Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revoke internal permissions upon owner change.

Browse Source 
Similar to runtime permissions.

Bug: 195338390
Test: manual
Change-Id: I4f35ef021629810ea8854de2582c57b899b46db0
This commit is contained in:
Hai Zhang
2021-08-18 21:41:48 +00:00
parent c1dfb44dd1
commit ce576f8f68
2 changed files with 21 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
services/core/java/com/android/server/pm/permission/Permission.java
View File

@@ -480,9 +480,10 @@ public final class Permission {
r.append("DUP:");
r.append(permissionInfo.name);
}
if (permission.isRuntime() && (ownerChanged || wasNonRuntime)) {
// If this is a runtime permission and the owner has changed, or this wasn't a runtime
// permission, then permission state should be cleaned up
if ((permission.isInternal() && ownerChanged)
|| (permission.isRuntime() && (ownerChanged || wasNonRuntime))) {
// If this is an internal/runtime permission and the owner has changed, or this wasn't a
// runtime permission, then permission state should be cleaned up.
permission.mDefinitionChanged = true;
}
if (PackageManagerService.DEBUG_PACKAGE_SCANNING && r != null) {

25
services/core/java/com/android/server/pm/permission/PermissionManagerService.java
View File

@@ -1643,7 +1643,8 @@ public class PermissionManagerService extends IPermissionManager.Stub {
isRolePermission = permission.isRole();
}
final boolean mayRevokeRolePermission = isRolePermission
&& mayManageRolePermission(callingUid);
// Allow ourselves to revoke role permissions due to definition changes.
&& (callingUid == Process.myUid() || mayManageRolePermission(callingUid));
final boolean isRuntimePermission;
synchronized (mLock) {
@@ -2321,11 +2322,13 @@ public class PermissionManagerService extends IPermissionManager.Stub {
for (int permNum = 0; permNum < numPermissions; permNum++) {
final String permName = permissionsToRevoke.get(permNum);
final boolean isInternalPermission;
synchronized (mLock) {
final Permission bp = mRegistry.getPermission(permName);
if (bp == null || !bp.isRuntime()) {
if (bp == null || !(bp.isInternal() || bp.isRuntime())) {
continue;
}
isInternalPermission = bp.isInternal();
}
mPackageManagerInt.forEachPackage(pkg -> {
final String packageName = pkg.getPackageName();
@@ -2345,12 +2348,18 @@ public class PermissionManagerService extends IPermissionManager.Stub {
if (permissionState == PackageManager.PERMISSION_GRANTED
&& (flags & flagMask) == 0) {
final int uid = UserHandle.getUid(userId, appId);
EventLog.writeEvent(0x534e4554, "154505240", uid,
"Revoking permission " + permName + " from package "
+ packageName + " due to definition change");
EventLog.writeEvent(0x534e4554, "168319670", uid,
"Revoking permission " + permName + " from package "
+ packageName + " due to definition change");
if (isInternalPermission) {
EventLog.writeEvent(0x534e4554, "195338390", uid,
"Revoking permission " + permName + " from package "
+ packageName + " due to definition change");
} else {
EventLog.writeEvent(0x534e4554, "154505240", uid,
"Revoking permission " + permName + " from package "
+ packageName + " due to definition change");
EventLog.writeEvent(0x534e4554, "168319670", uid,
"Revoking permission " + permName + " from package "
+ packageName + " due to definition change");
}
Slog.e(TAG, "Revoking permission " + permName + " from package "
+ packageName + " due to definition change");
try {