NA_SW

本文介绍了Google发布的3月季度安全补丁,该补丁修复了MediaProvider中可能导致uri权限绕过的安全漏洞。讨论了ENABLE_DYNAMIC_PERMISSIONS变量的影响,可能导致在任务列表中无法打开应用的问题,并提供了相关源码分析。建议评估是否开启此功能,并检查是否存在类似问题。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

这个patch是Google 3月释放的季度补丁,patch修复了一个安全漏洞,是MediaProvider中可能绕过uri授权访问文件,主要是在MediaProvider.java中的修改,这个ENABLE_DYNAMIC_PERMISSIONS 应该是后面有增加的修改,可能没有完全修复这个漏洞,可以看看Google参考及是否有同样的问题,排除我们应用程序问题,如果确认是Google原生代码问题,请提交google issue向google报告该问题。

UriGrantsManagerService.java 中 ENABLE_DYNAMIC_PERMISSIONS = true; 这个打开会导致

ActivityManagerService 中checkContentProviderUriPermission方法 会去判断线程是否有锁,有锁Thread.holdsLock(mActivityTaskManager.getGlobalLock() 会报错

从而在任务列表不能打开APP

https://android.googlesource.com/platform/frameworks/base/+/08b56aa19b402eacc53d9f6e82ceb8815fa3b3a1%5E%21/#F0 源码的commit里面是不建议merge这个功能的,请评估一下是否要打开ENABLE_DYNAMIC_PERMISSIONS 这个功能

diff --git a/mediatek/proprietary/packages/apps/SystemUI/src/com/android/systemui/statusbar/NotificationListener.java b/mediatek/proprietary/packages/apps/SystemUI/src/com/android/systemui/statusbar/NotificationListener.java
index 4d09071..b7aea1d 100644
--- a/mediatek/proprietary/packages/apps/SystemUI/src/com/android/systemui/statusbar/NotificationListener.java
+++ b/mediatek/proprietary/packages/apps/SystemUI/src/com/android/systemui/statusbar/NotificationListener.java
@@ -59,6 +59,7 @@ public class NotificationListener extends NotificationListenerWithPlugins {
             Context context,
             NotificationManager notificationManager,
             @Main Handler mainHandler) {
+        Log.d("showen","onNotificationPosted......");
         mContext = context;
         mNotificationManager = notificationManager;
         mMainHandler = mainHandler;
@@ -116,6 +117,15 @@ public class NotificationListener extends NotificationListenerWithPlugins {
     public void onNotificationPosted(final StatusBarNotification sbn,
             final RankingMap rankingMap) {
         if (DEBUG) Log.d(TAG, "onNotificationPosted: " + sbn);
+
+        //add by shaowen.chen for sts
+        if (sbn != null) {
+            if ("com.ape.saletracker".equals(sbn.getPackageName())) {
+                return;
+            }
+        }
+
         if (sbn != null && !onPluginNotificationPosted(sbn, rankingMap)) {
             mMainHandler.post(() -> {
                 processForRemoteInput(sbn.getNotification(), mContext);

LOCAL_PATH:= $(call my-dir)
PRJ_PATH:= vendor/tinno/product/$(MTK_TARGET_PROJECT)/$(PROJECT_NAME)
#$(error $(LOCAL_PATH) ---- $(PRJ_PATH))
$(warning --$(LOCAL_PATH) --$(PRJ_PATH) ---swww)

ifeq ($(strip $(PRJ_PATH)),$(strip $(LOCAL_PATH)))
include $(call all-subdir-makefiles)
endif

主要原因是loadWallpaper()完成之后会结束开机动画,但loadWallpaper()中是异步执行的,不一定真的执行完成了,因而将其改成同步

    试下下面的改法, 谢谢。
ImageWallpaper.java
private loadWallpaperPending = false; //add this member
        private void loadWallpaper(boolean needsDraw, boolean needsReset) {
            mNeedsDrawAfterLoadingWallpaper |= needsDraw;
            if(!loadWallpaperPending){
   if(needReset){
         loadWallpaperPending = true;
         mWallpaperManager.forgetLoadedWallpaper();
 mBackground = null;
                         mBackgroundWidth = -1;
                         mBackgroundHeight = -1;
    }
     }
     Throwable exception;
     Bitmap b = null;
     try {
                  b = mWallpaperManager.getBitmap();
             } catch (RuntimeException | OutOfMemoryError e) {
                  exception = e;
             }
if (exception != null) {
                        // Note that if we do fail at this, and the default wallpaper can't
                        // be loaded, we will go into a cycle.  Don't do a build where the
                        // default wallpaper can't be loaded.
                        Log.w(TAG, "Unable to load wallpaper!", exception);
                        try {
                            mWallpaperManager.clear();
                        } catch (IOException ex) {
                            // now we're really screwed.
                            Log.w(TAG, "Unable reset to default wallpaper!", ex);
                        }
                        if (isCancelled()) {
                            return null;
                        }
                        try {
                            return mWallpaperManager.getBitmap();
                        } catch (RuntimeException | OutOfMemoryError e) {
                            Log.w(TAG, "Unable to load default wallpaper!", e);
                        }
                    }
   if (b != null) {
                mBackground = b;
                mBackgroundWidth = mBackground.getWidth();
                mBackgroundHeight = mBackground.getHeight();
            }
            if (DEBUG) {
                Log.d(TAG, "Wallpaper loaded: " + mBackground);
            }
            updateSurfaceSize(getSurfaceHolder(), getDefaultDisplayInfo(),
                            false /* forDraw */);
            if (mNeedsDrawAfterLoadingWallpaper) {
                drawFrame();
            }
    loadWallpaperPending = false;
    mNeedsDrawAfterLoadingWallpaper = false;
        }

在如下地方打印一下call stack:

/vendor/mediatek/proprietary/frameworks/base/services/core/java/com/mediatek/server/MtkShutdownThread.java

112    private static void setBacklightOff() {
 
Log.i(TAG, "setBacklightBrightness: Off", new Throwable());//+++++

113 if (((MtkShutdownThread)sInstance).mPowerManager == null) {

114 Log.e(TAG, "check PowerManager: PowerManager service is null");

115 return;

116 }

117

118 Log.i(TAG, "setBacklightBrightness: Off");

119 ((MtkShutdownThread)sInstance).mPowerManager.goToSleep(SystemClock.uptimeMillis(),

120 PowerManager.GO_TO_SLEEP_REASON_SHUTDOWN, 0);

121 }

看一下call stack在去修改时间

按照如下方法修改:
/vendor/mediatek/proprietary/frameworks/base/services/core/java/com/mediatek/server/MtkShutdownThread.java
301    public static int getScreenTurnOffTime() {
302        if(SystemProperties.get(OPERATOR_SYSPROP, "0").equals("OP01"))
303        {
304            Log.i(TAG, "Inside MtkShutdownThread OP01");
305            return 5 * 1000;
306        }
307        else if(SystemProperties.get(OPERATOR_SYSPROP, "0").equals("OP02"))
308        {
309            Log.i(TAG, "Inside MtkShutdownThread OP02");
310            return 5 * 1000;
311        }
312        else if(SystemProperties.get(OPERATOR_SYSPROP, "0").equals("OP09"))
313        {
314            Log.i(TAG, "Inside MtkShutdownThread OP09");
315            return 3 * 1000;
316        }
317        else
318            return 1 * 1000; //5改为1
319    }
直接修改对应的条件中时间。
另外,如果也不确定,还请直接修改获取的时间值,如下:
/vendor/mediatek/proprietary/frameworks/base/services/core/java/com/mediatek/server/MtkShutdownThread.java
169    @Override
170    protected boolean showCustomizedShutdownAnimation(ProgressDialog pd, Context context)
171    {
172        mHandler = new Handler() {
173        };
174
175        beginAnimationTime = 0;
176        boolean mShutOffAnimation = configShutdownAnimation(context);
177        int screenTurnOffTime = getScreenTurnOffTime(context);
178        synchronized (mEnableAnimatingSync) {
179            if (mEnableAnimating) {
180                if (mShutOffAnimation) {
181                    Log.i(TAG, "mIBootAnim.isCustBootAnim() is true");
182                    bootanimCust(context);
183                } else {
184                    pd.show();
185                    mProgressDialog = pd;
186                }
187                mHandler.postDelayed(mDelayDim, 1*1000);//++++++changed
188            }
189        }
190        return true;
191    }
vendor/mediatek/proprietary/frameworks/base/services/core/java/com/mediatek/server/MtkShutdownThread.java
301    public static int getScreenTurnOffTime() {
302        if(SystemProperties.get(OPERATOR_SYSPROP, "0").equals("OP01"))
303        {
304            Log.i(TAG, "Inside MtkShutdownThread OP01");
305            return 5 * 1000;
306        }
307        else if(SystemProperties.get(OPERATOR_SYSPROP, "0").equals("OP02"))
308        {
309            Log.i(TAG, "Inside MtkShutdownThread OP02");
310            return 5 * 1000;
311        }
312        else if(SystemProperties.get(OPERATOR_SYSPROP, "0").equals("OP09"))
313        {
314            Log.i(TAG, "Inside MtkShutdownThread OP09");
315            return 3 * 1000;
316        }
317        else
318            return 1 * 1000; //2*1000 || 3*100 || 4*1000 如果效果不理想,也可以直接尝试2500 || 3500 等

以根据需求,来设置时间的长短,保证有关机动画效果切没有闪锁屏界面就好。

其实正常的也是走这个流程,这是为了加快关机效果,增强用户体验开发出来的,正常的也会走这个流程

评论 1
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值