From 0f929c53201264da0ae908e349c904f2fa930e29 Mon Sep 17 00:00:00 2001 From: Svetoslav Ganov Date: Tue, 27 Dec 2016 18:55:29 -0800 Subject: [PATCH] Don't allow permission change to runtime Prevent apps to change permission protection level to dangerous from any other type as this would allow a privilege escalation where an app adds a normal permission in other app's group and then redefines it as dangerous leading to the group auto-grant. Test: Added a CTS test which passes. bug:33860747 Change-Id: I1ccf546f78ee79ff027cb98124be81c8e5265a82 --- .../server/pm/PackageManagerService.java | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index ec4b7ebf8a9b5..b5a7c69622888 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -15611,6 +15611,27 @@ public class PackageManagerService extends IPackageManager.Stub { return; } + // Prevent apps to change permission protection level to dangerous + // from any other type as this would allow a privilege escalation + // where an app adds a normal/signature permission in other app's + // group and later redefines it as dangerous leading to the group + // auto-grant. + final int permissionCount = pkg.permissions.size(); + for (int i = 0; i < permissionCount; i++) { + PackageParser.Permission permission = pkg.permissions.get(i); + if ((permission.info.protectionLevel & PermissionInfo.PROTECTION_MASK_BASE) + == PermissionInfo.PROTECTION_DANGEROUS) { + BasePermission bp = mSettings.mPermissions.get(permission.info.name); + if (bp != null && !bp.isRuntime()) { + res.setError(PackageManager.INSTALL_PARSE_FAILED_BAD_MANIFEST, + "Package " + pkg.packageName + " trying to change a " + + "non-runtime permission " + permission.info.name + + " to runtime."); + return; + } + } + } + // Prevent installing of child packages if (oldPackage.parentPackage != null) { res.setError(PackageManager.INSTALL_PARSE_FAILED_BAD_PACKAGE_NAME,