From 805b63e253c139625f5a86d72ef7b31d6ec9f8e9 Mon Sep 17 00:00:00 2001
From: Svetoslav <svetoslavganov@google.com>
Date: Thu, 9 Apr 2015 17:28:54 -0700
Subject: [PATCH] Allow only system signed apps to grant permissions at install

bug:20099946

Change-Id: Ifcc5c6638b4174ffb3ba452ae68a5a53b2d1ff0a
---
 core/res/AndroidManifest.xml                           |  6 ++++++
 packages/Shell/AndroidManifest.xml                     |  1 +
 .../com/android/server/pm/PackageInstallerService.java | 10 ++++++++++
 .../com/android/server/pm/PackageManagerService.java   | 10 +++++++++-
 4 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index f427f2bfe3921..fe3842e194170 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -3017,6 +3017,12 @@
         android:description="@string/permdesc_accessVoiceInteractionService"
         android:label="@string/permlab_accessVoiceInteractionService" />
 
+    <!-- Allows an app that has this permission and a permissions to install packages
+         to request all runtime permissions to be granted at installation.
+     @hide -->
+    <permission android:name="android.permission.INSTALL_GRANT_RUNTIME_PERMISSIONS"
+        android:protectionLevel="signature" />
+
     <!-- The system process is explicitly the only one allowed to launch the
          confirmation UI for full backup/restore -->
     <uses-permission android:name="android.permission.CONFIRM_FULL_BACKUP"/>
diff --git a/packages/Shell/AndroidManifest.xml b/packages/Shell/AndroidManifest.xml
index 9d165016e30fe..35e9636f3649f 100644
--- a/packages/Shell/AndroidManifest.xml
+++ b/packages/Shell/AndroidManifest.xml
@@ -93,6 +93,7 @@
     <uses-permission android:name="android.permission.BIND_APPWIDGET" />
     <uses-permission android:name="android.permission.UPDATE_APP_OPS_STATS" />
     <uses-permission android:name="android.permission.MODIFY_APPWIDGET_BIND_PERMISSIONS"/>
+    <uses-permission android:name="android.permission.INSTALL_GRANT_RUNTIME_PERMISSIONS" />
 
     <application android:label="@string/app_label">
         <provider
diff --git a/services/core/java/com/android/server/pm/PackageInstallerService.java b/services/core/java/com/android/server/pm/PackageInstallerService.java
index 591dbee93ef7e..89fa3202cd8e9 100644
--- a/services/core/java/com/android/server/pm/PackageInstallerService.java
+++ b/services/core/java/com/android/server/pm/PackageInstallerService.java
@@ -30,6 +30,7 @@ import static com.android.internal.util.XmlUtils.writeUriAttribute;
 import static org.xmlpull.v1.XmlPullParser.END_DOCUMENT;
 import static org.xmlpull.v1.XmlPullParser.START_TAG;
 
+import android.Manifest;
 import android.app.ActivityManager;
 import android.app.AppGlobals;
 import android.app.AppOpsManager;
@@ -528,6 +529,15 @@ public class PackageInstallerService extends IPackageInstaller.Stub {
             params.installFlags |= PackageManager.INSTALL_REPLACE_EXISTING;
         }
 
+        // Only system components can circumvent runtime permissions when installing.
+        if ((params.installFlags & PackageManager.INSTALL_GRANT_RUNTIME_PERMISSIONS) != 0
+                && mContext.checkCallingOrSelfPermission(Manifest.permission
+                .INSTALL_GRANT_RUNTIME_PERMISSIONS) == PackageManager.PERMISSION_DENIED) {
+            throw new SecurityException("You need the "
+                    + "android.permission.INSTALL_GRANT_RUNTIME_PERMISSIONS permission "
+                    + "to use the PackageManager.INSTALL_GRANT_RUNTIME_PERMISSIONS flag");
+        }
+
         // Defensively resize giant app icons
         if (params.appIcon != null) {
             final ActivityManager am = (ActivityManager) mContext.getSystemService(
diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 80a4351d08dcc..0c2e462fa79db 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -8528,6 +8528,15 @@ public class PackageManagerService extends IPackageManager.Stub {
             user = new UserHandle(userId);
         }
 
+        // Only system components can circumvent runtime permissions when installing.
+        if ((installFlags & PackageManager.INSTALL_GRANT_RUNTIME_PERMISSIONS) != 0
+                && mContext.checkCallingOrSelfPermission(Manifest.permission
+                .INSTALL_GRANT_RUNTIME_PERMISSIONS) == PackageManager.PERMISSION_DENIED) {
+            throw new SecurityException("You need the "
+                    + "android.permission.INSTALL_GRANT_RUNTIME_PERMISSIONS permission "
+                    + "to use the PackageManager.INSTALL_GRANT_RUNTIME_PERMISSIONS flag");
+        }
+
         verificationParams.setInstallerUid(callingUid);
 
         final File originFile = new File(originPath);
@@ -8685,7 +8694,6 @@ public class PackageManagerService extends IPackageManager.Stub {
         long callingId = Binder.clearCallingIdentity();
         try {
             boolean sendAdded = false;
-            Bundle extras = new Bundle(1);
 
             // writer
             synchronized (mPackages) {