Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Don't check apex when granting priv permission unless needed" into rvc-dev

Browse Source
This commit is contained in:
Philip P. Moltmann
2020-03-28 01:19:17 +00:00
committed by Android (Google) Code Review
parent 55237e8973 67655a1448
commit 19f8283a01
1 changed files with 40 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
services/core/java/com/android/server/pm/permission/PermissionManagerService.java
View File

@@ -3319,17 +3319,19 @@ public class PermissionManagerService extends IPermissionManager.Stub {
if (!privappPermissionsDisable && privilegedPermission && pkg.isPrivileged() if (!privappPermissionsDisable && privilegedPermission && pkg.isPrivileged()
&& !platformPackage && platformPermission) { && !platformPackage && platformPermission) {
if (!hasPrivappWhitelistEntry(perm, pkg)) { if (!hasPrivappWhitelistEntry(perm, pkg)) {
ApexManager apexMgr = ApexManager.getInstance();
String apexContainingPkg = apexMgr.getActiveApexPackageNameContainingPackage(pkg);
// Only enforce whitelist this on boot // Only enforce whitelist this on boot
if (!mSystemReady if (!mSystemReady
// Updated system apps do not need to be whitelisted // Updated system apps do not need to be whitelisted
&& !pkgSetting.getPkgState().isUpdatedSystemApp() && !pkgSetting.getPkgState().isUpdatedSystemApp()) {
ApexManager apexMgr = ApexManager.getInstance();
String apexContainingPkg = apexMgr.getActiveApexPackageNameContainingPackage(
pkg);
// Apps that are in updated apexs' do not need to be whitelisted // Apps that are in updated apexs' do not need to be whitelisted
&& (apexContainingPkg == null || apexMgr.isFactory( if (apexContainingPkg == null || apexMgr.isFactory(
apexMgr.getPackageInfo(apexContainingPkg, MATCH_ACTIVE_PACKAGE)))) { apexMgr.getPackageInfo(apexContainingPkg, MATCH_ACTIVE_PACKAGE))) {
// it's only a reportable violation if the permission isn't explicitly denied // it's only a reportable violation if the permission isn't explicitly
// denied
ArraySet<String> deniedPermissions = null; ArraySet<String> deniedPermissions = null;
if (pkg.isVendor()) { if (pkg.isVendor()) {
deniedPermissions = SystemConfig.getInstance() deniedPermissions = SystemConfig.getInstance()
@@ -3356,12 +3358,14 @@ public class PermissionManagerService extends IPermissionManager.Stub {
mPrivappPermissionsViolations = new ArraySet<>(); mPrivappPermissionsViolations = new ArraySet<>();
} }
mPrivappPermissionsViolations.add( mPrivappPermissionsViolations.add(
pkg.getPackageName() + " (" + pkg.getCodePath() + "): " + perm); pkg.getPackageName() + " (" + pkg.getCodePath() + "): "
+ perm);
} }
} else { } else {
return false; return false;
} }
} }
}
if (RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS_ENFORCE) { if (RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS_ENFORCE) {
return false; return false;
} }