Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Allow permissions to be runtime-only." into oc-dev

Browse Source
This commit is contained in:
Chad Brubaker
2017-04-06 16:44:07 +00:00
committed by Android (Google) Code Review
parent e7ec7ec634 a5d70a17eb
commit 941e9e2b38
9 changed files with 32 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
api/current.txt
View File

@@ -10807,6 +10807,7 @@ package android.content.pm {
field public static final int PROTECTION_FLAG_PRE23 = 128; // 0x80
field public static final int PROTECTION_FLAG_PREINSTALLED = 1024; // 0x400
field public static final int PROTECTION_FLAG_PRIVILEGED = 16; // 0x10
field public static final int PROTECTION_FLAG_RUNTIME_ONLY = 8192; // 0x2000
field public static final int PROTECTION_FLAG_SETUP = 2048; // 0x800
field public static final deprecated int PROTECTION_FLAG_SYSTEM = 16; // 0x10
field public static final int PROTECTION_FLAG_VERIFIER = 512; // 0x200

1
api/system-current.txt
View File

@@ -11555,6 +11555,7 @@ package android.content.pm {
field public static final int PROTECTION_FLAG_PRE23 = 128; // 0x80
field public static final int PROTECTION_FLAG_PREINSTALLED = 1024; // 0x400
field public static final int PROTECTION_FLAG_PRIVILEGED = 16; // 0x10
field public static final int PROTECTION_FLAG_RUNTIME_ONLY = 8192; // 0x2000
field public static final int PROTECTION_FLAG_SETUP = 2048; // 0x800
field public static final deprecated int PROTECTION_FLAG_SYSTEM = 16; // 0x10
field public static final int PROTECTION_FLAG_VERIFIER = 512; // 0x200

1
api/test-current.txt
View File

@@ -10847,6 +10847,7 @@ package android.content.pm {
field public static final int PROTECTION_FLAG_PRE23 = 128; // 0x80
field public static final int PROTECTION_FLAG_PREINSTALLED = 1024; // 0x400
field public static final int PROTECTION_FLAG_PRIVILEGED = 16; // 0x10
field public static final int PROTECTION_FLAG_RUNTIME_ONLY = 8192; // 0x2000
field public static final int PROTECTION_FLAG_SETUP = 2048; // 0x800
field public static final deprecated int PROTECTION_FLAG_SYSTEM = 16; // 0x10
field public static final int PROTECTION_FLAG_VERIFIER = 512; // 0x200

1
core/java/android/content/pm/PackageParser.java
View File

@@ -3114,6 +3114,7 @@ public class PackageParser {
if ((perm.info.protectionLevel&PermissionInfo.PROTECTION_MASK_FLAGS) != 0) {
if ( (perm.info.protectionLevel&PermissionInfo.PROTECTION_FLAG_EPHEMERAL) == 0
&& (perm.info.protectionLevel&PermissionInfo.PROTECTION_FLAG_RUNTIME_ONLY) == 0
&& (perm.info.protectionLevel&PermissionInfo.PROTECTION_MASK_BASE) !=
PermissionInfo.PROTECTION_SIGNATURE) {
outError[0] = "<permission> protectionLevel specifies a non-ephemeral flag but is "

10
core/java/android/content/pm/PermissionInfo.java
View File

@@ -130,6 +130,13 @@ public class PermissionInfo extends PackageItemInfo implements Parcelable {
@TestApi
public static final int PROTECTION_FLAG_EPHEMERAL = 0x1000;
/**
* Additional flag for {@link #protectionLevel}, corresponding
* to the <code>runtime</code> value of
* {@link android.R.attr#protectionLevel}.
*/
public static final int PROTECTION_FLAG_RUNTIME_ONLY = 0x2000;
/**
* Mask for {@link #protectionLevel}: the basic protection type.
*/
@@ -250,6 +257,9 @@ public class PermissionInfo extends PackageItemInfo implements Parcelable {
if ((level&PermissionInfo.PROTECTION_FLAG_EPHEMERAL) != 0) {
protLevel += "|ephemeral";
}
if ((level&PermissionInfo.PROTECTION_FLAG_RUNTIME_ONLY) != 0) {
protLevel += "|runtime";
}
return protLevel;
}

2
core/res/AndroidManifest.xml
View File

@@ -914,7 +914,7 @@
android:permissionGroup="android.permission-group.PHONE"
android:label="@string/permlab_answerPhoneCalls"
android:description="@string/permdesc_answerPhoneCalls"
android:protectionLevel="dangerous" />
android:protectionLevel="dangerous|runtime" />
<!-- ====================================================================== -->

4
core/res/res/values/attrs_manifest.xml
View File

@@ -245,6 +245,10 @@
<!-- Additional flag from base permission type: this permission can be granted to ephemeral
apps -->
<flag name="ephemeral" value="0x1000" />
<!-- Additional flag from base permission type: this permission can only be granted to apps
that target runtime permissions ({@link android.os.Build.VERSION_CODES#M} and above)
-->
<flag name="runtime" value="0x2000" />
</attr>
<!-- Flags indicating more context for a permission group. -->

4
services/core/java/com/android/server/pm/BasePermission.java
View File

@@ -98,4 +98,8 @@ final class BasePermission {
public boolean isInstant() {
return (protectionLevel & PermissionInfo.PROTECTION_FLAG_EPHEMERAL) != 0;
}
public boolean isRuntimeOnly() {
return (protectionLevel & PermissionInfo.PROTECTION_FLAG_RUNTIME_ONLY) != 0;
}
}

11
services/core/java/com/android/server/pm/PackageManagerService.java
View File

@@ -2056,6 +2056,7 @@ public class PackageManagerService extends IPackageManager.Stub {
}
if (bp != null && (bp.isRuntime() || bp.isDevelopment())
&& (!instantApp || bp.isInstant())
&& (supportsRuntimePermissions || !bp.isRuntimeOnly())
&& (grantedPermissions == null
|| ArrayUtils.contains(grantedPermissions, permission))) {
final int flags = permissionsState.getPermissionFlags(permission, userId);
@@ -11415,6 +11416,8 @@ public class PackageManagerService extends IPackageManager.Stub {
for (int i=0; i<N; i++) {
final String name = pkg.requestedPermissions.get(i);
final BasePermission bp = mSettings.mPermissions.get(name);
final boolean appSupportsRuntimePermissions = pkg.applicationInfo.targetSdkVersion
>= Build.VERSION_CODES.M;
if (DEBUG_INSTALL) {
Log.i(TAG, "Package " + pkg.packageName + " checking " + name + ": " + bp);
@@ -11436,6 +11439,12 @@ public class PackageManagerService extends IPackageManager.Stub {
continue;
}
if (bp.isRuntimeOnly() && !appSupportsRuntimePermissions) {
Log.i(TAG, "Denying runtime-only permission " + bp.name + " for package "
+ pkg.packageName);
continue;
}
final String perm = bp.name;
boolean allowedSig = false;
int grant = GRANT_DENIED;
@@ -11451,8 +11460,6 @@ public class PackageManagerService extends IPackageManager.Stub {
}
final int level = bp.protectionLevel & PermissionInfo.PROTECTION_MASK_BASE;
final boolean appSupportsRuntimePermissions = pkg.applicationInfo.targetSdkVersion
>= Build.VERSION_CODES.M;
switch (level) {
case PermissionInfo.PROTECTION_NORMAL: {
// For all apps normal permissions are install time ones.