From 8e8b067e2830022dc7fb02aa94e8611de0157fb8 Mon Sep 17 00:00:00 2001
From: Hai Zhang <zhanghai@google.com>
Date: Fri, 23 Jun 2023 11:54:23 -0700
Subject: [PATCH] Re-evaluate permission state upon known certs change.

Bug: 288515705
Test: PkgInstallSignatureVerificationTest
Change-Id: I7a21dc48e209d0773da4297028d45ce212881b1d
---
 .../access/permission/AppIdPermissionPolicy.kt       | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt b/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt
index b0a964a6570cf..b1369fe68b135 100644
--- a/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt
+++ b/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt
@@ -519,9 +519,15 @@ class AppIdPermissionPolicy : SchemePolicy() {
                 val isPermissionChanged = oldPermission == null ||
                     newPackageName != oldPermission.packageName ||
                     newPermission.protectionLevel != oldPermission.protectionLevel || (
-                        oldPermission.isReconciled && newPermission.isRuntime &&
-                            newPermission.groupName != null &&
-                            newPermission.groupName != oldPermission.groupName
+                        oldPermission.isReconciled && (
+                            (
+                                newPermission.isKnownSigner &&
+                                    newPermission.knownCerts != oldPermission.knownCerts
+                            ) || (
+                                newPermission.isRuntime && newPermission.groupName != null &&
+                                    newPermission.groupName != oldPermission.groupName
+                            )
+                        )
                     )
                 if (isPermissionChanged) {
                     changedPermissionNames += permissionName