diff --git a/core/java/android/permission/IPermissionManager.aidl b/core/java/android/permission/IPermissionManager.aidl index 441908dca03fc..b2d911dcdf12d 100644 --- a/core/java/android/permission/IPermissionManager.aidl +++ b/core/java/android/permission/IPermissionManager.aidl @@ -48,10 +48,6 @@ interface IPermissionManager { void updatePermissionFlagsForAllApps(int flagMask, int flagValues, int userId); - int checkPermission(String permName, String pkgName, int userId); - - int checkUidPermission(String permName, int uid); - void addOnPermissionsChangeListener(in IOnPermissionsChangeListener listener); void removeOnPermissionsChangeListener(in IOnPermissionsChangeListener listener); @@ -69,8 +65,6 @@ interface IPermissionManager { void revokeRuntimePermission(String packageName, String permName, int userId, String reason); - void resetRuntimePermissions(); - boolean shouldShowRequestPermissionRationale(String permName, String packageName, int userId); diff --git a/core/java/android/permission/PermissionManager.java b/core/java/android/permission/PermissionManager.java index 705ac1b5138f0..15d236c31e467 100644 --- a/core/java/android/permission/PermissionManager.java +++ b/core/java/android/permission/PermissionManager.java @@ -1236,7 +1236,7 @@ public final class PermissionManager { private static int checkPackageNamePermissionUncached( String permName, String pkgName, @UserIdInt int userId) { try { - return ActivityThread.getPermissionManager().checkPermission( + return ActivityThread.getPackageManager().checkPermission( permName, pkgName, userId); } catch (RemoteException e) { throw e.rethrowFromSystemServer(); diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index 22f4a92f06f70..8231faa85bec2 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -295,7 +295,7 @@ import android.os.storage.StorageManager; import android.os.storage.StorageManagerInternal; import android.os.storage.VolumeInfo; import android.os.storage.VolumeRecord; -import android.permission.IPermissionManager; +import android.permission.PermissionManager; import android.provider.ContactsContract; import android.provider.DeviceConfig; import android.provider.Settings.Global; @@ -962,7 +962,6 @@ public class PackageManagerService extends IPackageManager.Stub private final Singleton mArtManagerServiceProducer; private final Singleton mApexManagerProducer; private final Singleton mViewCompilerProducer; - private final Singleton mPermissionManagerProducer; private final Singleton mIncrementalManagerProducer; private final Singleton mDefaultAppProviderProducer; private final Singleton mDisplayMetricsProducer; @@ -994,7 +993,6 @@ public class PackageManagerService extends IPackageManager.Stub Producer dexManagerProducer, Producer artManagerServiceProducer, Producer apexManagerProducer, - Producer permissionManagerProducer, Producer viewCompilerProducer, Producer incrementalManagerProducer, Producer defaultAppProviderProducer, @@ -1029,7 +1027,6 @@ public class PackageManagerService extends IPackageManager.Stub mDexManagerProducer = new Singleton<>(dexManagerProducer); mArtManagerServiceProducer = new Singleton<>(artManagerServiceProducer); mApexManagerProducer = new Singleton<>(apexManagerProducer); - mPermissionManagerProducer = new Singleton<>(permissionManagerProducer); mViewCompilerProducer = new Singleton<>(viewCompilerProducer); mIncrementalManagerProducer = new Singleton<>(incrementalManagerProducer); mDefaultAppProviderProducer = new Singleton<>(defaultAppProviderProducer); @@ -1131,10 +1128,6 @@ public class PackageManagerService extends IPackageManager.Stub return mViewCompilerProducer.get(this, mPackageManager); } - public IPermissionManager getPermissionManagerService() { - return mPermissionManagerProducer.get(this, mPackageManager); - } - public Handler getBackgroundHandler() { return mBackgroundHandler; } @@ -1260,7 +1253,6 @@ public class PackageManagerService extends IPackageManager.Stub public OverlayConfig overlayConfig; public PackageDexOptimizer packageDexOptimizer; public PackageParser2.Callback packageParserCallback; - public IPermissionManager permissionManagerService; public PendingPackageBroadcasts pendingPackageBroadcasts; public PackageManagerInternal pmInternal; public TestUtilityService testUtilityService; @@ -1381,8 +1373,6 @@ public class PackageManagerService extends IPackageManager.Stub // Internal interface for permission manager private final PermissionManagerServiceInternal mPermissionManager; - // Public interface for permission manager - private final IPermissionManager mPermissionManagerService; private final ComponentResolver mComponentResolver; // List of packages names to keep cached, even if they are uninstalled for all users @@ -2857,7 +2847,6 @@ public class PackageManagerService extends IPackageManager.Stub (i, pm) -> new ArtManagerService(i.getContext(), pm, i.getInstaller(), i.getInstallLock()), (i, pm) -> ApexManager.getInstance(), - (i, pm) -> (IPermissionManager) ServiceManager.getService("permissionmgr"), (i, pm) -> new ViewCompiler(i.getInstallLock(), i.getInstaller()), (i, pm) -> (IncrementalManager) i.getContext().getSystemService(Context.INCREMENTAL_SERVICE), @@ -3080,7 +3069,6 @@ public class PackageManagerService extends IPackageManager.Stub mPackageDexOptimizer = testParams.packageDexOptimizer; mPackageParserCallback = testParams.packageParserCallback; mPendingBroadcasts = testParams.pendingPackageBroadcasts; - mPermissionManagerService = testParams.permissionManagerService; mPmInternal = testParams.pmInternal; mTestUtilityService = testParams.testUtilityService; mProcessLoggingHandler = testParams.processLoggingHandler; @@ -3158,7 +3146,6 @@ public class PackageManagerService extends IPackageManager.Stub mComponentResolver = injector.getComponentResolver(); mPermissionManager = injector.getPermissionManagerServiceInternal(); mSettings = injector.getSettings(); - mPermissionManagerService = injector.getPermissionManagerService(); mIncrementalManager = mInjector.getIncrementalManager(); mDefaultAppProvider = mInjector.getDefaultAppProvider(); mLegacyPermissionManager = mInjector.getLegacyPermissionManagerInternal(); @@ -5176,12 +5163,10 @@ public class PackageManagerService extends IPackageManager.Stub // NOTE: Can't remove due to unsupported app usage @Override public PermissionGroupInfo getPermissionGroupInfo(String groupName, int flags) { - try { - // Because this is accessed via the package manager service AIDL, - // go through the permission manager service AIDL - return mPermissionManagerService.getPermissionGroupInfo(groupName, flags); - } catch (RemoteException ignore) { } - return null; + // Because this is accessed via the package manager service AIDL, + // go through the permission manager service AIDL + return mContext.getSystemService(PermissionManager.class) + .getPermissionGroupInfo(groupName, flags); } @GuardedBy("mLock") @@ -6213,23 +6198,13 @@ public class PackageManagerService extends IPackageManager.Stub // NOTE: Can't remove due to unsupported app usage @Override public int checkPermission(String permName, String pkgName, int userId) { - try { - // Because this is accessed via the package manager service AIDL, - // go through the permission manager service AIDL - return mPermissionManagerService.checkPermission(permName, pkgName, userId); - } catch (RemoteException ignore) { } - return PackageManager.PERMISSION_DENIED; + return mPermissionManager.checkPermission(pkgName, permName, userId); } // NOTE: Can't remove without a major refactor. Keep around for now. @Override public int checkUidPermission(String permName, int uid) { - try { - // Because this is accessed via the package manager service AIDL, - // go through the permission manager service AIDL - return mPermissionManagerService.checkUidPermission(permName, uid); - } catch (RemoteException ignore) { } - return PackageManager.PERMISSION_DENIED; + return mPermissionManager.checkUidPermission(uid, permName); } @Override @@ -6248,43 +6223,34 @@ public class PackageManagerService extends IPackageManager.Stub // NOTE: Can't remove due to unsupported app usage @Override public boolean addPermission(PermissionInfo info) { - try { - // Because this is accessed via the package manager service AIDL, - // go through the permission manager service AIDL - return mPermissionManagerService.addPermission(info, false); - } catch (RemoteException ignore) { } - return false; + // Because this is accessed via the package manager service AIDL, + // go through the permission manager service AIDL + return mContext.getSystemService(PermissionManager.class).addPermission(info, false); } // NOTE: Can't remove due to unsupported app usage @Override public boolean addPermissionAsync(PermissionInfo info) { - try { - // Because this is accessed via the package manager service AIDL, - // go through the permission manager service AIDL - return mPermissionManagerService.addPermission(info, true); - } catch (RemoteException ignore) { } - return false; + // Because this is accessed via the package manager service AIDL, + // go through the permission manager service AIDL + return mContext.getSystemService(PermissionManager.class).addPermission(info, true); } // NOTE: Can't remove due to unsupported app usage @Override public void removePermission(String permName) { - try { - // Because this is accessed via the package manager service AIDL, - // go through the permission manager service AIDL - mPermissionManagerService.removePermission(permName); - } catch (RemoteException ignore) { } + // Because this is accessed via the package manager service AIDL, + // go through the permission manager service AIDL + mContext.getSystemService(PermissionManager.class).removePermission(permName); } // NOTE: Can't remove due to unsupported app usage @Override public void grantRuntimePermission(String packageName, String permName, final int userId) { - try { - // Because this is accessed via the package manager service AIDL, - // go through the permission manager service AIDL - mPermissionManagerService.grantRuntimePermission(packageName, permName, userId); - } catch (RemoteException ignore) { } + // Because this is accessed via the package manager service AIDL, + // go through the permission manager service AIDL + mContext.getSystemService(PermissionManager.class) + .grantRuntimePermission(packageName, permName, UserHandle.of(userId)); } @Override @@ -22521,7 +22487,7 @@ public class PackageManagerService extends IPackageManager.Stub public void onShellCommand(FileDescriptor in, FileDescriptor out, FileDescriptor err, String[] args, ShellCallback callback, ResultReceiver resultReceiver) { - (new PackageManagerShellCommand(this, mPermissionManagerService, mContext)).exec( + (new PackageManagerShellCommand(this, mContext)).exec( this, in, out, err, args, callback, resultReceiver); } diff --git a/services/core/java/com/android/server/pm/PackageManagerShellCommand.java b/services/core/java/com/android/server/pm/PackageManagerShellCommand.java index 2f6756dc01eed..9eae1174fb739 100644 --- a/services/core/java/com/android/server/pm/PackageManagerShellCommand.java +++ b/services/core/java/com/android/server/pm/PackageManagerShellCommand.java @@ -89,7 +89,7 @@ import android.os.UserHandle; import android.os.UserManager; import android.os.incremental.V4Signature; import android.os.storage.StorageManager; -import android.permission.IPermissionManager; +import android.permission.PermissionManager; import android.system.ErrnoException; import android.system.Os; import android.text.TextUtils; @@ -108,6 +108,7 @@ import com.android.server.FgThread; import com.android.server.LocalServices; import com.android.server.SystemConfig; import com.android.server.pm.PackageManagerShellCommandDataLoader.Metadata; +import com.android.server.pm.permission.LegacyPermissionManagerInternal; import dalvik.system.DexFile; @@ -144,7 +145,8 @@ class PackageManagerShellCommand extends ShellCommand { private static final String TAG = "PackageManagerShellCommand"; final IPackageManager mInterface; - final IPermissionManager mPermissionManager; + final LegacyPermissionManagerInternal mLegacyPermissionManager; + final PermissionManager mPermissionManager; final Context mContext; final private WeakHashMap mResourceCache = new WeakHashMap(); @@ -153,10 +155,10 @@ class PackageManagerShellCommand extends ShellCommand { boolean mComponents; int mQueryFlags; - PackageManagerShellCommand( - PackageManagerService service, IPermissionManager permissionManager, Context context) { + PackageManagerShellCommand(PackageManagerService service, Context context) { mInterface = service; - mPermissionManager = permissionManager; + mLegacyPermissionManager = LocalServices.getService(LegacyPermissionManagerInternal.class); + mPermissionManager = context.getSystemService(PermissionManager.class); mContext = context; } @@ -887,8 +889,7 @@ class PackageManagerShellCommand extends ShellCommand { private int runListPermissionGroups() throws RemoteException { final PrintWriter pw = getOutPrintWriter(); - final List pgs = - mPermissionManager.getAllPermissionGroups(0).getList(); + final List pgs = mPermissionManager.getAllPermissionGroups(0); final int count = pgs.size(); for (int p = 0; p < count ; p++) { @@ -935,7 +936,7 @@ class PackageManagerShellCommand extends ShellCommand { final ArrayList groupList = new ArrayList(); if (groups) { final List infos = - mPermissionManager.getAllPermissionGroups(0 /*flags*/).getList(); + mPermissionManager.getAllPermissionGroups(0 /*flags*/); final int count = infos.size(); for (int i = 0; i < count; i++) { groupList.add(infos.get(i).name); @@ -2297,18 +2298,18 @@ class PackageManagerShellCommand extends ShellCommand { getErrPrintWriter().println("Error: no permission specified"); return 1; } - final int translatedUserId = - translateUserId(userId, UserHandle.USER_NULL, "runGrantRevokePermission"); + final UserHandle translatedUser = UserHandle.of(translateUserId(userId, + UserHandle.USER_NULL, "runGrantRevokePermission")); if (grant) { - mPermissionManager.grantRuntimePermission(pkg, perm, translatedUserId); + mPermissionManager.grantRuntimePermission(pkg, perm, translatedUser); } else { - mPermissionManager.revokeRuntimePermission(pkg, perm, translatedUserId, null); + mPermissionManager.revokeRuntimePermission(pkg, perm, translatedUser, null); } return 0; } private int runResetPermissions() throws RemoteException { - mPermissionManager.resetRuntimePermissions(); + mLegacyPermissionManager.resetRuntimePermissions(); return 0; } @@ -3483,7 +3484,7 @@ class PackageManagerShellCommand extends ShellCommand { prefix = " "; } List ps = mPermissionManager - .queryPermissionsByGroup(groupList.get(i), 0 /*flags*/).getList(); + .queryPermissionsByGroup(groupList.get(i), 0 /*flags*/); final int count = ps.size(); boolean first = true; for (int p = 0 ; p < count ; p++) { diff --git a/services/core/java/com/android/server/pm/permission/LegacyPermissionManagerInternal.java b/services/core/java/com/android/server/pm/permission/LegacyPermissionManagerInternal.java index 7ca9f0536de17..446e20b702793 100644 --- a/services/core/java/com/android/server/pm/permission/LegacyPermissionManagerInternal.java +++ b/services/core/java/com/android/server/pm/permission/LegacyPermissionManagerInternal.java @@ -23,6 +23,11 @@ import android.annotation.UserIdInt; * The internal interface for {@link LegacyPermissionManagerService}. */ public interface LegacyPermissionManagerInternal { + /** + * Reset the runtime permission state for all users and packages. + */ + void resetRuntimePermissions(); + /** * Sets the dialer application packages provider. * @param provider The provider. diff --git a/services/core/java/com/android/server/pm/permission/LegacyPermissionManagerService.java b/services/core/java/com/android/server/pm/permission/LegacyPermissionManagerService.java index f453d7460d9df..fd9aa3e07b255 100644 --- a/services/core/java/com/android/server/pm/permission/LegacyPermissionManagerService.java +++ b/services/core/java/com/android/server/pm/permission/LegacyPermissionManagerService.java @@ -22,6 +22,7 @@ import android.app.AppOpsManager; import android.app.admin.DevicePolicyManager; import android.content.Context; import android.content.pm.PackageManager; +import android.content.pm.PackageManagerInternal; import android.os.Binder; import android.os.Process; import android.os.ServiceManager; @@ -32,6 +33,7 @@ import android.util.Log; import com.android.internal.annotations.VisibleForTesting; import com.android.server.LocalServices; import com.android.server.pm.PackageManagerServiceUtils; +import com.android.server.pm.UserManagerService; /** * Legacy permission manager service. @@ -42,6 +44,9 @@ public class LegacyPermissionManagerService extends ILegacyPermissionManager.Stu /** Injector that can be used to facilitate testing. */ private final Injector mInjector; + @NonNull + private final Context mContext; + @NonNull private final DefaultPermissionGrantPolicy mDefaultPermissionGrantPolicy; @@ -74,6 +79,7 @@ public class LegacyPermissionManagerService extends ILegacyPermissionManager.Stu @VisibleForTesting LegacyPermissionManagerService(@NonNull Context context, @NonNull Injector injector) { + mContext = context; mInjector = injector; mDefaultPermissionGrantPolicy = new DefaultPermissionGrantPolicy(context); } @@ -189,6 +195,29 @@ public class LegacyPermissionManagerService extends ILegacyPermissionManager.Stu } private class Internal implements LegacyPermissionManagerInternal { + @Override + public void resetRuntimePermissions() { + mContext.enforceCallingOrSelfPermission( + android.Manifest.permission.REVOKE_RUNTIME_PERMISSIONS, + "revokeRuntimePermission"); + + final int callingUid = Binder.getCallingUid(); + if (callingUid != Process.SYSTEM_UID && callingUid != 0) { + mContext.enforceCallingOrSelfPermission( + android.Manifest.permission.INTERACT_ACROSS_USERS_FULL, + "resetRuntimePermissions"); + } + + final PackageManagerInternal packageManagerInternal = LocalServices.getService( + PackageManagerInternal.class); + final PermissionManagerServiceInternal permissionManagerInternal = + LocalServices.getService(PermissionManagerServiceInternal.class); + for (final int userId : UserManagerService.getInstance().getUserIds()) { + packageManagerInternal.forEachPackage(pkg -> + permissionManagerInternal.resetRuntimePermissions(pkg, userId)); + } + } + @Override public void setDialerAppPackagesProvider(PackagesProvider provider) { mDefaultPermissionGrantPolicy.setDialerAppPackagesProvider(provider); diff --git a/services/core/java/com/android/server/pm/permission/PermissionManagerService.java b/services/core/java/com/android/server/pm/permission/PermissionManagerService.java index 2107536fdb83a..27c838fb422a4 100644 --- a/services/core/java/com/android/server/pm/permission/PermissionManagerService.java +++ b/services/core/java/com/android/server/pm/permission/PermissionManagerService.java @@ -955,8 +955,7 @@ public class PermissionManagerService extends IPermissionManager.Stub { } } - @Override - public int checkPermission(String permName, String pkgName, @UserIdInt int userId) { + private int checkPermission(String permName, String pkgName, @UserIdInt int userId) { // Not using Objects.requireNonNull() here for compatibility reasons. if (permName == null || pkgName == null) { return PackageManager.PERMISSION_DENIED; @@ -1037,8 +1036,7 @@ public class PermissionManagerService extends IPermissionManager.Stub { return true; } - @Override - public int checkUidPermission(String permName, int uid) { + private int checkUidPermission(String permName, int uid) { // Not using Objects.requireNonNull() here for compatibility reasons. if (permName == null) { return PackageManager.PERMISSION_DENIED; @@ -1764,27 +1762,6 @@ public class PermissionManagerService extends IPermissionManager.Stub { return Arrays.asList(packageNames).contains(permissionControllerPackageName); } - @Override - public void resetRuntimePermissions() { - mContext.enforceCallingOrSelfPermission( - android.Manifest.permission.REVOKE_RUNTIME_PERMISSIONS, - "revokeRuntimePermission"); - - final int callingUid = Binder.getCallingUid(); - if (callingUid != Process.SYSTEM_UID && callingUid != 0) { - mContext.enforceCallingOrSelfPermission( - android.Manifest.permission.INTERACT_ACROSS_USERS_FULL, - "resetRuntimePermissions"); - } - - updateAllPermissions( - StorageManager.UUID_PRIVATE_INTERNAL, false, mDefaultPermissionCallback); - for (final int userId : UserManagerService.getInstance().getUserIds()) { - mPackageManagerInt.forEachPackage( - (AndroidPackage pkg) -> resetRuntimePermissionsInternal(pkg, userId)); - } - } - /** * Reverts user permission state changes (permissions and flags). * @@ -4947,6 +4924,18 @@ public class PermissionManagerService extends IPermissionManager.Stub { } private class PermissionManagerServiceInternalImpl implements PermissionManagerServiceInternal { + @Override + public int checkPermission(@NonNull String packageName, @NonNull String permissionName, + @UserIdInt int userId) { + return PermissionManagerService.this.checkPermission(permissionName, packageName, + userId); + } + + @Override + public int checkUidPermission(int uid, @NonNull String permissionName) { + return PermissionManagerService.this.checkUidPermission(permissionName, uid); + } + @Override public void onSystemReady() { PermissionManagerService.this.systemReady(); diff --git a/services/core/java/com/android/server/pm/permission/PermissionManagerServiceInternal.java b/services/core/java/com/android/server/pm/permission/PermissionManagerServiceInternal.java index 1cfae009737ad..0f6de858c5020 100644 --- a/services/core/java/com/android/server/pm/permission/PermissionManagerServiceInternal.java +++ b/services/core/java/com/android/server/pm/permission/PermissionManagerServiceInternal.java @@ -38,6 +38,30 @@ import java.util.Set; */ public interface PermissionManagerServiceInternal extends PermissionManagerInternal, LegacyPermissionDataProvider { + /** + * Check whether a particular package has been granted a particular permission. + * + * @param packageName the name of the package you are checking against + * @param permissionName the name of the permission you are checking for + * @param userId the user ID + * @return {@code PERMISSION_GRANTED} if the permission is granted, or {@code PERMISSION_DENIED} + * otherwise + */ + //@SystemApi(client = SystemApi.Client.SYSTEM_SERVER) + int checkPermission(@NonNull String packageName, @NonNull String permissionName, + @UserIdInt int userId); + + /** + * Check whether a particular UID has been granted a particular permission. + * + * @param uid the UID + * @param permissionName the name of the permission you are checking for + * @return {@code PERMISSION_GRANTED} if the permission is granted, or {@code PERMISSION_DENIED} + * otherwise + */ + //@SystemApi(client = SystemApi.Client.SYSTEM_SERVER) + int checkUidPermission(int uid, @NonNull String permissionName); + /** * Adds a listener for runtime permission state (permissions or flags) changes. * diff --git a/services/tests/mockingservicestests/src/com/android/server/pm/MockSystem.kt b/services/tests/mockingservicestests/src/com/android/server/pm/MockSystem.kt index 015eeadbb4790..c522541b166f5 100644 --- a/services/tests/mockingservicestests/src/com/android/server/pm/MockSystem.kt +++ b/services/tests/mockingservicestests/src/com/android/server/pm/MockSystem.kt @@ -36,7 +36,6 @@ import android.os.SystemProperties import android.os.UserHandle import android.os.UserManager import android.os.incremental.IncrementalManager -import android.permission.IPermissionManager import android.util.ArrayMap import android.util.DisplayMetrics import android.util.EventLog @@ -184,7 +183,6 @@ class MockSystem(withSession: (StaticMockitoSessionBuilder) -> Unit = {}) { val dexManager: DexManager = mock() val installer: Installer = mock() val displayMetrics: DisplayMetrics = mock() - val permissionManager: IPermissionManager = mock() } companion object { @@ -246,7 +244,6 @@ class MockSystem(withSession: (StaticMockitoSessionBuilder) -> Unit = {}) { whenever(mocks.injector.permissionManagerServiceInternal) { mocks.permissionManagerInternal } - whenever(mocks.injector.permissionManagerService).thenReturn(mocks.permissionManager) whenever(mocks.injector.incrementalManager).thenReturn(mocks.incrementalManager) whenever(mocks.injector.compatibility).thenReturn(mocks.platformCompat) whenever(mocks.injector.settings).thenReturn(mocks.settings)