binder: "intent:" target URIs that match multiple <service>s should only connect to the one of highest priority #12490
Description
More than one <service> can advertise an <intent-filter> that matches a given Intent. IntentNameResolver returns all matches to the "pick-first" load balancer which tries them in priority order. If connecting to a first Service fails, pick-first will try the second highest priority Service.
Pick-first's fail-over behavior makes sense in the networked world where clients want to tolerate server failure and spotty connectivity. In the on-device context there are only two reasons we want fail-over:
- So an unauthorized app that maliciously gives itself a high
<android:priority>can quickly be passed over by preauthorization, avoiding a denial-of-service situation. - So multiple server apps in an
<android:priority>hierarchy can independently collaborate on which of them is active by enabling/disabling only their own<service>components in PackageManager.
But BinderClientTransport can fail to connect for many transient reasons like:
- the phone/tablet is busy doing other things causing the server app to be slow to start (DEADLINE_EXCEEDED)
- the server app does many things other than host the target Service, and a bug in one of them crashes the whole process while the ServiceConnection is being established (UNAVAILABLE).
- the user "swipes away" the server app's actiivity from the "recents" UI just as the ServiceConnection is being established (UNAVAILABLE).
- the server app is manually/automatically updated to a newer version and android kills all its processes while the ServiceConnection is being established (UNAVAILABLE).
Fail-over for these other reasons is problematic because different AndroidComponentAddresss are likely different implementations of the requested interface. It would be like if you selected Chrome as your default mobile browser but when you clicked on a URL, your phone failed over to Firefox if it didn’t launch fast enough. Perhaps that’s better than failing to show the web page at all, but it's also masking the underlying problem with the explicitly configured first choice browser in a way that's surprising and non-deterministic.