Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge changes from topics "remove_bg_mic_cam_public", "remove_role_exempt" into sc-dev

Browse Source 
* changes:
  Remove role exempt flag
  Remove background microphone and camera from public api
This commit is contained in:
Evan Severson
2021-02-26 18:09:50 +00:00
committed by Android (Google) Code Review
parent edc573f0ac c5d33bfde2
commit 768cddd98e
10 changed files with 24 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/api/current.txt
View File

@@ -21,7 +21,6 @@ package android {
field public static final String ACTIVITY_RECOGNITION = "android.permission.ACTIVITY_RECOGNITION";
field public static final String ADD_VOICEMAIL = "com.android.voicemail.permission.ADD_VOICEMAIL";
field public static final String ANSWER_PHONE_CALLS = "android.permission.ANSWER_PHONE_CALLS";
field public static final String BACKGROUND_CAMERA = "android.permission.BACKGROUND_CAMERA";
field public static final String BATTERY_STATS = "android.permission.BATTERY_STATS";
field public static final String BIND_ACCESSIBILITY_SERVICE = "android.permission.BIND_ACCESSIBILITY_SERVICE";
field public static final String BIND_APPWIDGET = "android.permission.BIND_APPWIDGET";
@@ -134,7 +133,6 @@ package android {
field public static final String RECEIVE_SMS = "android.permission.RECEIVE_SMS";
field public static final String RECEIVE_WAP_PUSH = "android.permission.RECEIVE_WAP_PUSH";
field public static final String RECORD_AUDIO = "android.permission.RECORD_AUDIO";
field public static final String RECORD_BACKGROUND_AUDIO = "android.permission.RECORD_BACKGROUND_AUDIO";
field public static final String REORDER_TASKS = "android.permission.REORDER_TASKS";
field public static final String REQUEST_COMPANION_PROFILE_WATCH = "android.permission.REQUEST_COMPANION_PROFILE_WATCH";
field public static final String REQUEST_COMPANION_RUN_IN_BACKGROUND = "android.permission.REQUEST_COMPANION_RUN_IN_BACKGROUND";
@@ -12563,7 +12561,6 @@ package android.content.pm {
field public static final String FEATURE_WIFI_DIRECT = "android.hardware.wifi.direct";
field public static final String FEATURE_WIFI_PASSPOINT = "android.hardware.wifi.passpoint";
field public static final String FEATURE_WIFI_RTT = "android.hardware.wifi.rtt";
field public static final int FLAG_PERMISSION_ALLOWLIST_ROLE = 8; // 0x8
field public static final int FLAG_PERMISSION_WHITELIST_INSTALLER = 2; // 0x2
field public static final int FLAG_PERMISSION_WHITELIST_SYSTEM = 1; // 0x1
field public static final int FLAG_PERMISSION_WHITELIST_UPGRADE = 4; // 0x4
@@ -12702,7 +12699,6 @@ package android.content.pm {
field public static final int FLAG_HARD_RESTRICTED = 4; // 0x4
field public static final int FLAG_IMMUTABLY_RESTRICTED = 16; // 0x10
field public static final int FLAG_INSTALLED = 1073741824; // 0x40000000
field public static final int FLAG_INSTALLER_EXEMPT_IGNORED = 32; // 0x20
field public static final int FLAG_SOFT_RESTRICTED = 8; // 0x8
field public static final int PROTECTION_DANGEROUS = 1; // 0x1
field public static final int PROTECTION_FLAG_APPOP = 64; // 0x40

3
core/api/system-current.txt
View File

@@ -27,6 +27,7 @@ package android {
field public static final String ALLOW_ANY_CODEC_FOR_PLAYBACK = "android.permission.ALLOW_ANY_CODEC_FOR_PLAYBACK";
field public static final String AMBIENT_WALLPAPER = "android.permission.AMBIENT_WALLPAPER";
field public static final String APPROVE_INCIDENT_REPORTS = "android.permission.APPROVE_INCIDENT_REPORTS";
field public static final String BACKGROUND_CAMERA = "android.permission.BACKGROUND_CAMERA";
field public static final String BACKUP = "android.permission.BACKUP";
field public static final String BATTERY_PREDICTION = "android.permission.BATTERY_PREDICTION";
field public static final String BIND_ATTENTION_SERVICE = "android.permission.BIND_ATTENTION_SERVICE";
@@ -215,6 +216,7 @@ package android {
field public static final String RECEIVE_DEVICE_CUSTOMIZATION_READY = "android.permission.RECEIVE_DEVICE_CUSTOMIZATION_READY";
field public static final String RECEIVE_EMERGENCY_BROADCAST = "android.permission.RECEIVE_EMERGENCY_BROADCAST";
field public static final String RECEIVE_WIFI_CREDENTIAL_CHANGE = "android.permission.RECEIVE_WIFI_CREDENTIAL_CHANGE";
field public static final String RECORD_BACKGROUND_AUDIO = "android.permission.RECORD_BACKGROUND_AUDIO";
field public static final String RECOVERY = "android.permission.RECOVERY";
field public static final String RECOVER_KEYSTORE = "android.permission.RECOVER_KEYSTORE";
field public static final String REGISTER_CALL_PROVIDER = "android.permission.REGISTER_CALL_PROVIDER";
@@ -2570,7 +2572,6 @@ package android.content.pm {
field public static final int FLAG_PERMISSION_ONE_TIME = 65536; // 0x10000
field public static final int FLAG_PERMISSION_POLICY_FIXED = 4; // 0x4
field public static final int FLAG_PERMISSION_RESTRICTION_INSTALLER_EXEMPT = 2048; // 0x800
field public static final int FLAG_PERMISSION_RESTRICTION_ROLE_EXEMPT = 262144; // 0x40000
field public static final int FLAG_PERMISSION_RESTRICTION_SYSTEM_EXEMPT = 4096; // 0x1000
field public static final int FLAG_PERMISSION_RESTRICTION_UPGRADE_EXEMPT = 8192; // 0x2000
field public static final int FLAG_PERMISSION_REVIEW_REQUIRED = 64; // 0x40

2
core/api/test-current.txt
View File

@@ -5,6 +5,7 @@ package android {
field public static final String ACCESS_NOTIFICATIONS = "android.permission.ACCESS_NOTIFICATIONS";
field public static final String ACTIVITY_EMBEDDING = "android.permission.ACTIVITY_EMBEDDING";
field public static final String APPROVE_INCIDENT_REPORTS = "android.permission.APPROVE_INCIDENT_REPORTS";
field public static final String BACKGROUND_CAMERA = "android.permission.BACKGROUND_CAMERA";
field public static final String BIND_CELL_BROADCAST_SERVICE = "android.permission.BIND_CELL_BROADCAST_SERVICE";
field public static final String BRIGHTNESS_SLIDER_USAGE = "android.permission.BRIGHTNESS_SLIDER_USAGE";
field public static final String BROADCAST_CLOSE_SYSTEM_DIALOGS = "android.permission.BROADCAST_CLOSE_SYSTEM_DIALOGS";
@@ -30,6 +31,7 @@ package android {
field public static final String QUERY_USERS = "android.permission.QUERY_USERS";
field public static final String READ_CELL_BROADCASTS = "android.permission.READ_CELL_BROADCASTS";
field public static final String READ_PRIVILEGED_PHONE_STATE = "android.permission.READ_PRIVILEGED_PHONE_STATE";
field public static final String RECORD_BACKGROUND_AUDIO = "android.permission.RECORD_BACKGROUND_AUDIO";
field public static final String REMOVE_TASKS = "android.permission.REMOVE_TASKS";
field public static final String RESET_APP_ERRORS = "android.permission.RESET_APP_ERRORS";
field public static final String START_TASKS_FROM_RECENTS = "android.permission.START_TASKS_FROM_RECENTS";

35
core/java/android/content/pm/PackageManager.java
View File

@@ -4074,16 +4074,6 @@ public abstract class PackageManager {
@SystemApi
public static final int FLAG_PERMISSION_AUTO_REVOKED = 1 << 17;
/**
* Permission flag: The permission is restricted but the app is exempt
* from the restriction and is allowed to hold this permission in its
* full form and the exemption is provided by the held roles.
*
* @hide
*/
@SystemApi
public static final int FLAG_PERMISSION_RESTRICTION_ROLE_EXEMPT = 1 << 18;
/**
* Permission flag: This location permission is selected as the level of granularity of
* location accuracy.
@@ -4113,8 +4103,7 @@ public abstract class PackageManager {
public static final int FLAGS_PERMISSION_RESTRICTION_ANY_EXEMPT =
FLAG_PERMISSION_RESTRICTION_INSTALLER_EXEMPT
| FLAG_PERMISSION_RESTRICTION_SYSTEM_EXEMPT
| FLAG_PERMISSION_RESTRICTION_UPGRADE_EXEMPT
| FLAG_PERMISSION_RESTRICTION_ROLE_EXEMPT;
| FLAG_PERMISSION_RESTRICTION_UPGRADE_EXEMPT;
/**
* Mask for all permission flags.
@@ -4199,20 +4188,11 @@ public abstract class PackageManager {
*/
public static final int FLAG_PERMISSION_WHITELIST_UPGRADE = 1 << 2;
/**
* Permission allowlist flag: permissions exempted by the system
* when being granted a role.
* Permissions can also be exempted by the installer, the system, or on
* upgrade.
*/
public static final int FLAG_PERMISSION_ALLOWLIST_ROLE = 1 << 3;
/** @hide */
@IntDef(flag = true, prefix = {"FLAG_PERMISSION_WHITELIST_"}, value = {
FLAG_PERMISSION_WHITELIST_SYSTEM,
FLAG_PERMISSION_WHITELIST_INSTALLER,
FLAG_PERMISSION_WHITELIST_UPGRADE,
FLAG_PERMISSION_ALLOWLIST_ROLE
FLAG_PERMISSION_WHITELIST_UPGRADE
})
@Retention(RetentionPolicy.SOURCE)
public @interface PermissionWhitelistFlags {}
@@ -5244,10 +5224,6 @@ public abstract class PackageManager {
* This list corresponds to the {@link #FLAG_PERMISSION_WHITELIST_INSTALLER} flag.
* Can be accessed by pre-installed holders of a dedicated permission or the
* installer on record.
*
* <li>one for cases where the system exempts the permission when granting a role.
* This list corresponds to the {@link #FLAG_PERMISSION_ALLOWLIST_ROLE} flag. Can
* be accessed by pre-installed holders of a dedicated permission.
* </ol>
*
* <p>
@@ -5266,7 +5242,6 @@ public abstract class PackageManager {
* @see #FLAG_PERMISSION_WHITELIST_SYSTEM
* @see #FLAG_PERMISSION_WHITELIST_UPGRADE
* @see #FLAG_PERMISSION_WHITELIST_INSTALLER
* @see #FLAG_PERMISSION_ALLOWLIST_ROLE
*
* @throws SecurityException if you try to access a whitelist that you have no access to.
*/
@@ -5306,10 +5281,6 @@ public abstract class PackageManager {
* This list corresponds to the {@link #FLAG_PERMISSION_WHITELIST_INSTALLER} flag.
* Can be modified by pre-installed holders of a dedicated permission or the installer
* on record.
*
* <li>one for cases where the system exempts the permission when permission when
* granting a role. This list corresponds to the {@link #FLAG_PERMISSION_ALLOWLIST_ROLE}
* flag. Can be modified by pre-installed holders of a dedicated permission.
* </ol>
*
* <p>You need to specify the whitelists for which to set the whitelisted permissions
@@ -5333,7 +5304,6 @@ public abstract class PackageManager {
* @see #FLAG_PERMISSION_WHITELIST_SYSTEM
* @see #FLAG_PERMISSION_WHITELIST_UPGRADE
* @see #FLAG_PERMISSION_WHITELIST_INSTALLER
* @see #FLAG_PERMISSION_ALLOWLIST_ROLE
*
* @throws SecurityException if you try to modify a whitelist that you have no access to.
*/
@@ -5403,7 +5373,6 @@ public abstract class PackageManager {
* @see #FLAG_PERMISSION_WHITELIST_SYSTEM
* @see #FLAG_PERMISSION_WHITELIST_UPGRADE
* @see #FLAG_PERMISSION_WHITELIST_INSTALLER
* @see #FLAG_PERMISSION_ALLOWLIST_ROLE
*
* @throws SecurityException if you try to modify a whitelist that you have no access to.
*/

13
core/java/android/content/pm/PermissionInfo.java
View File

@@ -410,14 +410,6 @@ public class PermissionInfo extends PackageItemInfo implements Parcelable {
*/
public static final int FLAG_IMMUTABLY_RESTRICTED = 1<<4;
/**
* Flag for {@link #flags}, corresponding to <code>installerExemptIgnored</code>
* value of {@link android.R.attr#permissionFlags}.
*
* <p> Modifier for permission restriction. This permission cannot be exempted by the installer.
*/
public static final int FLAG_INSTALLER_EXEMPT_IGNORED = 1 << 5;
/**
* Flag for {@link #flags}, indicating that this permission has been
* installed into the system's globally defined permissions.
@@ -723,11 +715,6 @@ public class PermissionInfo extends PackageItemInfo implements Parcelable {
return isHardRestricted() || isSoftRestricted();
}
/** @hide */
public boolean isInstallerExemptIgnored() {
return (flags & PermissionInfo.FLAG_INSTALLER_EXEMPT_IGNORED) != 0;
}
/** @hide */
public boolean isAppOp() {
return (protectionLevel & PermissionInfo.PROTECTION_FLAG_APPOP) != 0;

15
core/java/android/permission/PermissionManager.java
View File

@@ -485,10 +485,6 @@ public final class PermissionManager {
* One for cases where the installer of the package allowlists a permission. This list
* corresponds to the {@link PackageManager#FLAG_PERMISSION_WHITELIST_INSTALLER} flag. Can be
* accessed by pre-installed holders of a dedicated permission or the installer on record.
* <li>
* One for cases where the system exempts the permission when granting a role. This list
* corresponds to the {@link PackageManager#FLAG_PERMISSION_ALLOWLIST_ROLE} flag. Can be
* accessed by pre-installed holders of a dedicated permission.
* </ol>
*
* @param packageName the app for which to get allowlisted permissions
@@ -502,7 +498,6 @@ public final class PermissionManager {
* @see PackageManager#FLAG_PERMISSION_WHITELIST_SYSTEM
* @see PackageManager#FLAG_PERMISSION_WHITELIST_UPGRADE
* @see PackageManager#FLAG_PERMISSION_WHITELIST_INSTALLER
* @see PackageManager#FLAG_PERMISSION_ALLOWLIST_ROLE
*
* @hide Pending API
*/
@@ -549,10 +544,6 @@ public final class PermissionManager {
* One for cases where the installer of the package allowlists a permission. This list
* corresponds to the {@link PackageManager#FLAG_PERMISSION_WHITELIST_INSTALLER} flag. Can be
* accessed by pre-installed holders of a dedicated permission or the installer on record.
* <li>
* One for cases where the system exempts the permission when granting a role. This list
* corresponds to the {@link PackageManager#FLAG_PERMISSION_ALLOWLIST_ROLE} flag. Can be
* accessed by pre-installed holders of a dedicated permission.
* </ol>
* <p>
* You need to specify the allowlists for which to set the allowlisted permissions which will
@@ -570,7 +561,6 @@ public final class PermissionManager {
* @see PackageManager#FLAG_PERMISSION_WHITELIST_SYSTEM
* @see PackageManager#FLAG_PERMISSION_WHITELIST_UPGRADE
* @see PackageManager#FLAG_PERMISSION_WHITELIST_INSTALLER
* @see PackageManager#FLAG_PERMISSION_ALLOWLIST_ROLE
*
* @hide Pending API
*/
@@ -613,10 +603,6 @@ public final class PermissionManager {
* One for cases where the installer of the package allowlists a permission. This list
* corresponds to the {@link PackageManager#FLAG_PERMISSION_WHITELIST_INSTALLER} flag. Can be
* accessed by pre-installed holders of a dedicated permission or the installer on record.
* <li>
* One for cases where the system exempts the permission when granting a role. This list
* corresponds to the {@link PackageManager#FLAG_PERMISSION_ALLOWLIST_ROLE} flag. Can be
* accessed by pre-installed holders of a dedicated permission.
* </ol>
* <p>
* You need to specify the allowlists for which to set the allowlisted permissions which will
@@ -634,7 +620,6 @@ public final class PermissionManager {
* @see PackageManager#FLAG_PERMISSION_WHITELIST_SYSTEM
* @see PackageManager#FLAG_PERMISSION_WHITELIST_UPGRADE
* @see PackageManager#FLAG_PERMISSION_WHITELIST_INSTALLER
* @see PackageManager#FLAG_PERMISSION_ALLOWLIST_ROLE
*
* @hide Pending API
*/

20
core/res/AndroidManifest.xml
View File

@@ -1284,15 +1284,15 @@
android:backgroundPermission="android.permission.RECORD_BACKGROUND_AUDIO"
android:protectionLevel="dangerous|instant" />
<!-- Allows an application to record audio while in the background.
<p>Protection level: dangerous
-->
<!-- @SystemApi @TestApi Allows an application to record audio while in the background.
This permission is not intended to be held by apps.
<p>Protection level: internal
@hide -->
<permission android:name="android.permission.RECORD_BACKGROUND_AUDIO"
android:permissionGroup="android.permission-group.UNDEFINED"
android:label="@string/permlab_recordBackgroundAudio"
android:description="@string/permdesc_recordBackgroundAudio"
android:permissionFlags="hardRestricted|installerExemptIgnored"
android:protectionLevel="dangerous" />
android:protectionLevel="internal" />
<!-- ====================================================================== -->
<!-- Permissions for activity recognition -->
@@ -1368,15 +1368,15 @@
android:backgroundPermission="android.permission.BACKGROUND_CAMERA"
android:protectionLevel="dangerous|instant" />
<!-- Required to be able to access the camera device in the background.
<p>Protection level: dangerous
-->
<!-- @SystemApi @TestApi Required to be able to access the camera device in the background.
This permission is not intended to be held by apps.
<p>Protection level: internal
@hide -->
<permission android:name="android.permission.BACKGROUND_CAMERA"
android:permissionGroup="android.permission-group.UNDEFINED"
android:label="@string/permlab_backgroundCamera"
android:description="@string/permdesc_backgroundCamera"
android:permissionFlags="hardRestricted|installerExemptIgnored"
android:protectionLevel="dangerous" />
android:protectionLevel="internal" />
<!-- @SystemApi Required in addition to android.permission.CAMERA to be able to access
system only camera devices.

7
services/core/java/com/android/server/pm/permission/DefaultPermissionGrantPolicy.java
View File

@@ -1277,12 +1277,7 @@ final class DefaultPermissionGrantPolicy {
newFlags |= (flags & PackageManager.FLAGS_PERMISSION_RESTRICTION_ANY_EXEMPT);
// If we are allowlisting the permission, update the exempt flag before grant.
// If the permission can't be allowlisted by an installer, skip it here because
// this is where the platform takes the role of the installer for exempting
// preinstalled apps.
if (whitelistRestrictedPermissions && pm.isPermissionRestricted(permission)
&& !pm.getPermissionInfo(permission).isInstallerExemptIgnored()) {
if (whitelistRestrictedPermissions && pm.isPermissionRestricted(permission)) {
pm.updatePermissionFlags(permission, pkg,
PackageManager.FLAG_PERMISSION_RESTRICTION_SYSTEM_EXEMPT,
PackageManager.FLAG_PERMISSION_RESTRICTION_SYSTEM_EXEMPT, user);

4
services/core/java/com/android/server/pm/permission/Permission.java
View File

@@ -239,10 +239,6 @@ public final class Permission {
return (mPermissionInfo.flags & PermissionInfo.FLAG_IMMUTABLY_RESTRICTED) != 0;
}
public boolean isInstallerExemptIgnored() {
return (mPermissionInfo.flags & PermissionInfo.FLAG_INSTALLER_EXEMPT_IGNORED) != 0;
}
public boolean isSignature() {
return (mPermissionInfo.protectionLevel & PermissionInfo.PROTECTION_MASK_BASE)
== PermissionInfo.PROTECTION_SIGNATURE;

36
services/core/java/com/android/server/pm/permission/PermissionManagerService.java
View File

@@ -24,14 +24,12 @@ import static android.app.AppOpsManager.MODE_IGNORED;
import static android.content.pm.ApplicationInfo.AUTO_REVOKE_DISALLOWED;
import static android.content.pm.ApplicationInfo.AUTO_REVOKE_DISCOURAGED;
import static android.content.pm.PackageManager.FLAGS_PERMISSION_RESTRICTION_ANY_EXEMPT;
import static android.content.pm.PackageManager.FLAG_PERMISSION_ALLOWLIST_ROLE;
import static android.content.pm.PackageManager.FLAG_PERMISSION_APPLY_RESTRICTION;
import static android.content.pm.PackageManager.FLAG_PERMISSION_GRANTED_BY_DEFAULT;
import static android.content.pm.PackageManager.FLAG_PERMISSION_GRANTED_BY_ROLE;
import static android.content.pm.PackageManager.FLAG_PERMISSION_ONE_TIME;
import static android.content.pm.PackageManager.FLAG_PERMISSION_POLICY_FIXED;
import static android.content.pm.PackageManager.FLAG_PERMISSION_RESTRICTION_INSTALLER_EXEMPT;
import static android.content.pm.PackageManager.FLAG_PERMISSION_RESTRICTION_ROLE_EXEMPT;
import static android.content.pm.PackageManager.FLAG_PERMISSION_RESTRICTION_SYSTEM_EXEMPT;
import static android.content.pm.PackageManager.FLAG_PERMISSION_RESTRICTION_UPGRADE_EXEMPT;
import static android.content.pm.PackageManager.FLAG_PERMISSION_REVIEW_REQUIRED;
@@ -771,10 +769,6 @@ public class PermissionManagerService extends IPermissionManager.Stub {
isRuntimePermission = bp.isRuntime();
if (bp.isInstallerExemptIgnored()) {
flagValues &= ~FLAG_PERMISSION_RESTRICTION_INSTALLER_EXEMPT;
}
final UidPermissionState uidState = getUidStateLocked(pkg, userId);
if (uidState == null) {
Slog.e(TAG, "Missing permissions state for " + packageName + " and user " + userId);
@@ -1018,8 +1012,7 @@ public class PermissionManagerService extends IPermissionManager.Stub {
Preconditions.checkFlagsArgument(flags,
PackageManager.FLAG_PERMISSION_WHITELIST_UPGRADE
| PackageManager.FLAG_PERMISSION_WHITELIST_SYSTEM
| PackageManager.FLAG_PERMISSION_WHITELIST_INSTALLER
| PackageManager.FLAG_PERMISSION_ALLOWLIST_ROLE);
| PackageManager.FLAG_PERMISSION_WHITELIST_INSTALLER);
Preconditions.checkArgumentNonNegative(userId, null);
if (UserHandle.getCallingUserId() != userId) {
@@ -1043,9 +1036,9 @@ public class PermissionManagerService extends IPermissionManager.Stub {
final boolean isCallerInstallerOnRecord =
mPackageManagerInt.isCallerInstallerOfRecord(pkg, callingUid);
if ((flags & (PackageManager.FLAG_PERMISSION_WHITELIST_SYSTEM
| PackageManager.FLAG_PERMISSION_ALLOWLIST_ROLE)) != 0 && !isCallerPrivileged) {
throw new SecurityException("Querying system or role allowlist requires "
if ((flags & PackageManager.FLAG_PERMISSION_WHITELIST_SYSTEM) != 0
&& !isCallerPrivileged) {
throw new SecurityException("Querying system allowlist requires "
+ Manifest.permission.WHITELIST_RESTRICTED_PERMISSIONS);
}
@@ -1087,9 +1080,6 @@ public class PermissionManagerService extends IPermissionManager.Stub {
if ((flags & PackageManager.FLAG_PERMISSION_WHITELIST_INSTALLER) != 0) {
queryFlags |= FLAG_PERMISSION_RESTRICTION_INSTALLER_EXEMPT;
}
if ((flags & PackageManager.FLAG_PERMISSION_ALLOWLIST_ROLE) != 0) {
queryFlags |= FLAG_PERMISSION_RESTRICTION_ROLE_EXEMPT;
}
ArrayList<String> allowlistedPermissions = null;
@@ -1182,8 +1172,7 @@ public class PermissionManagerService extends IPermissionManager.Stub {
Preconditions.checkFlagsArgument(flags,
PackageManager.FLAG_PERMISSION_WHITELIST_UPGRADE
| PackageManager.FLAG_PERMISSION_WHITELIST_SYSTEM
| PackageManager.FLAG_PERMISSION_WHITELIST_INSTALLER
| PackageManager.FLAG_PERMISSION_ALLOWLIST_ROLE);
| PackageManager.FLAG_PERMISSION_WHITELIST_INSTALLER);
Preconditions.checkArgument(Integer.bitCount(flags) == 1);
Preconditions.checkArgumentNonNegative(userId, null);
@@ -1209,10 +1198,8 @@ public class PermissionManagerService extends IPermissionManager.Stub {
final boolean isCallerInstallerOnRecord =
mPackageManagerInt.isCallerInstallerOfRecord(pkg, callingUid);
if ((flags & (PackageManager.FLAG_PERMISSION_WHITELIST_SYSTEM
| PackageManager.FLAG_PERMISSION_ALLOWLIST_ROLE)) != 0
&& !isCallerPrivileged) {
throw new SecurityException("Modifying system or role allowlist requires "
if ((flags & PackageManager.FLAG_PERMISSION_WHITELIST_SYSTEM) != 0 && !isCallerPrivileged) {
throw new SecurityException("Modifying system allowlist requires "
+ Manifest.permission.WHITELIST_RESTRICTED_PERMISSIONS);
}
@@ -3718,15 +3705,6 @@ public class PermissionManagerService extends IPermissionManager.Stub {
}
}
break;
case FLAG_PERMISSION_ALLOWLIST_ROLE: {
mask |= FLAG_PERMISSION_RESTRICTION_ROLE_EXEMPT;
if (permissions != null && permissions.contains(permissionName)) {
newFlags |= FLAG_PERMISSION_RESTRICTION_ROLE_EXEMPT;
} else {
newFlags &= ~FLAG_PERMISSION_RESTRICTION_ROLE_EXEMPT;
}
}
break;
}
}