From bc6714659d3e4bd11e5b6aad63bdd8ba30ccd537 Mon Sep 17 00:00:00 2001
From: Hui Yu <huiyu@google.com>
Date: Thu, 25 Feb 2021 10:09:11 -0800
Subject: [PATCH] Allow BG-FGS-Launch for role EMERGENCY, SYSTEM_GALLERY and
 SMS.

1. Make permission START_FOREGROUND_SERVICES_FROM_BACKGROUND an "public"
and "role" permission.
2. In PermissionController/res/xml/roles.xml (separate CL), add
<permission
name="android.permission.START_FOREGROUND_SERVICES_FROM_BACKGROUND" />
to these three roles.
2. Need to add
 <uses-permission android:name="android.permission.START_FOREGROUND_SERVICES_FROM_BACKGROUND" />
to EMERGENCY, SYSTEM_GALLERY and SMS app's AndroidManifest.xml file.

Bug: 171305836
Test: 1. "adb shell dumpsys role" to find apps for role EMERGENCY, SYSTEM_GALLERY and SMS are com.google.android.apps.safetyhub, com.google.android.apps.photos and com.google.android.apps.messaging. Add <uses-permission android:name="android.permission.START_FOREGROUND_SERVICES_FROM_BACKGROUND" /> to these apps' AndroidManifest.xml, after app installation,  "adb shell dumpsys package" to check these apps have START_FOREGROUND_SERVICES_FROM_BACKGROUND permission. 2. Manual test, create a test app, assign it SMS role, "dumpsys package" to observe permission START_FOREGROUND_SERVICES_FROM_BACKGROUND is granted to this test app.

Change-Id: I8370f82eba0751dca3079bd190055f5a8466a5ca
---
 core/api/current.txt         | 1 +
 core/api/system-current.txt  | 1 -
 core/res/AndroidManifest.xml | 5 +++--
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/core/api/current.txt b/core/api/current.txt
index 05d7c231824ac..78994c8e823e3 100644
--- a/core/api/current.txt
+++ b/core/api/current.txt
@@ -158,6 +158,7 @@ package android {
     field public static final String SET_WALLPAPER_HINTS = "android.permission.SET_WALLPAPER_HINTS";
     field public static final String SIGNAL_PERSISTENT_PROCESSES = "android.permission.SIGNAL_PERSISTENT_PROCESSES";
     field @Deprecated public static final String SMS_FINANCIAL_TRANSACTIONS = "android.permission.SMS_FINANCIAL_TRANSACTIONS";
+    field public static final String START_FOREGROUND_SERVICES_FROM_BACKGROUND = "android.permission.START_FOREGROUND_SERVICES_FROM_BACKGROUND";
     field public static final String START_VIEW_PERMISSION_USAGE = "android.permission.START_VIEW_PERMISSION_USAGE";
     field public static final String STATUS_BAR = "android.permission.STATUS_BAR";
     field public static final String SYSTEM_ALERT_WINDOW = "android.permission.SYSTEM_ALERT_WINDOW";
diff --git a/core/api/system-current.txt b/core/api/system-current.txt
index bf08723020cdc..699a98525c9f3 100644
--- a/core/api/system-current.txt
+++ b/core/api/system-current.txt
@@ -260,7 +260,6 @@ package android {
     field public static final String SIGNAL_REBOOT_READINESS = "android.permission.SIGNAL_REBOOT_READINESS";
     field public static final String SOUND_TRIGGER_RUN_IN_BATTERY_SAVER = "android.permission.SOUND_TRIGGER_RUN_IN_BATTERY_SAVER";
     field public static final String START_ACTIVITIES_FROM_BACKGROUND = "android.permission.START_ACTIVITIES_FROM_BACKGROUND";
-    field public static final String START_FOREGROUND_SERVICES_FROM_BACKGROUND = "android.permission.START_FOREGROUND_SERVICES_FROM_BACKGROUND";
     field public static final String STATUS_BAR_SERVICE = "android.permission.STATUS_BAR_SERVICE";
     field public static final String STOP_APP_SWITCHES = "android.permission.STOP_APP_SWITCHES";
     field public static final String SUBSTITUTE_NOTIFICATION_APP_NAME = "android.permission.SUBSTITUTE_NOTIFICATION_APP_NAME";
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index 19f1f0327c85f..46cc8ef92ac71 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -2706,9 +2706,10 @@
     <permission android:name="android.permission.START_ACTIVITIES_FROM_BACKGROUND"
         android:protectionLevel="signature|privileged|vendorPrivileged|oem|verifier" />
 
-    <!-- @SystemApi @hide Allows an application to start foreground services from background -->
+    <!-- Allows an application to start foreground services from background, can only be granted to
+         privileged apps or app that is SMS/EMERGENCY/SYSTEM GALLERY roles. -->
     <permission android:name="android.permission.START_FOREGROUND_SERVICES_FROM_BACKGROUND"
-                android:protectionLevel="signature|privileged|vendorPrivileged|oem|verifier" />
+                android:protectionLevel="signature|privileged|vendorPrivileged|oem|verifier|role"/>
 
     <!-- @SystemApi Must be required by activities that handle the intent action
          {@link Intent#ACTION_SEND_SHOW_SUSPENDED_APP_DETAILS}. This is for use by apps that