Ensure privileged APIs require runtime permission.

When users revoke a runtime permission, they expect all interactions
to be blocked, including those protected by the BLUETOOTH_PRIVILEGED
permission.

This change finishes applying that policy to any remaining Bluetooth
APIs which didn't already implement it.  To keep the implementation
straightforward, this change does "data delivery" checks when
registering for callbacks; the ideal behavior would be to wait
until data is actually delivered through the callbacks, but
RemoteCallbackList doesn't have support for AttributionSource yet.

Bug: 186405452
Test: atest BluetoothInstrumentationTests
Change-Id: Idd7be143eb8baff020a0718065293baae708041b

3 files changed, 130 insertions, 45 deletions

diff --git a/core/java/android/bluetooth/BluetoothAdapter.java b/core/java/android/bluetooth/BluetoothAdapter.java
index 8afc557ef85e..67179c7d3e46 100644
--- a/core/java/android/bluetooth/BluetoothAdapter.java
+++ b/core/java/android/bluetooth/BluetoothAdapter.java
@@ -1311,11 +1311,15 @@ public final class BluetoothAdapter {
      * @hide
      */
     @UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.R, trackingBug = 170729553)
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresBluetoothConnectPermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean factoryReset() {
         try {
             mServiceLock.readLock().lock();
-            if (mService != null && mService.factoryReset()
+            if (mService != null && mService.factoryReset(mAttributionSource)
                     && mManagerService != null
                     && mManagerService.onFactoryReset(mAttributionSource)) {
                 return true;
@@ -1430,7 +1434,11 @@ public final class BluetoothAdapter {
      *
      * @hide
      */
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresBluetoothConnectPermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean setBluetoothClass(BluetoothClass bluetoothClass) {
         if (getState() != STATE_ON) {
             return false;
@@ -1438,7 +1446,7 @@ public final class BluetoothAdapter {
         try {
             mServiceLock.readLock().lock();
             if (mService != null) {
-                return mService.setBluetoothClass(bluetoothClass);
+                return mService.setBluetoothClass(bluetoothClass, mAttributionSource);
             }
         } catch (RemoteException e) {
             Log.e(TAG, "", e);
@@ -1487,12 +1495,16 @@ public final class BluetoothAdapter {
      *
      * @hide
      */
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresBluetoothConnectPermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean setIoCapability(@IoCapability int capability) {
         if (getState() != STATE_ON) return false;
         try {
             mServiceLock.readLock().lock();
-            if (mService != null) return mService.setIoCapability(capability);
+            if (mService != null) return mService.setIoCapability(capability, mAttributionSource);
         } catch (RemoteException e) {
             Log.e(TAG, e.getMessage(), e);
         } finally {
@@ -1540,12 +1552,16 @@ public final class BluetoothAdapter {
      *
      * @hide
      */
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresBluetoothConnectPermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean setLeIoCapability(@IoCapability int capability) {
         if (getState() != STATE_ON) return false;
         try {
             mServiceLock.readLock().lock();
-            if (mService != null) return mService.setLeIoCapability(capability);
+            if (mService != null) return mService.setLeIoCapability(capability, mAttributionSource);
         } catch (RemoteException e) {
             Log.e(TAG, e.getMessage(), e);
         } finally {
@@ -1739,12 +1755,16 @@ public final class BluetoothAdapter {
      * @hide
      */
     @SystemApi
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresBluetoothConnectPermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public long getDiscoveryEndMillis() {
         try {
             mServiceLock.readLock().lock();
             if (mService != null) {
-                return mService.getDiscoveryEndMillis();
+                return mService.getDiscoveryEndMillis(mAttributionSource);
             }
         } catch (RemoteException e) {
             Log.e(TAG, "", e);
@@ -2353,7 +2373,11 @@ public final class BluetoothAdapter {
      * instead.
      */
     @Deprecated
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresBluetoothConnectPermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public BluetoothActivityEnergyInfo getControllerActivityEnergyInfo(int updateType) {
         SynchronousResultReceiver receiver = new SynchronousResultReceiver();
         requestControllerActivityEnergyInfo(receiver);
@@ -2379,12 +2403,16 @@ public final class BluetoothAdapter {
      * @param result The callback to which to send the activity info.
      * @hide
      */
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresBluetoothConnectPermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public void requestControllerActivityEnergyInfo(ResultReceiver result) {
         try {
             mServiceLock.readLock().lock();
             if (mService != null) {
-                mService.requestActivityInfo(result);
+                mService.requestActivityInfo(result, mAttributionSource);
                 result = null;
             }
         } catch (RemoteException e) {
@@ -3141,7 +3169,7 @@ public final class BluetoothAdapter {
                         sMetadataListeners.forEach((device, pair) -> {
                             try {
                                 mService.registerMetadataListener(sBluetoothMetadataListener,
-                                        device);
+                                        device, mAttributionSource);
                             } catch (RemoteException e) {
                                 Log.e(TAG, "Failed to register metadata listener", e);
                             }
@@ -3150,7 +3178,8 @@ public final class BluetoothAdapter {
                     synchronized (mBluetoothConnectionCallbackExecutorMap) {
                         if (!mBluetoothConnectionCallbackExecutorMap.isEmpty()) {
                             try {
-                                mService.registerBluetoothConnectionCallback(mConnectionCallback);
+                                mService.registerBluetoothConnectionCallback(mConnectionCallback,
+                                        mAttributionSource);
                             } catch (RemoteException e) {
                                 Log.e(TAG, "onBluetoothServiceUp: Failed to register bluetooth"
                                         + "connection callback", e);
@@ -3364,7 +3393,11 @@ public final class BluetoothAdapter {
      * @hide
      */
     @SystemApi
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresBluetoothConnectPermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public void generateLocalOobData(@Transport int transport,
             @NonNull @CallbackExecutor Executor executor, @NonNull OobDataCallback callback) {
         if (transport != BluetoothDevice.TRANSPORT_BREDR && transport
@@ -3378,7 +3411,7 @@ public final class BluetoothAdapter {
         } else {
             try {
                 mService.generateLocalOobData(transport, new WrappedOobDataCallback(callback,
-                        executor));
+                        executor), mAttributionSource);
             } catch (RemoteException e) {
                 Log.e(TAG, "", e);
             }
@@ -3515,11 +3548,13 @@ public final class BluetoothAdapter {
 
     /** {@hide} */
     @UnsupportedAppUsage
+    @RequiresNoPermission
     public IBluetoothManager getBluetoothManager() {
         return mManagerService;
     }
 
     /** {@hide} */
+    @RequiresNoPermission
     public AttributionSource getAttributionSource() {
         return mAttributionSource;
     }
@@ -3892,7 +3927,11 @@ public final class BluetoothAdapter {
      * @hide
      */
     @SystemApi
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresBluetoothConnectPermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean addOnMetadataChangedListener(@NonNull BluetoothDevice device,
             @NonNull Executor executor, @NonNull OnMetadataChangedListener listener) {
         if (DBG) Log.d(TAG, "addOnMetadataChangedListener()");
@@ -3932,7 +3971,8 @@ public final class BluetoothAdapter {
 
             boolean ret = false;
             try {
-                ret = service.registerMetadataListener(sBluetoothMetadataListener, device);
+                ret = service.registerMetadataListener(sBluetoothMetadataListener, device,
+                        mAttributionSource);
             } catch (RemoteException e) {
                 Log.e(TAG, "registerMetadataListener fail", e);
             } finally {
@@ -3965,7 +4005,11 @@ public final class BluetoothAdapter {
      * @hide
      */
     @SystemApi
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresBluetoothConnectPermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean removeOnMetadataChangedListener(@NonNull BluetoothDevice device,
             @NonNull OnMetadataChangedListener listener) {
         if (DBG) Log.d(TAG, "removeOnMetadataChangedListener()");
@@ -3993,7 +4037,7 @@ public final class BluetoothAdapter {
                     return true;
                 }
                 try {
-                    return service.unregisterMetadataListener(device);
+                    return service.unregisterMetadataListener(device, mAttributionSource);
                 } catch (RemoteException e) {
                     Log.e(TAG, "unregisterMetadataListener fail", e);
                     return false;
@@ -4055,7 +4099,11 @@ public final class BluetoothAdapter {
      * @throws IllegalArgumentException if the callback is already registered
      * @hide
      */
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresBluetoothConnectPermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean registerBluetoothConnectionCallback(@NonNull @CallbackExecutor Executor executor,
             @NonNull BluetoothConnectionCallback callback) {
         if (DBG) Log.d(TAG, "registerBluetoothConnectionCallback()");
@@ -4069,7 +4117,8 @@ public final class BluetoothAdapter {
                 try {
                     mServiceLock.readLock().lock();
                     if (mService != null) {
-                        if (!mService.registerBluetoothConnectionCallback(mConnectionCallback)) {
+                        if (!mService.registerBluetoothConnectionCallback(mConnectionCallback,
+                                mAttributionSource)) {
                             return false;
                         }
                     }
@@ -4098,7 +4147,11 @@ public final class BluetoothAdapter {
      * @return true if the callback was unregistered successfully, false otherwise
      * @hide
      */
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresBluetoothConnectPermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean unregisterBluetoothConnectionCallback(
             @NonNull BluetoothConnectionCallback callback) {
         if (DBG) Log.d(TAG, "unregisterBluetoothConnectionCallback()");
@@ -4120,7 +4173,8 @@ public final class BluetoothAdapter {
         try {
             mServiceLock.readLock().lock();
             if (mService != null) {
-                return mService.unregisterBluetoothConnectionCallback(mConnectionCallback);
+                return mService.unregisterBluetoothConnectionCallback(mConnectionCallback,
+                        mAttributionSource);
             }
         } catch (RemoteException e) {
             Log.e(TAG, "", e);
diff --git a/core/java/android/bluetooth/BluetoothDevice.java b/core/java/android/bluetooth/BluetoothDevice.java
index 98823b096a55..0ca6d74c6759 100644
--- a/core/java/android/bluetooth/BluetoothDevice.java
+++ b/core/java/android/bluetooth/BluetoothDevice.java
@@ -1644,7 +1644,10 @@ public final class BluetoothDevice implements Parcelable {
      * @hide
      */
     @SystemApi
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean canBondWithoutDialog() {
         final IBluetooth service = sService;
         if (service == null) {
@@ -1653,7 +1656,7 @@ public final class BluetoothDevice implements Parcelable {
         }
         try {
             if (DBG) Log.d(TAG, "canBondWithoutDialog, device: " + this);
-            return service.canBondWithoutDialog(this);
+            return service.canBondWithoutDialog(this, mAttributionSource);
         } catch (RemoteException e) {
             Log.e(TAG, "", e);
         }
@@ -1874,7 +1877,10 @@ public final class BluetoothDevice implements Parcelable {
      *
      * @return true confirmation has been sent out false for error
      */
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean setPairingConfirmation(boolean confirm) {
         final IBluetooth service = sService;
         if (service == null) {
@@ -1882,7 +1888,7 @@ public final class BluetoothDevice implements Parcelable {
             return false;
         }
         try {
-            return service.setPairingConfirmation(this, confirm);
+            return service.setPairingConfirmation(this, confirm, mAttributionSource);
         } catch (RemoteException e) {
             Log.e(TAG, "", e);
         }
@@ -1971,14 +1977,17 @@ public final class BluetoothDevice implements Parcelable {
      * @hide
      */
     @SystemApi
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean setSilenceMode(boolean silence) {
         final IBluetooth service = sService;
         if (service == null) {
             throw new IllegalStateException("Bluetooth is not turned ON");
         }
         try {
-            return service.setSilenceMode(this, silence);
+            return service.setSilenceMode(this, silence, mAttributionSource);
         } catch (RemoteException e) {
             Log.e(TAG, "setSilenceMode fail", e);
             return false;
@@ -1993,14 +2002,17 @@ public final class BluetoothDevice implements Parcelable {
      * @hide
      */
     @SystemApi
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean isInSilenceMode() {
         final IBluetooth service = sService;
         if (service == null) {
             throw new IllegalStateException("Bluetooth is not turned ON");
         }
         try {
-            return service.getSilenceMode(this);
+            return service.getSilenceMode(this, mAttributionSource);
         } catch (RemoteException e) {
             Log.e(TAG, "isInSilenceMode fail", e);
             return false;
@@ -2016,14 +2028,17 @@ public final class BluetoothDevice implements Parcelable {
      * @hide
      */
     @SystemApi
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean setPhonebookAccessPermission(@AccessPermission int value) {
         final IBluetooth service = sService;
         if (service == null) {
             return false;
         }
         try {
-            return service.setPhonebookAccessPermission(this, value);
+            return service.setPhonebookAccessPermission(this, value, mAttributionSource);
         } catch (RemoteException e) {
             Log.e(TAG, "", e);
         }
@@ -2063,7 +2078,10 @@ public final class BluetoothDevice implements Parcelable {
      * @hide
      */
     @SystemApi
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean setMessageAccessPermission(@AccessPermission int value) {
         // Validates param value is one of the accepted constants
         if (value != ACCESS_ALLOWED && value != ACCESS_REJECTED && value != ACCESS_UNKNOWN) {
@@ -2074,7 +2092,7 @@ public final class BluetoothDevice implements Parcelable {
             return false;
         }
         try {
-            return service.setMessageAccessPermission(this, value);
+            return service.setMessageAccessPermission(this, value, mAttributionSource);
         } catch (RemoteException e) {
             Log.e(TAG, "", e);
         }
@@ -2114,14 +2132,17 @@ public final class BluetoothDevice implements Parcelable {
      * @hide
      */
     @SystemApi
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean setSimAccessPermission(int value) {
         final IBluetooth service = sService;
         if (service == null) {
             return false;
         }
         try {
-            return service.setSimAccessPermission(this, value);
+            return service.setSimAccessPermission(this, value, mAttributionSource);
         } catch (RemoteException e) {
             Log.e(TAG, "", e);
         }
@@ -2616,7 +2637,10 @@ public final class BluetoothDevice implements Parcelable {
      * @hide
     */
     @SystemApi
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public boolean setMetadata(@MetadataKey int key, @NonNull byte[] value) {
         final IBluetooth service = sService;
         if (service == null) {
@@ -2628,7 +2652,7 @@ public final class BluetoothDevice implements Parcelable {
                     + ", should not over " + METADATA_MAX_LENGTH);
         }
         try {
-            return service.setMetadata(this, key, value);
+            return service.setMetadata(this, key, value, mAttributionSource);
         } catch (RemoteException e) {
             Log.e(TAG, "setMetadata fail", e);
             return false;
@@ -2644,7 +2668,10 @@ public final class BluetoothDevice implements Parcelable {
      */
     @SystemApi
     @Nullable
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public byte[] getMetadata(@MetadataKey int key) {
         final IBluetooth service = sService;
         if (service == null) {
@@ -2652,7 +2679,7 @@ public final class BluetoothDevice implements Parcelable {
             return null;
         }
         try {
-            return service.getMetadata(this, key);
+            return service.getMetadata(this, key, mAttributionSource);
         } catch (RemoteException e) {
             Log.e(TAG, "getMetadata fail", e);
             return null;
diff --git a/core/java/android/bluetooth/le/AdvertisingSet.java b/core/java/android/bluetooth/le/AdvertisingSet.java
index caa91fb23918..bbdb6953afd1 100644
--- a/core/java/android/bluetooth/le/AdvertisingSet.java
+++ b/core/java/android/bluetooth/le/AdvertisingSet.java
@@ -205,10 +205,14 @@ public final class AdvertisingSet {
      *
      * @hide
      */
-    @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
+    @RequiresBluetoothAdvertisePermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_ADVERTISE,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
     public void getOwnAddress() {
         try {
-            mGatt.getOwnAddress(mAdvertiserId);
+            mGatt.getOwnAddress(mAdvertiserId, mAttributionSource);
         } catch (RemoteException e) {
             Log.e(TAG, "remote exception - ", e);
         }