From 433a58d6afd2f02ceeac3995ee36788a18d1ef9b Mon Sep 17 00:00:00 2001
From: Hai Zhang <zhanghai@google.com>
Date: Tue, 4 Apr 2023 18:46:12 -0700
Subject: [PATCH] Simulate installer denying USE_FULL_SCREEN_INTENT unless
 allowlisted.

Pre-installed (i.e. system) apps are automatically considered
allowlisted.

Note that the change can't be made in PackageInstaller because we need
to know the package name but that's unavailable before the install.

Bug: 277104139
Test: manual
Change-Id: I6c48483cf1681313203269025fbab51f54b8cbf0
---
 core/res/res/values/config.xml                |  3 +++
 core/res/res/values/symbols.xml               |  1 +
 .../PermissionManagerServiceImpl.java         | 21 +++++++++++++++++++
 3 files changed, 25 insertions(+)

diff --git a/core/res/res/values/config.xml b/core/res/res/values/config.xml
index e4d74b5373e0c..9f10ae6066f58 100644
--- a/core/res/res/values/config.xml
+++ b/core/res/res/values/config.xml
@@ -1373,6 +1373,9 @@
     <!-- Number of notifications to keep in the notification service historical archive -->
     <integer name="config_notificationServiceArchiveSize">100</integer>
 
+    <!-- List of packages that will be able to use full screen intent in notifications by default -->
+    <string-array name="config_useFullScreenIntentPackages" translatable="false" />
+
     <!-- Allow the menu hard key to be disabled in LockScreen on some devices -->
     <bool name="config_disableMenuKeyInLockScreen">false</bool>
 
diff --git a/core/res/res/values/symbols.xml b/core/res/res/values/symbols.xml
index c6c1c8f120d75..a823d1fd8ff4c 100644
--- a/core/res/res/values/symbols.xml
+++ b/core/res/res/values/symbols.xml
@@ -2017,6 +2017,7 @@
   <java-symbol type="integer" name="config_notificationsBatteryMediumARGB" />
   <java-symbol type="integer" name="config_notificationsBatteryNearlyFullLevel" />
   <java-symbol type="integer" name="config_notificationServiceArchiveSize" />
+  <java-symbol type="array" name="config_useFullScreenIntentPackages" />
   <java-symbol type="integer" name="config_previousVibrationsDumpLimit" />
   <java-symbol type="integer" name="config_defaultVibrationAmplitude" />
   <java-symbol type="dimen" name="config_hapticChannelMaxVibrationAmplitude" />
diff --git a/services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java b/services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java
index cc2c9adfcba4b..3492b2660c4ad 100644
--- a/services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java
+++ b/services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java
@@ -23,6 +23,7 @@ import static android.Manifest.permission.WRITE_EXTERNAL_STORAGE;
 import static android.app.AppOpsManager.MODE_ALLOWED;
 import static android.app.AppOpsManager.MODE_ERRORED;
 import static android.content.pm.PackageInstaller.SessionParams.PERMISSION_STATE_DEFAULT;
+import static android.content.pm.PackageInstaller.SessionParams.PERMISSION_STATE_DENIED;
 import static android.content.pm.PackageInstaller.SessionParams.PERMISSION_STATE_GRANTED;
 import static android.content.pm.PackageManager.FLAGS_PERMISSION_RESTRICTION_ANY_EXEMPT;
 import static android.content.pm.PackageManager.FLAG_PERMISSION_APPLY_RESTRICTION;
@@ -3655,6 +3656,26 @@ public class PermissionManagerServiceImpl implements PermissionManagerServiceInt
 
         for (String permission : pkg.getRequestedPermissions()) {
             Integer permissionState = permissionStates.get(permission);
+
+            if (Objects.equals(permission, Manifest.permission.USE_FULL_SCREEN_INTENT)
+                    && permissionState == null) {
+                final PackageStateInternal ps;
+                final long token = Binder.clearCallingIdentity();
+                try {
+                    ps = mPackageManagerInt.getPackageStateInternal(pkg.getPackageName());
+                } finally {
+                    Binder.restoreCallingIdentity(token);
+                }
+                final String[] useFullScreenIntentPackageNames =
+                        mContext.getResources().getStringArray(
+                                com.android.internal.R.array.config_useFullScreenIntentPackages);
+                final boolean canUseFullScreenIntent = (ps != null && ps.isSystem())
+                        || ArrayUtils.contains(useFullScreenIntentPackageNames,
+                                pkg.getPackageName());
+                permissionState = canUseFullScreenIntent ? PERMISSION_STATE_GRANTED
+                        : PERMISSION_STATE_DENIED;
+            }
+
             if (permissionState == null || permissionState == PERMISSION_STATE_DEFAULT) {
                 continue;
             }