Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove IPermissionManager usage inside PackageManagerService.

Browse Source 
Because we are moving permission into mainline and AIDL can't be an
API.

Most usages are replaced with calling through PermissionManager
instead.

For checkPermission() and checkUidPermission(), they are not intended
to be exposed as cross-process APIs because people should use
Context.check*Permission() instead. So they are made in-process APIs.

resetRuntimePermissions() is moved to IPackageManager because it is
only used by PackageManagerShellCommand and is implemented by calling
resetRuntimePermissions() in a loop.

Bug: 158736025
Test: presubmit
Change-Id: I8285abddbfb3c4011a8acbc2e2ebfc30715c6f9a
This commit is contained in:
Hai Zhang
2020-12-14 13:15:00 -08:00
parent 226c6ccb96
commit a0d2826aa8
9 changed files with 109 additions and 104 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
core/java/android/permission/IPermissionManager.aidl
View File

@@ -48,10 +48,6 @@ interface IPermissionManager {
void updatePermissionFlagsForAllApps(int flagMask, int flagValues, int userId);
int checkPermission(String permName, String pkgName, int userId);
int checkUidPermission(String permName, int uid);
void addOnPermissionsChangeListener(in IOnPermissionsChangeListener listener);
void removeOnPermissionsChangeListener(in IOnPermissionsChangeListener listener);
@@ -69,8 +65,6 @@ interface IPermissionManager {
void revokeRuntimePermission(String packageName, String permName, int userId, String reason);
void resetRuntimePermissions();
boolean shouldShowRequestPermissionRationale(String permName,
String packageName, int userId);

2
core/java/android/permission/PermissionManager.java
View File

@@ -1218,7 +1218,7 @@ public final class PermissionManager {
private static int checkPackageNamePermissionUncached(
String permName, String pkgName, @UserIdInt int userId) {
try {
return ActivityThread.getPermissionManager().checkPermission(
return ActivityThread.getPackageManager().checkPermission(
permName, pkgName, userId);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();

76
services/core/java/com/android/server/pm/PackageManagerService.java
View File

@@ -295,7 +295,7 @@ import android.os.storage.StorageManager;
import android.os.storage.StorageManagerInternal;
import android.os.storage.VolumeInfo;
import android.os.storage.VolumeRecord;
import android.permission.IPermissionManager;
import android.permission.PermissionManager;
import android.provider.ContactsContract;
import android.provider.DeviceConfig;
import android.provider.Settings.Global;
@@ -962,7 +962,6 @@ public class PackageManagerService extends IPackageManager.Stub
private final Singleton<ArtManagerService> mArtManagerServiceProducer;
private final Singleton<ApexManager> mApexManagerProducer;
private final Singleton<ViewCompiler> mViewCompilerProducer;
private final Singleton<IPermissionManager> mPermissionManagerProducer;
private final Singleton<IncrementalManager> mIncrementalManagerProducer;
private final Singleton<DefaultAppProvider> mDefaultAppProviderProducer;
private final Singleton<DisplayMetrics> mDisplayMetricsProducer;
@@ -994,7 +993,6 @@ public class PackageManagerService extends IPackageManager.Stub
Producer<DexManager> dexManagerProducer,
Producer<ArtManagerService> artManagerServiceProducer,
Producer<ApexManager> apexManagerProducer,
Producer<IPermissionManager> permissionManagerProducer,
Producer<ViewCompiler> viewCompilerProducer,
Producer<IncrementalManager> incrementalManagerProducer,
Producer<DefaultAppProvider> defaultAppProviderProducer,
@@ -1029,7 +1027,6 @@ public class PackageManagerService extends IPackageManager.Stub
mDexManagerProducer = new Singleton<>(dexManagerProducer);
mArtManagerServiceProducer = new Singleton<>(artManagerServiceProducer);
mApexManagerProducer = new Singleton<>(apexManagerProducer);
mPermissionManagerProducer = new Singleton<>(permissionManagerProducer);
mViewCompilerProducer = new Singleton<>(viewCompilerProducer);
mIncrementalManagerProducer = new Singleton<>(incrementalManagerProducer);
mDefaultAppProviderProducer = new Singleton<>(defaultAppProviderProducer);
@@ -1131,10 +1128,6 @@ public class PackageManagerService extends IPackageManager.Stub
return mViewCompilerProducer.get(this, mPackageManager);
}
public IPermissionManager getPermissionManagerService() {
return mPermissionManagerProducer.get(this, mPackageManager);
}
public Handler getBackgroundHandler() {
return mBackgroundHandler;
}
@@ -1260,7 +1253,6 @@ public class PackageManagerService extends IPackageManager.Stub
public OverlayConfig overlayConfig;
public PackageDexOptimizer packageDexOptimizer;
public PackageParser2.Callback packageParserCallback;
public IPermissionManager permissionManagerService;
public PendingPackageBroadcasts pendingPackageBroadcasts;
public PackageManagerInternal pmInternal;
public TestUtilityService testUtilityService;
@@ -1381,8 +1373,6 @@ public class PackageManagerService extends IPackageManager.Stub
// Internal interface for permission manager
private final PermissionManagerServiceInternal mPermissionManager;
// Public interface for permission manager
private final IPermissionManager mPermissionManagerService;
private final ComponentResolver mComponentResolver;
// List of packages names to keep cached, even if they are uninstalled for all users
@@ -2857,7 +2847,6 @@ public class PackageManagerService extends IPackageManager.Stub
(i, pm) -> new ArtManagerService(i.getContext(), pm, i.getInstaller(),
i.getInstallLock()),
(i, pm) -> ApexManager.getInstance(),
(i, pm) -> (IPermissionManager) ServiceManager.getService("permissionmgr"),
(i, pm) -> new ViewCompiler(i.getInstallLock(), i.getInstaller()),
(i, pm) -> (IncrementalManager)
i.getContext().getSystemService(Context.INCREMENTAL_SERVICE),
@@ -3080,7 +3069,6 @@ public class PackageManagerService extends IPackageManager.Stub
mPackageDexOptimizer = testParams.packageDexOptimizer;
mPackageParserCallback = testParams.packageParserCallback;
mPendingBroadcasts = testParams.pendingPackageBroadcasts;
mPermissionManagerService = testParams.permissionManagerService;
mPmInternal = testParams.pmInternal;
mTestUtilityService = testParams.testUtilityService;
mProcessLoggingHandler = testParams.processLoggingHandler;
@@ -3158,7 +3146,6 @@ public class PackageManagerService extends IPackageManager.Stub
mComponentResolver = injector.getComponentResolver();
mPermissionManager = injector.getPermissionManagerServiceInternal();
mSettings = injector.getSettings();
mPermissionManagerService = injector.getPermissionManagerService();
mIncrementalManager = mInjector.getIncrementalManager();
mDefaultAppProvider = mInjector.getDefaultAppProvider();
mLegacyPermissionManager = mInjector.getLegacyPermissionManagerInternal();
@@ -5176,12 +5163,10 @@ public class PackageManagerService extends IPackageManager.Stub
// NOTE: Can't remove due to unsupported app usage
@Override
public PermissionGroupInfo getPermissionGroupInfo(String groupName, int flags) {
try {
// Because this is accessed via the package manager service AIDL,
// go through the permission manager service AIDL
return mPermissionManagerService.getPermissionGroupInfo(groupName, flags);
} catch (RemoteException ignore) { }
return null;
// Because this is accessed via the package manager service AIDL,
// go through the permission manager service AIDL
return mContext.getSystemService(PermissionManager.class)
.getPermissionGroupInfo(groupName, flags);
}
@GuardedBy("mLock")
@@ -6213,23 +6198,13 @@ public class PackageManagerService extends IPackageManager.Stub
// NOTE: Can't remove due to unsupported app usage
@Override
public int checkPermission(String permName, String pkgName, int userId) {
try {
// Because this is accessed via the package manager service AIDL,
// go through the permission manager service AIDL
return mPermissionManagerService.checkPermission(permName, pkgName, userId);
} catch (RemoteException ignore) { }
return PackageManager.PERMISSION_DENIED;
return mPermissionManager.checkPermission(pkgName, permName, userId);
}
// NOTE: Can't remove without a major refactor. Keep around for now.
@Override
public int checkUidPermission(String permName, int uid) {
try {
// Because this is accessed via the package manager service AIDL,
// go through the permission manager service AIDL
return mPermissionManagerService.checkUidPermission(permName, uid);
} catch (RemoteException ignore) { }
return PackageManager.PERMISSION_DENIED;
return mPermissionManager.checkUidPermission(uid, permName);
}
@Override
@@ -6248,43 +6223,34 @@ public class PackageManagerService extends IPackageManager.Stub
// NOTE: Can't remove due to unsupported app usage
@Override
public boolean addPermission(PermissionInfo info) {
try {
// Because this is accessed via the package manager service AIDL,
// go through the permission manager service AIDL
return mPermissionManagerService.addPermission(info, false);
} catch (RemoteException ignore) { }
return false;
// Because this is accessed via the package manager service AIDL,
// go through the permission manager service AIDL
return mContext.getSystemService(PermissionManager.class).addPermission(info, false);
}
// NOTE: Can't remove due to unsupported app usage
@Override
public boolean addPermissionAsync(PermissionInfo info) {
try {
// Because this is accessed via the package manager service AIDL,
// go through the permission manager service AIDL
return mPermissionManagerService.addPermission(info, true);
} catch (RemoteException ignore) { }
return false;
// Because this is accessed via the package manager service AIDL,
// go through the permission manager service AIDL
return mContext.getSystemService(PermissionManager.class).addPermission(info, true);
}
// NOTE: Can't remove due to unsupported app usage
@Override
public void removePermission(String permName) {
try {
// Because this is accessed via the package manager service AIDL,
// go through the permission manager service AIDL
mPermissionManagerService.removePermission(permName);
} catch (RemoteException ignore) { }
// Because this is accessed via the package manager service AIDL,
// go through the permission manager service AIDL
mContext.getSystemService(PermissionManager.class).removePermission(permName);
}
// NOTE: Can't remove due to unsupported app usage
@Override
public void grantRuntimePermission(String packageName, String permName, final int userId) {
try {
// Because this is accessed via the package manager service AIDL,
// go through the permission manager service AIDL
mPermissionManagerService.grantRuntimePermission(packageName, permName, userId);
} catch (RemoteException ignore) { }
// Because this is accessed via the package manager service AIDL,
// go through the permission manager service AIDL
mContext.getSystemService(PermissionManager.class)
.grantRuntimePermission(packageName, permName, UserHandle.of(userId));
}
@Override
@@ -22521,7 +22487,7 @@ public class PackageManagerService extends IPackageManager.Stub
public void onShellCommand(FileDescriptor in, FileDescriptor out,
FileDescriptor err, String[] args, ShellCallback callback,
ResultReceiver resultReceiver) {
(new PackageManagerShellCommand(this, mPermissionManagerService, mContext)).exec(
(new PackageManagerShellCommand(this, mContext)).exec(
this, in, out, err, args, callback, resultReceiver);
}

29
services/core/java/com/android/server/pm/PackageManagerShellCommand.java
View File

@@ -89,7 +89,7 @@ import android.os.UserHandle;
import android.os.UserManager;
import android.os.incremental.V4Signature;
import android.os.storage.StorageManager;
import android.permission.IPermissionManager;
import android.permission.PermissionManager;
import android.system.ErrnoException;
import android.system.Os;
import android.text.TextUtils;
@@ -108,6 +108,7 @@ import com.android.server.FgThread;
import com.android.server.LocalServices;
import com.android.server.SystemConfig;
import com.android.server.pm.PackageManagerShellCommandDataLoader.Metadata;
import com.android.server.pm.permission.LegacyPermissionManagerInternal;
import dalvik.system.DexFile;
@@ -144,7 +145,8 @@ class PackageManagerShellCommand extends ShellCommand {
private static final String TAG = "PackageManagerShellCommand";
final IPackageManager mInterface;
final IPermissionManager mPermissionManager;
final LegacyPermissionManagerInternal mLegacyPermissionManager;
final PermissionManager mPermissionManager;
final Context mContext;
final private WeakHashMap<String, Resources> mResourceCache =
new WeakHashMap<String, Resources>();
@@ -153,10 +155,10 @@ class PackageManagerShellCommand extends ShellCommand {
boolean mComponents;
int mQueryFlags;
PackageManagerShellCommand(
PackageManagerService service, IPermissionManager permissionManager, Context context) {
PackageManagerShellCommand(PackageManagerService service, Context context) {
mInterface = service;
mPermissionManager = permissionManager;
mLegacyPermissionManager = LocalServices.getService(LegacyPermissionManagerInternal.class);
mPermissionManager = context.getSystemService(PermissionManager.class);
mContext = context;
}
@@ -887,8 +889,7 @@ class PackageManagerShellCommand extends ShellCommand {
private int runListPermissionGroups() throws RemoteException {
final PrintWriter pw = getOutPrintWriter();
final List<PermissionGroupInfo> pgs =
mPermissionManager.getAllPermissionGroups(0).getList();
final List<PermissionGroupInfo> pgs = mPermissionManager.getAllPermissionGroups(0);
final int count = pgs.size();
for (int p = 0; p < count ; p++) {
@@ -935,7 +936,7 @@ class PackageManagerShellCommand extends ShellCommand {
final ArrayList<String> groupList = new ArrayList<String>();
if (groups) {
final List<PermissionGroupInfo> infos =
mPermissionManager.getAllPermissionGroups(0 /*flags*/).getList();
mPermissionManager.getAllPermissionGroups(0 /*flags*/);
final int count = infos.size();
for (int i = 0; i < count; i++) {
groupList.add(infos.get(i).name);
@@ -2297,18 +2298,18 @@ class PackageManagerShellCommand extends ShellCommand {
getErrPrintWriter().println("Error: no permission specified");
return 1;
}
final int translatedUserId =
translateUserId(userId, UserHandle.USER_NULL, "runGrantRevokePermission");
final UserHandle translatedUser = UserHandle.of(translateUserId(userId,
UserHandle.USER_NULL, "runGrantRevokePermission"));
if (grant) {
mPermissionManager.grantRuntimePermission(pkg, perm, translatedUserId);
mPermissionManager.grantRuntimePermission(pkg, perm, translatedUser);
} else {
mPermissionManager.revokeRuntimePermission(pkg, perm, translatedUserId, null);
mPermissionManager.revokeRuntimePermission(pkg, perm, translatedUser, null);
}
return 0;
}
private int runResetPermissions() throws RemoteException {
mPermissionManager.resetRuntimePermissions();
mLegacyPermissionManager.resetRuntimePermissions();
return 0;
}
@@ -3483,7 +3484,7 @@ class PackageManagerShellCommand extends ShellCommand {
prefix = " ";
}
List<PermissionInfo> ps = mPermissionManager
.queryPermissionsByGroup(groupList.get(i), 0 /*flags*/).getList();
.queryPermissionsByGroup(groupList.get(i), 0 /*flags*/);
final int count = ps.size();
boolean first = true;
for (int p = 0 ; p < count ; p++) {

5
services/core/java/com/android/server/pm/permission/LegacyPermissionManagerInternal.java
View File

@@ -23,6 +23,11 @@ import android.annotation.UserIdInt;
* The internal interface for {@link LegacyPermissionManagerService}.
*/
public interface LegacyPermissionManagerInternal {
/**
* Reset the runtime permission state for all users and packages.
*/
void resetRuntimePermissions();
/**
* Sets the dialer application packages provider.
* @param provider The provider.

29
services/core/java/com/android/server/pm/permission/LegacyPermissionManagerService.java
View File

@@ -22,6 +22,7 @@ import android.app.AppOpsManager;
import android.app.admin.DevicePolicyManager;
import android.content.Context;
import android.content.pm.PackageManager;
import android.content.pm.PackageManagerInternal;
import android.os.Binder;
import android.os.Process;
import android.os.ServiceManager;
@@ -32,6 +33,7 @@ import android.util.Log;
import com.android.internal.annotations.VisibleForTesting;
import com.android.server.LocalServices;
import com.android.server.pm.PackageManagerServiceUtils;
import com.android.server.pm.UserManagerService;
/**
* Legacy permission manager service.
@@ -42,6 +44,9 @@ public class LegacyPermissionManagerService extends ILegacyPermissionManager.Stu
/** Injector that can be used to facilitate testing. */
private final Injector mInjector;
@NonNull
private final Context mContext;
@NonNull
private final DefaultPermissionGrantPolicy mDefaultPermissionGrantPolicy;
@@ -74,6 +79,7 @@ public class LegacyPermissionManagerService extends ILegacyPermissionManager.Stu
@VisibleForTesting
LegacyPermissionManagerService(@NonNull Context context, @NonNull Injector injector) {
mContext = context;
mInjector = injector;
mDefaultPermissionGrantPolicy = new DefaultPermissionGrantPolicy(context);
}
@@ -189,6 +195,29 @@ public class LegacyPermissionManagerService extends ILegacyPermissionManager.Stu
}
private class Internal implements LegacyPermissionManagerInternal {
@Override
public void resetRuntimePermissions() {
mContext.enforceCallingOrSelfPermission(
android.Manifest.permission.REVOKE_RUNTIME_PERMISSIONS,
"revokeRuntimePermission");
final int callingUid = Binder.getCallingUid();
if (callingUid != Process.SYSTEM_UID && callingUid != 0) {
mContext.enforceCallingOrSelfPermission(
android.Manifest.permission.INTERACT_ACROSS_USERS_FULL,
"resetRuntimePermissions");
}
final PackageManagerInternal packageManagerInternal = LocalServices.getService(
PackageManagerInternal.class);
final PermissionManagerServiceInternal permissionManagerInternal =
LocalServices.getService(PermissionManagerServiceInternal.class);
for (final int userId : UserManagerService.getInstance().getUserIds()) {
packageManagerInternal.forEachPackage(pkg ->
permissionManagerInternal.resetRuntimePermissions(pkg, userId));
}
}
@Override
public void setDialerAppPackagesProvider(PackagesProvider provider) {
mDefaultPermissionGrantPolicy.setDialerAppPackagesProvider(provider);

39
services/core/java/com/android/server/pm/permission/PermissionManagerService.java
View File

@@ -955,8 +955,7 @@ public class PermissionManagerService extends IPermissionManager.Stub {
}
}
@Override
public int checkPermission(String permName, String pkgName, @UserIdInt int userId) {
private int checkPermission(String permName, String pkgName, @UserIdInt int userId) {
// Not using Objects.requireNonNull() here for compatibility reasons.
if (permName == null || pkgName == null) {
return PackageManager.PERMISSION_DENIED;
@@ -1037,8 +1036,7 @@ public class PermissionManagerService extends IPermissionManager.Stub {
return true;
}
@Override
public int checkUidPermission(String permName, int uid) {
private int checkUidPermission(String permName, int uid) {
// Not using Objects.requireNonNull() here for compatibility reasons.
if (permName == null) {
return PackageManager.PERMISSION_DENIED;
@@ -1764,27 +1762,6 @@ public class PermissionManagerService extends IPermissionManager.Stub {
return Arrays.asList(packageNames).contains(permissionControllerPackageName);
}
@Override
public void resetRuntimePermissions() {
mContext.enforceCallingOrSelfPermission(
android.Manifest.permission.REVOKE_RUNTIME_PERMISSIONS,
"revokeRuntimePermission");
final int callingUid = Binder.getCallingUid();
if (callingUid != Process.SYSTEM_UID && callingUid != 0) {
mContext.enforceCallingOrSelfPermission(
android.Manifest.permission.INTERACT_ACROSS_USERS_FULL,
"resetRuntimePermissions");
}
updateAllPermissions(
StorageManager.UUID_PRIVATE_INTERNAL, false, mDefaultPermissionCallback);
for (final int userId : UserManagerService.getInstance().getUserIds()) {
mPackageManagerInt.forEachPackage(
(AndroidPackage pkg) -> resetRuntimePermissionsInternal(pkg, userId));
}
}
/**
* Reverts user permission state changes (permissions and flags).
*
@@ -4947,6 +4924,18 @@ public class PermissionManagerService extends IPermissionManager.Stub {
}
private class PermissionManagerServiceInternalImpl implements PermissionManagerServiceInternal {
@Override
public int checkPermission(@NonNull String packageName, @NonNull String permissionName,
@UserIdInt int userId) {
return PermissionManagerService.this.checkPermission(permissionName, packageName,
userId);
}
@Override
public int checkUidPermission(int uid, @NonNull String permissionName) {
return PermissionManagerService.this.checkUidPermission(permissionName, uid);
}
@Override
public void onSystemReady() {
PermissionManagerService.this.systemReady();

24
services/core/java/com/android/server/pm/permission/PermissionManagerServiceInternal.java
View File

@@ -38,6 +38,30 @@ import java.util.Set;
*/
public interface PermissionManagerServiceInternal extends PermissionManagerInternal,
LegacyPermissionDataProvider {
/**
* Check whether a particular package has been granted a particular permission.
*
* @param packageName the name of the package you are checking against
* @param permissionName the name of the permission you are checking for
* @param userId the user ID
* @return {@code PERMISSION_GRANTED} if the permission is granted, or {@code PERMISSION_DENIED}
* otherwise
*/
//@SystemApi(client = SystemApi.Client.SYSTEM_SERVER)
int checkPermission(@NonNull String packageName, @NonNull String permissionName,
@UserIdInt int userId);
/**
* Check whether a particular UID has been granted a particular permission.
*
* @param uid the UID
* @param permissionName the name of the permission you are checking for
* @return {@code PERMISSION_GRANTED} if the permission is granted, or {@code PERMISSION_DENIED}
* otherwise
*/
//@SystemApi(client = SystemApi.Client.SYSTEM_SERVER)
int checkUidPermission(int uid, @NonNull String permissionName);
/**
* Adds a listener for runtime permission state (permissions or flags) changes.
*

3
services/tests/mockingservicestests/src/com/android/server/pm/MockSystem.kt
View File

@@ -36,7 +36,6 @@ import android.os.SystemProperties
import android.os.UserHandle
import android.os.UserManager
import android.os.incremental.IncrementalManager
import android.permission.IPermissionManager
import android.util.ArrayMap
import android.util.DisplayMetrics
import android.util.EventLog
@@ -184,7 +183,6 @@ class MockSystem(withSession: (StaticMockitoSessionBuilder) -> Unit = {}) {
val dexManager: DexManager = mock()
val installer: Installer = mock()
val displayMetrics: DisplayMetrics = mock()
val permissionManager: IPermissionManager = mock()
}
companion object {
@@ -246,7 +244,6 @@ class MockSystem(withSession: (StaticMockitoSessionBuilder) -> Unit = {}) {
whenever(mocks.injector.permissionManagerServiceInternal) {
mocks.permissionManagerInternal
}
whenever(mocks.injector.permissionManagerService).thenReturn(mocks.permissionManager)
whenever(mocks.injector.incrementalManager).thenReturn(mocks.incrementalManager)
whenever(mocks.injector.compatibility).thenReturn(mocks.platformCompat)
whenever(mocks.injector.settings).thenReturn(mocks.settings)