From 88c2406eb4f30ad788972054f5ac74cc9b682939 Mon Sep 17 00:00:00 2001
From: Hai Zhang <zhanghai@google.com>
Date: Fri, 7 Jul 2023 21:19:03 +0000
Subject: [PATCH] Update signature permissions when package signing is changed.

Fixes: 288515966
Test: KeySetHostTest#testUpgradeDefinerSigPerm{Gained,Lost}
Change-Id: I56f6bd7f6b772c6fcb06e26445df7d30048cd189
---
 .../access/permission/AppIdPermissionPolicy.kt        | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt b/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt
index d39c8a0a11020..aa86cd6323b90 100644
--- a/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt
+++ b/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt
@@ -390,7 +390,14 @@ class AppIdPermissionPolicy : SchemePolicy() {
         packageState: PackageState,
         changedPermissionNames: MutableIndexedSet<String>
     ) {
-        packageState.androidPackage!!.permissions.forEachIndexed { _, parsedPermission ->
+        val androidPackage = packageState.androidPackage!!
+        // This may not be the same package as the old permission because the old permission owner
+        // can be different, hence using this somewhat strange name to prevent misuse.
+        val oldNewPackage = oldState.externalState.packageStates[packageState.packageName]
+            ?.androidPackage
+        val isPackageSigningChanged = oldNewPackage != null &&
+                androidPackage.signingDetails != oldNewPackage.signingDetails
+        androidPackage.permissions.forEachIndexed { _, parsedPermission ->
             val newPermissionInfo = PackageInfoUtils.generatePermissionInfo(
                 parsedPermission, PackageManager.GET_META_DATA.toLong()
             )!!
@@ -520,7 +527,7 @@ class AppIdPermissionPolicy : SchemePolicy() {
                     newPackageName != oldPermission.packageName ||
                     newPermission.protectionLevel != oldPermission.protectionLevel || (
                         oldPermission.isReconciled && (
-                            (
+                            (newPermission.isSignature && isPackageSigningChanged) || (
                                 newPermission.isKnownSigner &&
                                     newPermission.knownCerts != oldPermission.knownCerts
                             ) || (