resuming their activities and
the one they started placed at the top and executed.
Now old applications will automatically be granted it. Also renamed it from
SDCARD_WRITE to WRITE_SDCARD to be consistent with our other permissions,
and re-arranged how we do targetSdkVersion to actually be usuable for this
kind of stuff.
Note that right now this results in basically all apps being given the
WRITE_SDCARD permission, because their targetSdkVersion is not set. I will
be dealing with that in a future change.
Now old applications will automatically be granted it. Also renamed it from
SDCARD_WRITE to WRITE_SDCARD to be consistent with our other permissions,
and re-arranged how we do targetSdkVersion to actually be usuable for this
kind of stuff.
Note that right now this results in basically all apps being given the
WRITE_SDCARD permission, because their targetSdkVersion is not set. I will
be dealing with that in a future change.
This introduces a new class in the base platform for performing a clean
shutdown (which was copied from the classes in the policies). It
includes new features to send a shutdown broadcast for applications
to do cleanup, and ot have the activity manager pause the current
activity before proceeding with the shutdown. These facilities are
also use to write at the most recent stat files for sync, battery
and user activity.
The previous implementation used a database for storing all of its state, which could cause
a significant amount of IO activity as its tables were updated through the stages of a sync.
This new implementation replaces that in-memory data structures, with hand-written code
for writing them to persistent storage.
There are now 4 files associated with this class, holding various pieces of its state that
should be consistent. These are everything from a main XML file of account information that
must always be retained, to a binary file of per-day statistics that can be thrown away at
any time. Writes of these files as scheduled at various times based on their importance of
the frequency at which they change.
Because the database no longer exists, there needs to be a new explicit interface for
interacting with the sync manager database. This is provided by new APIs on IContentService,
with a hidden method on ContentResolver to retrieve the IContentService so that various
system entities can use it. Other changes in other projects are required to update to the
new API.
The goal here is to have as little an impact on the code and functionality outside of
SyncStorageEngine, though due to the necessary change in API it is still somewhat extensive.
Merge commit '275555c8eb3fb5df6e7320873b88b77cdde85a9e'
* commit '275555c8eb3fb5df6e7320873b88b77cdde85a9e':
location: Add support for location providers outside of the system process.
Also added new permissions android.permission.INSTALL_LOCATION_PROVIDER
and android.permission.INSTALL_LOCATION_COLLECTOR to the public API.
Signed-off-by: Mike Lockwood <lockwood@android.com>
