From bc3a5111d1026f1a959df581da0d53c597041f59 Mon Sep 17 00:00:00 2001
From: Martijn Coenen <maco@google.com>
Date: Tue, 11 Feb 2020 12:21:24 +0100
Subject: [PATCH] Give installers/DownloadManager/MTP correct GIDs.

On devices without sdcardfs, these classes of apps get the right storage
access by being a part of the correct group.

Bug: 146419093
Test: manually verify apps get the correct GID
Change-Id: I7021cbf8a2e84bda7a49519da36e84fcf3f479a8
---
 core/java/android/os/Process.java                  | 14 ++++++++++++++
 .../java/com/android/server/am/ProcessList.java    | 12 ++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/core/java/android/os/Process.java b/core/java/android/os/Process.java
index 8d09461560449..dbe3b7bd17945 100644
--- a/core/java/android/os/Process.java
+++ b/core/java/android/os/Process.java
@@ -214,6 +214,20 @@ public class Process {
      */
     public static final int FSVERITY_CERT_UID = 1075;
 
+    /**
+     * GID that gives write access to app-private data directories on external
+     * storage (used on devices without sdcardfs only).
+     * @hide
+     */
+    public static final int EXT_DATA_RW_GID = 1078;
+
+    /**
+     * GID that gives write access to app-private OBB directories on external
+     * storage (used on devices without sdcardfs only).
+     * @hide
+     */
+    public static final int EXT_OBB_RW_GID = 1079;
+
     /** {@hide} */
     public static final int NOBODY_UID = 9999;
 
diff --git a/services/core/java/com/android/server/am/ProcessList.java b/services/core/java/com/android/server/am/ProcessList.java
index dcada89bb04a8..abe0dd543debd 100644
--- a/services/core/java/com/android/server/am/ProcessList.java
+++ b/services/core/java/com/android/server/am/ProcessList.java
@@ -1577,7 +1577,19 @@ public final class ProcessList {
             // For DownloadProviders and MTP: To grant access to /sdcard/Android/
             // And a special case for the FUSE daemon since it runs an MTP server and should have
             // access to Android/
+            // Note that we must add in the user id, because sdcardfs synthesizes this permission
+            // based on the user
             gidList.add(UserHandle.getUid(UserHandle.getUserId(uid), Process.SDCARD_RW_GID));
+
+            // For devices without sdcardfs, these GIDs are needed instead; note that we
+            // consciously don't add the user_id in the GID, since these apps are anyway
+            // isolated to only their own user
+            gidList.add(Process.EXT_DATA_RW_GID);
+            gidList.add(Process.EXT_OBB_RW_GID);
+        }
+        if (mountExternal == Zygote.MOUNT_EXTERNAL_INSTALLER) {
+            // For devices without sdcardfs, this GID is needed to allow installers access to OBBs
+            gidList.add(Process.EXT_OBB_RW_GID);
         }
         if (mountExternal == Zygote.MOUNT_EXTERNAL_PASS_THROUGH) {
             // For the FUSE daemon: To grant access to the lower filesystem.