From d8572e2747720856ae33bbdf96a15b01981d0720 Mon Sep 17 00:00:00 2001
From: Joe Castro <joecastro@google.com>
Date: Thu, 27 Oct 2022 00:17:32 +0000
Subject: [PATCH] Don't remove permission when cleaning up orphaned tree on
 uninstall

This is fixing a security bug in a relatively safe way. Fundamentally
this situation shouldn't be happening. It's an artifact of the way that
the manifest parsing is loose with types. We can consider a more
thorough and upstream fix for upcoming OS releases, but for impact risk
mitigation this is a relatively constrained change.

Bug: 225880325
Test: Tests are included for the more thorough fix.
Change-Id: I86801109ce2d9c2750c6dfef4bb0425df0ab135e
---
 .../PermissionManagerServiceImpl.java         | 21 -------------------
 1 file changed, 21 deletions(-)

diff --git a/services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java b/services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java
index 799ef41f30671..ab223ef3cbeb9 100644
--- a/services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java
+++ b/services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java
@@ -4245,7 +4245,6 @@ public class PermissionManagerServiceImpl implements PermissionManagerServiceInt
         }
         boolean changed = false;
 
-        Set<Permission> needsUpdate = null;
         synchronized (mLock) {
             final Iterator<Permission> it = mRegistry.getPermissionTrees().iterator();
             while (it.hasNext()) {
@@ -4264,26 +4263,6 @@ public class PermissionManagerServiceImpl implements PermissionManagerServiceInt
                             + " that used to be declared by " + bp.getPackageName());
                     it.remove();
                 }
-                if (needsUpdate == null) {
-                    needsUpdate = new ArraySet<>();
-                }
-                needsUpdate.add(bp);
-            }
-        }
-        if (needsUpdate != null) {
-            for (final Permission bp : needsUpdate) {
-                final AndroidPackage sourcePkg =
-                        mPackageManagerInt.getPackage(bp.getPackageName());
-                final PackageStateInternal sourcePs =
-                        mPackageManagerInt.getPackageStateInternal(bp.getPackageName());
-                synchronized (mLock) {
-                    if (sourcePkg != null && sourcePs != null) {
-                        continue;
-                    }
-                    Slog.w(TAG, "Removing dangling permission tree: " + bp.getName()
-                            + " from package " + bp.getPackageName());
-                    mRegistry.removePermission(bp.getName());
-                }
             }
         }
         return changed;