From a5e348af993a60b6ee8a31119ad5410474f0d4a6 Mon Sep 17 00:00:00 2001
From: Dario Freni <dariofreni@google.com>
Date: Tue, 22 Oct 2019 14:14:00 +0100
Subject: [PATCH] Support privileged apps installed in APEX.

If an APEX contains a priv-app/ directory, and the APEX package itself
is located in a partition for which privileged apps are allowed, then
the APKs under said directory will be included in the initial scan and
made available to the system.

Bug: 138429615
Test: Move PermissionController to com.android.permission APEX. Run
CtsPermissionTestCases and verify that the 16 failures out of 264 tests,
which seem unrelated to PermissionController, happen also on an
unpatched build on head.
Change-Id: If809db5d0a061c1a55aeb7f830c183fa822adca5
---
 .../server/pm/PackageManagerService.java      | 47 ++++++++++---------
 .../java/com/android/server/pm/Settings.java  |  2 +-
 2 files changed, 27 insertions(+), 22 deletions(-)

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 74a85d58c016d..a5d9dbc5e5754 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -751,17 +751,17 @@ public class PackageManagerService extends IPackageManager.Stub
     static final List<SystemPartition> SYSTEM_PARTITIONS = Collections.unmodifiableList(
             Arrays.asList(
                     new SystemPartition(Environment.getRootDirectory(), 0 /* scanFlag */,
-                            true /* hasPriv */, false /* hasOverlays */),
+                            false /* hasOverlays */),
                     new SystemPartition(Environment.getVendorDirectory(), SCAN_AS_VENDOR,
-                            true /* hasPriv */, true /* hasOverlays */),
+                            true /* hasOverlays */),
                     new SystemPartition(Environment.getOdmDirectory(), SCAN_AS_ODM,
-                            true /* hasPriv */, true /* hasOverlays */),
+                            true /* hasOverlays */),
                     new SystemPartition(Environment.getOemDirectory(), SCAN_AS_OEM,
-                            false /* hasPriv */, true /* hasOverlays */),
+                            true /* hasOverlays */),
                     new SystemPartition(Environment.getProductDirectory(), SCAN_AS_PRODUCT,
-                            true /* hasPriv */, true /* hasOverlays */),
+                            true /* hasOverlays */),
                     new SystemPartition(Environment.getSystemExtDirectory(), SCAN_AS_SYSTEM_EXT,
-                            true /* hasPriv */, true /* hasOverlays */)));
+                            true /* hasOverlays */)));
 
     private final List<SystemPartition> mDirsToScanAsSystem;
 
@@ -2427,12 +2427,28 @@ public class PackageManagerService extends IPackageManager.Stub
         @Nullable
         public final File overlayFolder;
 
-        private SystemPartition(File folder, int scanFlag, boolean hasPrivApps,
-                boolean hasOverlays) {
+
+        private static boolean shouldScanPrivApps(@ScanFlags int scanFlags) {
+            if ((scanFlags & SCAN_AS_OEM) != 0) {
+                return false;
+            }
+            if (scanFlags == 0) {  // /system partition
+                return true;
+            }
+            if ((scanFlags
+                    & (SCAN_AS_VENDOR | SCAN_AS_ODM | SCAN_AS_PRODUCT | SCAN_AS_SYSTEM_EXT)) != 0) {
+                return true;
+            }
+            return false;
+        }
+
+        private SystemPartition(File folder, int scanFlag, boolean hasOverlays) {
             this.folder = folder;
             this.scanFlag = scanFlag;
             this.appFolder = toCanonical(new File(folder, "app"));
-            this.privAppFolder = hasPrivApps ? toCanonical(new File(folder, "priv-app")) : null;
+            this.privAppFolder = shouldScanPrivApps(scanFlag)
+                    ? toCanonical(new File(folder, "priv-app"))
+                    : null;
             this.overlayFolder = hasOverlays ? toCanonical(new File(folder, "overlay")) : null;
         }
 
@@ -17790,17 +17806,6 @@ public class PackageManagerService extends IPackageManager.Stub
         }
     }
 
-    static boolean locationIsPrivileged(String path) {
-        // TODO(dariofreni): include APEX partitions when they will support priv apps.
-        for (int i = 0, size = SYSTEM_PARTITIONS.size(); i < size; i++) {
-            SystemPartition partition = SYSTEM_PARTITIONS.get(i);
-            if (partition.containsPrivPath(path)) {
-                return true;
-            }
-        }
-        return false;
-    }
-
     private static @Nullable SystemPartition resolveApexToSystemPartition(
             ApexManager.ActiveApexInfo apexInfo) {
         for (int i = 0, size = SYSTEM_PARTITIONS.size(); i < size; i++) {
@@ -17808,7 +17813,7 @@ public class PackageManagerService extends IPackageManager.Stub
             if (apexInfo.preinstalledApexPath.getAbsolutePath().startsWith(
                     sp.folder.getAbsolutePath())) {
                 return new SystemPartition(apexInfo.apexDirectory, sp.scanFlag,
-                        false /* hasPriv */, false /* hasOverlays */);
+                        false /* hasOverlays */);
             }
         }
         return null;
diff --git a/services/core/java/com/android/server/pm/Settings.java b/services/core/java/com/android/server/pm/Settings.java
index a11ae8ce6f54f..66c77f583c57f 100644
--- a/services/core/java/com/android/server/pm/Settings.java
+++ b/services/core/java/com/android/server/pm/Settings.java
@@ -3513,7 +3513,7 @@ public final class Settings {
         int pkgFlags = 0;
         int pkgPrivateFlags = 0;
         pkgFlags |= ApplicationInfo.FLAG_SYSTEM;
-        if (PackageManagerService.locationIsPrivileged(codePathStr)) {
+        if (codePathStr.contains("/priv-app/")) {
             pkgPrivateFlags |= ApplicationInfo.PRIVATE_FLAG_PRIVILEGED;
         }
         PackageSetting ps = new PackageSetting(name, realName, new File(codePathStr),