Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't remove permission when cleaning up orphaned tree on uninstall

Browse Source 
This is fixing a security bug in a relatively safe way. Fundamentally
this situation shouldn't be happening. It's an artifact of the way that
the manifest parsing is loose with types. We can consider a more
thorough and upstream fix for upcoming OS releases, but for impact risk
mitigation this is a relatively constrained change.

Bug: 225880325
Test: Tests are included for the more thorough fix.
Change-Id: I86801109ce2d9c2750c6dfef4bb0425df0ab135e
This commit is contained in:
Joe Castro
2022-10-27 00:17:32 +00:00
parent 23f2e0ec96
commit d8572e2747
1 changed files with 0 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java
View File

@@ -4245,7 +4245,6 @@ public class PermissionManagerServiceImpl implements PermissionManagerServiceInt
} }
boolean changed = false; boolean changed = false;
Set<Permission> needsUpdate = null;
synchronized (mLock) { synchronized (mLock) {
final Iterator<Permission> it = mRegistry.getPermissionTrees().iterator(); final Iterator<Permission> it = mRegistry.getPermissionTrees().iterator();
while (it.hasNext()) { while (it.hasNext()) {
@@ -4264,26 +4263,6 @@ public class PermissionManagerServiceImpl implements PermissionManagerServiceInt
+ " that used to be declared by " + bp.getPackageName()); + " that used to be declared by " + bp.getPackageName());
it.remove(); it.remove();
} }
if (needsUpdate == null) {
needsUpdate = new ArraySet<>();
}
needsUpdate.add(bp);
}
}
if (needsUpdate != null) {
for (final Permission bp : needsUpdate) {
final AndroidPackage sourcePkg =
mPackageManagerInt.getPackage(bp.getPackageName());
final PackageStateInternal sourcePs =
mPackageManagerInt.getPackageStateInternal(bp.getPackageName());
synchronized (mLock) {
if (sourcePkg != null && sourcePs != null) {
continue;
}
Slog.w(TAG, "Removing dangling permission tree: " + bp.getName()
+ " from package " + bp.getPackageName());
mRegistry.removePermission(bp.getName());
}
} }
} }
return changed; return changed;