Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

DO NOT MERGE Update permissions flags for all users before attempting to

Browse Source 
restore permissions.

bug: 140274903
Test: cts-tradefed run cts-dev -m CtsPermissionTestCases -t android.permission.cts.SplitPermissionTest
on both user 0 and user 10.

Also (running on u10):
$ adb install out/.../CtsAppThatRequestsLocationPermission29.apk
$ adb shell pm grant --user 10 android.permission.cts.appthatrequestpermission android.permission.ACCESS_COARSE_LOCATION
$ adb install out/.../CtsAppThatRequestsLocationPermission28.apk
$ adb shell dumpsys package android.permission.cts.appthatrequestpermission

Verify that ACCESS_BACKGROUND_LOCATION is granted to user 10

Change-Id: I3cd4365ca5abce292a190ca7abca4e4e8fbf61c4
This commit is contained in:
Nicholas Sauer
2019-08-27 08:43:23 -07:00
parent db1bad4ab9
commit df93293342
1 changed files with 105 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
services/core/java/com/android/server/pm/permission/PermissionManagerService.java
View File

@@ -2022,16 +2022,6 @@ public class PermissionManagerService {
return whitelistedPermissions; return whitelistedPermissions;
} }
private void setWhitelistedRestrictedPermissions(@NonNull PackageParser.Package pkg,
@NonNull int[] userIds, @Nullable List<String> permissions, int callingUid,
@PackageManager.PermissionWhitelistFlags int whitelistFlags,
@NonNull PermissionCallback callback) {
for (int userId : userIds) {
setWhitelistedRestrictedPermissionsForUser(pkg, userId, permissions,
callingUid, whitelistFlags, callback);
}
}
private void grantRequestedRuntimePermissionsForUser(PackageParser.Package pkg, int userId, private void grantRequestedRuntimePermissionsForUser(PackageParser.Package pkg, int userId,
String[] grantedPermissions, int callingUid, PermissionCallback callback) { String[] grantedPermissions, int callingUid, PermissionCallback callback) {
PackageSetting ps = (PackageSetting) pkg.mExtras; PackageSetting ps = (PackageSetting) pkg.mExtras;
@@ -2312,20 +2302,22 @@ public class PermissionManagerService {
} }
} }
private void setWhitelistedRestrictedPermissionsForUser(@NonNull PackageParser.Package pkg, private void setWhitelistedRestrictedPermissions(@NonNull PackageParser.Package pkg,
@UserIdInt int userId, @Nullable List<String> permissions, int callingUid, @NonNull int[] userIds, @Nullable List<String> permissions, int callingUid,
@PermissionWhitelistFlags int whitelistFlags, PermissionCallback callback) { @PackageManager.PermissionWhitelistFlags int whitelistFlags,
@NonNull PermissionCallback callback) {
final PackageSetting ps = (PackageSetting) pkg.mExtras; final PackageSetting ps = (PackageSetting) pkg.mExtras;
if (ps == null) { if (ps == null) {
return; return;
} }
final PermissionsState permissionsState = ps.getPermissionsState(); final PermissionsState permissionsState = ps.getPermissionsState();
SparseArray<ArraySet<String>> oldGrantedRestrictedPermissionsByUser = new SparseArray<>();
ArraySet<String> oldGrantedRestrictedPermissions = null;
boolean updatePermissions = false; boolean updatePermissions = false;
final int permissionCount = pkg.requestedPermissions.size(); final int permissionCount = pkg.requestedPermissions.size();
for (int userId : userIds) {
for (int i = 0; i < permissionCount; i++) { for (int i = 0; i < permissionCount; i++) {
final String permissionName = pkg.requestedPermissions.get(i); final String permissionName = pkg.requestedPermissions.get(i);
@@ -2340,10 +2332,10 @@ public class PermissionManagerService {
} }
if (permissionsState.hasPermission(permissionName, userId)) { if (permissionsState.hasPermission(permissionName, userId)) {
if (oldGrantedRestrictedPermissions == null) { if (oldGrantedRestrictedPermissionsByUser.get(userId) == null) {
oldGrantedRestrictedPermissions = new ArraySet<>(); oldGrantedRestrictedPermissionsByUser.put(userId, new ArraySet<>());
} }
oldGrantedRestrictedPermissions.add(permissionName); oldGrantedRestrictedPermissionsByUser.get(userId).add(permissionName);
} }
final int oldFlags = permissionsState.getPermissionFlags(permissionName, userId); final int oldFlags = permissionsState.getPermissionFlags(permissionName, userId);
@@ -2358,27 +2350,36 @@ public class PermissionManagerService {
case FLAG_PERMISSION_WHITELIST_SYSTEM: { case FLAG_PERMISSION_WHITELIST_SYSTEM: {
mask |= PackageManager.FLAG_PERMISSION_RESTRICTION_SYSTEM_EXEMPT; mask |= PackageManager.FLAG_PERMISSION_RESTRICTION_SYSTEM_EXEMPT;
if (permissions != null && permissions.contains(permissionName)) { if (permissions != null && permissions.contains(permissionName)) {
newFlags |= PackageManager.FLAG_PERMISSION_RESTRICTION_SYSTEM_EXEMPT; newFlags |=
PackageManager.FLAG_PERMISSION_RESTRICTION_SYSTEM_EXEMPT;
} else { } else {
newFlags &= ~PackageManager.FLAG_PERMISSION_RESTRICTION_SYSTEM_EXEMPT; newFlags &=
~PackageManager.FLAG_PERMISSION_RESTRICTION_SYSTEM_EXEMPT;
} }
} break; }
break;
case FLAG_PERMISSION_WHITELIST_UPGRADE: { case FLAG_PERMISSION_WHITELIST_UPGRADE: {
mask |= PackageManager.FLAG_PERMISSION_RESTRICTION_UPGRADE_EXEMPT; mask |= PackageManager.FLAG_PERMISSION_RESTRICTION_UPGRADE_EXEMPT;
if (permissions != null && permissions.contains(permissionName)) { if (permissions != null && permissions.contains(permissionName)) {
newFlags |= PackageManager.FLAG_PERMISSION_RESTRICTION_UPGRADE_EXEMPT; newFlags |=
PackageManager.FLAG_PERMISSION_RESTRICTION_UPGRADE_EXEMPT;
} else { } else {
newFlags &= ~PackageManager.FLAG_PERMISSION_RESTRICTION_UPGRADE_EXEMPT; newFlags &=
~PackageManager.FLAG_PERMISSION_RESTRICTION_UPGRADE_EXEMPT;
} }
} break; }
break;
case FLAG_PERMISSION_WHITELIST_INSTALLER: { case FLAG_PERMISSION_WHITELIST_INSTALLER: {
mask |= PackageManager.FLAG_PERMISSION_RESTRICTION_INSTALLER_EXEMPT; mask |= PackageManager.FLAG_PERMISSION_RESTRICTION_INSTALLER_EXEMPT;
if (permissions != null && permissions.contains(permissionName)) { if (permissions != null && permissions.contains(permissionName)) {
newFlags |= PackageManager.FLAG_PERMISSION_RESTRICTION_INSTALLER_EXEMPT; newFlags |=
PackageManager.FLAG_PERMISSION_RESTRICTION_INSTALLER_EXEMPT;
} else { } else {
newFlags &= ~PackageManager.FLAG_PERMISSION_RESTRICTION_INSTALLER_EXEMPT; newFlags &= ~PackageManager
.FLAG_PERMISSION_RESTRICTION_INSTALLER_EXEMPT;
} }
} break; }
break;
} }
} }
@@ -2398,7 +2399,8 @@ public class PermissionManagerService {
// as whitelisting trumps policy i.e. policy cannot grant a non // as whitelisting trumps policy i.e. policy cannot grant a non
// grantable permission. // grantable permission.
if ((oldFlags & PackageManager.FLAG_PERMISSION_POLICY_FIXED) != 0) { if ((oldFlags & PackageManager.FLAG_PERMISSION_POLICY_FIXED) != 0) {
final boolean isGranted = permissionsState.hasPermission(permissionName, userId); final boolean isGranted = permissionsState.hasPermission(permissionName,
userId);
if (!isWhitelisted && isGranted) { if (!isWhitelisted && isGranted) {
mask |= PackageManager.FLAG_PERMISSION_POLICY_FIXED; mask |= PackageManager.FLAG_PERMISSION_POLICY_FIXED;
newFlags &= ~PackageManager.FLAG_PERMISSION_POLICY_FIXED; newFlags &= ~PackageManager.FLAG_PERMISSION_POLICY_FIXED;
@@ -2416,13 +2418,19 @@ public class PermissionManagerService {
updatePermissionFlags(permissionName, pkg.packageName, mask, newFlags, updatePermissionFlags(permissionName, pkg.packageName, mask, newFlags,
callingUid, userId, false, null /*callback*/); callingUid, userId, false, null /*callback*/);
} }
}
if (updatePermissions) { if (updatePermissions) {
// Update permission of this app to take into account the new whitelist state. // Update permission of this app to take into account the new whitelist state.
restorePermissionState(pkg, false, pkg.packageName, callback); restorePermissionState(pkg, false, pkg.packageName, callback);
// If this resulted in losing a permission we need to kill the app. // If this resulted in losing a permission we need to kill the app.
if (oldGrantedRestrictedPermissions != null) { int oldGrantedRestrictedPermissionsByUserCount =
oldGrantedRestrictedPermissionsByUser.size();
for (int j = 0; j < oldGrantedRestrictedPermissionsByUserCount; j++) {
final int userId = oldGrantedRestrictedPermissionsByUser.keyAt(j);
final ArraySet<String> oldGrantedRestrictedPermissions =
oldGrantedRestrictedPermissionsByUser.valueAt(j);
final int oldGrantedCount = oldGrantedRestrictedPermissions.size(); final int oldGrantedCount = oldGrantedRestrictedPermissions.size();
for (int i = 0; i < oldGrantedCount; i++) { for (int i = 0; i < oldGrantedCount; i++) {
final String permission = oldGrantedRestrictedPermissions.valueAt(i); final String permission = oldGrantedRestrictedPermissions.valueAt(i);