From 3d3b22a1f7b18a597bebd919aeab18d210a6ba0b Mon Sep 17 00:00:00 2001
From: Ben Gruver <bgruv@google.com>
Date: Tue, 2 Nov 2021 15:18:54 -0700
Subject: [PATCH] Add an App Protection Service role

This is a new, exclusive role for a system app that is able to access
application behavior data in order to detect potentially harmful behavior.

Currently, this role will have access to historical app ops via the new
GET_HISTORICAL_APP_OPS_STATS permission.

Security review: b/196982126

Bug: 204929538
Test: manual build and install
Change-Id: I9bd4cfcfed0419b5136a08d314c65572519af3db
---
 core/api/system-current.txt    | 1 +
 core/res/res/values/config.xml | 2 ++
 core/res/res/values/public.xml | 2 ++
 3 files changed, 5 insertions(+)

diff --git a/core/api/system-current.txt b/core/api/system-current.txt
index 49e44f4038fd1..62f4651d80aea 100755
--- a/core/api/system-current.txt
+++ b/core/api/system-current.txt
@@ -387,6 +387,7 @@ package android {
     field public static final int config_helpPackageNameValue = 17039388; // 0x104001c
     field public static final int config_systemActivityRecognizer = 17039416; // 0x1040038
     field public static final int config_systemAmbientAudioIntelligence = 17039411; // 0x1040033
+    field public static final int config_systemAppProtectionService;
     field public static final int config_systemAudioIntelligence = 17039412; // 0x1040034
     field public static final int config_systemAutomotiveCluster = 17039400; // 0x1040028
     field public static final int config_systemAutomotiveProjection = 17039401; // 0x1040029
diff --git a/core/res/res/values/config.xml b/core/res/res/values/config.xml
index 53ed0ec496d46..765be3b8291bb 100644
--- a/core/res/res/values/config.xml
+++ b/core/res/res/values/config.xml
@@ -2066,6 +2066,8 @@
     <string name="config_systemTelevisionRemoteService" translatable="false">@string/config_tvRemoteServicePackage</string>
     <!-- The name of the package that will hold the device management role -->
     <string name="config_deviceManager" translatable="false"></string>
+    <!-- The name of the package that will hold the app protection service role. -->
+    <string name="config_systemAppProtectionService" translatable="false"></string>
 
     <!-- The name of the package that will be allowed to change its components' label/icon. -->
     <string name="config_overrideComponentUiPackage" translatable="false">com.android.stk</string>
diff --git a/core/res/res/values/public.xml b/core/res/res/values/public.xml
index a2dadb9999243..f9375f76a4f3b 100644
--- a/core/res/res/values/public.xml
+++ b/core/res/res/values/public.xml
@@ -3322,6 +3322,8 @@
     <public name="config_systemSupervision" />
     <!-- @hide @SystemApi -->
     <public name="config_deviceManager" />
+    <!-- @hide @SystemApi -->
+    <public name="config_systemAppProtectionService" />
   </staging-public-group>
 
   <staging-public-group type="dimen" first-id="0x01db0000">