Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Filter package visibility in checkExistsAndEnforceCannotModifyImmutablyRestrictedPermission()." into sc-dev am: 4c2c1530bf am: e9d7139c21

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/14390030

Change-Id: Ied06fd4e586d05618754131968797f3dee791912
This commit is contained in:
TreeHugger Robot
2021-08-19 18:30:25 +00:00
committed by Automerger Merge Worker
parent 357d106029 e9d7139c21
commit 543e4d49bf
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
services/core/java/com/android/server/pm/permission/PermissionManagerService.java
View File

@@ -1216,6 +1216,7 @@ public class PermissionManagerService extends IPermissionManager.Stub {
private boolean checkExistsAndEnforceCannotModifyImmutablyRestrictedPermission(
@NonNull String permName) {
final String permissionPackageName;
final boolean isImmutablyRestrictedPermission;
synchronized (mLock) {
final Permission bp = mRegistry.getPermission(permName);
@@ -1223,15 +1224,25 @@ public class PermissionManagerService extends IPermissionManager.Stub {
Slog.w(TAG, "No such permissions: " + permName);
return false;
}
permissionPackageName = bp.getPackageName();
isImmutablyRestrictedPermission = bp.isHardOrSoftRestricted()
&& bp.isImmutablyRestricted();
}
final int callingUid = getCallingUid();
final int callingUserId = UserHandle.getUserId(callingUid);
if (mPackageManagerInt.filterAppAccess(permissionPackageName, callingUid, callingUserId)) {
EventLog.writeEvent(0x534e4554, "186404356", callingUid, permName);
return false;
}
if (isImmutablyRestrictedPermission && mContext.checkCallingOrSelfPermission(
Manifest.permission.WHITELIST_RESTRICTED_PERMISSIONS)
!= PackageManager.PERMISSION_GRANTED) {
throw new SecurityException("Cannot modify allowlisting of an immutably "
+ "restricted permission: " + permName);
}
return true;
}