Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't reset permission granted by role.

Browse Source 
Role isn't reset when clearing package data, so its permissions
shouldn't be reset as well. This becomes important as we are using
roles to replace DefaultPermissionGrantPolicy now, so GRANTED_BY_ROLE
should also behave like GRANTED_BY_DEFAULT. In case any future role
should be revoked upon clearing package data, the role itself should
handle permission revocation as well.

Fixes: 158026399
Test: Clear package data for Photos, observer that storage permissions
      are not revoked because they are granted by role, instead of
      being temporarily revoked and granted seconds after launching
      the app again
Change-Id: Iea1fd1a4e15c106c31c30d10ab6bf84d475455c2
This commit is contained in:
Hai Zhang
2020-06-02 14:07:23 -07:00
parent 0d07c9ac52
commit 253fa2b876
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
services/core/java/com/android/server/pm/permission/PermissionManagerService.java
View File

@@ -26,6 +26,7 @@ import static android.content.pm.ApplicationInfo.AUTO_REVOKE_DISCOURAGED;
import static android.content.pm.PackageManager.FLAGS_PERMISSION_RESTRICTION_ANY_EXEMPT;
import static android.content.pm.PackageManager.FLAG_PERMISSION_APPLY_RESTRICTION;
import static android.content.pm.PackageManager.FLAG_PERMISSION_GRANTED_BY_DEFAULT;
import static android.content.pm.PackageManager.FLAG_PERMISSION_GRANTED_BY_ROLE;
import static android.content.pm.PackageManager.FLAG_PERMISSION_ONE_TIME;
import static android.content.pm.PackageManager.FLAG_PERMISSION_POLICY_FIXED;
import static android.content.pm.PackageManager.FLAG_PERMISSION_REVIEW_REQUIRED;
@@ -1804,8 +1805,9 @@ public class PermissionManagerService extends IPermissionManager.Stub {
continue;
}
// If this permission was granted by default, make sure it is.
if ((oldFlags & FLAG_PERMISSION_GRANTED_BY_DEFAULT) != 0) {
// If this permission was granted by default or role, make sure it is.
if ((oldFlags & FLAG_PERMISSION_GRANTED_BY_DEFAULT) != 0
|| (oldFlags & FLAG_PERMISSION_GRANTED_BY_ROLE) != 0) {
// PermissionPolicyService will handle the app op for runtime permissions later.
grantRuntimePermissionInternal(permName, packageName, false,
Process.SYSTEM_UID, userId, delayingPermCallback);