From 8e566f33ee1e59ccad771c900b2553d90831d550 Mon Sep 17 00:00:00 2001
From: Joe Onorato <joeo@google.com>
Date: Wed, 23 Oct 2019 17:35:08 -0700
Subject: [PATCH] Add new permission that lets incidentd call dropbox

Bug: 139375147
Test: treehugger
Change-Id: I4eaf167ff9157d9168358ed050e7f8b8ce136097
---
 core/res/AndroidManifest.xml                             | 7 +++++++
 data/etc/platform.xml                                    | 1 +
 .../java/com/android/server/DropBoxManagerService.java   | 9 +++++++++
 3 files changed, 17 insertions(+)

diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index c365aaecb6f95..d33f3731c292f 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -4647,6 +4647,13 @@
                 android:protectionLevel="normal" />
     <uses-permission android:name="android.permission.QUERY_ALL_PACKAGES"/>
 
+    <!-- @hide Allow the caller to collect debugging data from processes that otherwise
+        would require USAGE_STATS. Before sharing this data with other apps, holders
+        of this permission are REQUIRED to themselves check that the caller has
+        PACKAGE_USAGE_STATS and OP_GET_USAGE_STATS. -->
+    <permission android:name="android.permission.PEEK_DROPBOX_DATA"
+        android:protectionLevel="signature|privileged" />
+
     <application android:process="system"
                  android:persistent="true"
                  android:hasCode="false"
diff --git a/data/etc/platform.xml b/data/etc/platform.xml
index dceb243972e22..80098c5a81f55 100644
--- a/data/etc/platform.xml
+++ b/data/etc/platform.xml
@@ -174,6 +174,7 @@
     <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="incidentd" />
     <assign-permission name="android.permission.INTERACT_ACROSS_USERS" uid="incidentd" />
     <assign-permission name="android.permission.REQUEST_INCIDENT_REPORT_APPROVAL" uid="incidentd" />
+    <assign-permission name="android.permission.PEEK_DROPBOX_DATA" uid="incidentd" />
 
     <assign-permission name="android.permission.ACCESS_LOWPAN_STATE" uid="lowpan" />
     <assign-permission name="android.permission.MANAGE_LOWPAN_INTERFACES" uid="lowpan" />
diff --git a/services/core/java/com/android/server/DropBoxManagerService.java b/services/core/java/com/android/server/DropBoxManagerService.java
index aeb3e7fd94de5..7365e78c707fb 100644
--- a/services/core/java/com/android/server/DropBoxManagerService.java
+++ b/services/core/java/com/android/server/DropBoxManagerService.java
@@ -23,6 +23,7 @@ import android.content.ContentResolver;
 import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
+import android.content.pm.PackageManager;
 import android.content.res.Resources;
 import android.database.ContentObserver;
 import android.net.Uri;
@@ -464,6 +465,14 @@ public final class DropBoxManagerService extends SystemService {
     }
 
     private boolean checkPermission(int callingUid, String callingPackage) {
+        // If callers have this permission, then we don't need to check
+        // USAGE_STATS, because they are part of the system and have agreed to
+        // check USAGE_STATS before passing the data along.
+        if (getContext().checkCallingPermission(android.Manifest.permission.PEEK_DROPBOX_DATA)
+                == PackageManager.PERMISSION_GRANTED) {
+            return true;
+        }
+
         // Callers always need this permission
         getContext().enforceCallingOrSelfPermission(
                 android.Manifest.permission.READ_LOGS, TAG);