Issue #1969025: need api for launching intent as if it were coming from another component

And now there is.

3 files changed, 55 insertions, 5 deletions

diff --git a/core/java/android/app/ActivityManagerNative.java b/core/java/android/app/ActivityManagerNative.java
index ec7714d..ba6cc32 100644
--- a/core/java/android/app/ActivityManagerNative.java
+++ b/core/java/android/app/ActivityManagerNative.java
@@ -1068,6 +1068,23 @@ public abstract class ActivityManagerNative extends Binder implements IActivityM
             unregisterActivityWatcher(watcher);
             return true;
         }
+        
+        case START_ACTIVITY_IN_PACKAGE_TRANSACTION:
+        {
+            data.enforceInterface(IActivityManager.descriptor);
+            int uid = data.readInt();
+            Intent intent = Intent.CREATOR.createFromParcel(data);
+            String resolvedType = data.readString();
+            IBinder resultTo = data.readStrongBinder();
+            String resultWho = data.readString();    
+            int requestCode = data.readInt();
+            boolean onlyIfNeeded = data.readInt() != 0;
+            int result = startActivityInPackage(uid, intent, resolvedType,
+                    resultTo, resultWho, requestCode, onlyIfNeeded);
+            reply.writeNoException();
+            reply.writeInt(result);
+            return true;
+        }
         }
         
         return super.onTransact(code, data, reply, flags);
@@ -2330,5 +2347,27 @@ class ActivityManagerProxy implements IActivityManager
         reply.recycle();
     }
     
+    public int startActivityInPackage(int uid,
+            Intent intent, String resolvedType, IBinder resultTo,
+            String resultWho, int requestCode, boolean onlyIfNeeded)
+            throws RemoteException {
+        Parcel data = Parcel.obtain();
+        Parcel reply = Parcel.obtain();
+        data.writeInterfaceToken(IActivityManager.descriptor);
+        data.writeInt(uid);
+        intent.writeToParcel(data, 0);
+        data.writeString(resolvedType);
+        data.writeStrongBinder(resultTo);
+        data.writeString(resultWho);
+        data.writeInt(requestCode);
+        data.writeInt(onlyIfNeeded ? 1 : 0);
+        mRemote.transact(START_ACTIVITY_IN_PACKAGE_TRANSACTION, data, reply, 0);
+        reply.readException();
+        int result = reply.readInt();
+        reply.recycle();
+        data.recycle();
+        return result;
+    }
+        
     private IBinder mRemote;
 }
diff --git a/core/java/android/app/IActivityManager.java b/core/java/android/app/IActivityManager.java
index ee1b69b..95b376c 100644
--- a/core/java/android/app/IActivityManager.java
+++ b/core/java/android/app/IActivityManager.java
@@ -262,6 +262,11 @@ public interface IActivityManager extends IInterface {
     public void unregisterActivityWatcher(IActivityWatcher watcher)
             throws RemoteException;
 
+    public int startActivityInPackage(int uid,
+            Intent intent, String resolvedType, IBinder resultTo,
+            String resultWho, int requestCode, boolean onlyIfNeeded)
+            throws RemoteException;
+        
     /*
      * Private non-Binder interfaces
      */
@@ -415,4 +420,5 @@ public interface IActivityManager extends IInterface {
     int UNBIND_BACKUP_AGENT_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+91;
     int REGISTER_ACTIVITY_WATCHER_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+92;
     int UNREGISTER_ACTIVITY_WATCHER_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+93;
+    int START_ACTIVITY_IN_PACKAGE_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+94;
 }
diff --git a/services/java/com/android/server/am/ActivityManagerService.java b/services/java/com/android/server/am/ActivityManagerService.java
index 442e9ce..36d3c4a 100644
--- a/services/java/com/android/server/am/ActivityManagerService.java
+++ b/services/java/com/android/server/am/ActivityManagerService.java
@@ -3522,8 +3522,6 @@ public final class ActivityManagerService extends ActivityManagerNative implemen
         intent = new Intent(intent);
 
         // Collect information about the target of the Intent.
-        // Must do this before locking, because resolving the intent
-        // may require launching a process to run its content provider.
         ActivityInfo aInfo;
         try {
             ResolveInfo rInfo =
@@ -3657,17 +3655,24 @@ public final class ActivityManagerService extends ActivityManagerNative implemen
         }
     }
 
-    final int startActivityInPackage(int uid,
+    public final int startActivityInPackage(int uid,
             Intent intent, String resolvedType, IBinder resultTo,
             String resultWho, int requestCode, boolean onlyIfNeeded) {
+        
+        // This is so super not safe, that only the system (or okay root)
+        // can do it.
+        final int callingUid = Binder.getCallingUid();
+        if (callingUid != 0 && callingUid != Process.myUid()) {
+            throw new SecurityException(
+                    "startActivityInPackage only available to the system");
+        }
+        
         final boolean componentSpecified = intent.getComponent() != null;
         
         // Don't modify the client's object!
         intent = new Intent(intent);
 
         // Collect information about the target of the Intent.
-        // Must do this before locking, because resolving the intent
-        // may require launching a process to run its content provider.
         ActivityInfo aInfo;
         try {
             ResolveInfo rInfo =