Android - Can't start an activity with "am start" when running as user on Android 11

I don't know if this is a new restriction, but with an Android 11 device, I can't run "am" from native code or the shell when I am running as my app's user. It works fine without run-as. Is this a new restriction, or is there some permission I can request for the app to allow it? Android 10 does not have this problem.

Example:

adb shell
run-as com.example.app
am start -a com.example.app.someactivity

The result is

Exception occurred while executing 'start':
java.lang.SecurityException: Permission Denial: package=com.android.shell does not belong to uid=10262
    at com.android.server.wm.ActivityTaskManagerService.assertPackageMatchesCallingUid(ActivityTaskManagerService.java:2598)
    at com.android.server.wm.ActivityTaskManagerService.startActivityAsUser(ActivityTaskManagerService.java:1081)
    at com.android.server.wm.ActivityTaskManagerService.startActivityAsUser(ActivityTaskManagerService.java:1072)
    at com.android.server.am.ActivityManagerService.startActivityAsUserWithFeature(ActivityManagerService.java:3678)
    at com.android.server.am.ActivityManagerShellCommand.runStartActivity(ActivityManagerShellCommand.java:544)
    at com.android.server.am.ActivityManagerShellCommand.onCommand(ActivityManagerShellCommand.java:186)
    at android.os.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:98)
    at android.os.ShellCommand.exec(ShellCommand.java:44)
    at com.android.server.am.ActivityManagerService.onShellCommand(ActivityManagerService.java:10522)
    at android.os.Binder.shellCommand(Binder.java:929)
    at android.os.Binder.onTransact(Binder.java:813)
    at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:5027)
    at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:2883)
    at android.os.Binder.execTransactInternal(Binder.java:1159)
    at android.os.Binder.execTransact(Binder.java:1123)

Also, "am start-foreground-service" does not have this problem.

Solution

For whatever reason, this restriction is real and apparently undocumented.

My fix was to instead use "am start-foreground-service" to launch a new service that can then start an activity. Hoops jumped, code bloated, and now working.

In summary "am start -a " is now broken when used by an app user, but "am start-foreground-service" is not, and a service can start an activity for a user (unfortunately duplicating functionality that worked for a decade but now disappeared).