Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Revoke internal permissions upon owner change." into sc-dev am: b8dec4bf2c

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/15615897

Change-Id: Ic3b3bb67e8ce32d383308995c968baa90a908786
This commit is contained in:
TreeHugger Robot
2021-08-31 23:32:50 +00:00
committed by Automerger Merge Worker
parent 1ee344bfd4 b8dec4bf2c
commit e039d85706
2 changed files with 21 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
services/core/java/com/android/server/pm/permission/Permission.java
View File

@@ -480,9 +480,10 @@ public final class Permission {
r.append("DUP:"); r.append("DUP:");
r.append(permissionInfo.name); r.append(permissionInfo.name);
} }
if (permission.isRuntime() && (ownerChanged || wasNonRuntime)) { if ((permission.isInternal() && ownerChanged)
// If this is a runtime permission and the owner has changed, or this wasn't a runtime || (permission.isRuntime() && (ownerChanged || wasNonRuntime))) {
// permission, then permission state should be cleaned up // If this is an internal/runtime permission and the owner has changed, or this wasn't a
// runtime permission, then permission state should be cleaned up.
permission.mDefinitionChanged = true; permission.mDefinitionChanged = true;
} }
if (PackageManagerService.DEBUG_PACKAGE_SCANNING && r != null) { if (PackageManagerService.DEBUG_PACKAGE_SCANNING && r != null) {

25
services/core/java/com/android/server/pm/permission/PermissionManagerService.java
View File

@@ -1654,7 +1654,8 @@ public class PermissionManagerService extends IPermissionManager.Stub {
isRolePermission = permission.isRole(); isRolePermission = permission.isRole();
} }
final boolean mayRevokeRolePermission = isRolePermission final boolean mayRevokeRolePermission = isRolePermission
&& mayManageRolePermission(callingUid); // Allow ourselves to revoke role permissions due to definition changes.
&& (callingUid == Process.myUid() || mayManageRolePermission(callingUid));
final boolean isRuntimePermission; final boolean isRuntimePermission;
synchronized (mLock) { synchronized (mLock) {
@@ -2332,11 +2333,13 @@ public class PermissionManagerService extends IPermissionManager.Stub {
for (int permNum = 0; permNum < numPermissions; permNum++) { for (int permNum = 0; permNum < numPermissions; permNum++) {
final String permName = permissionsToRevoke.get(permNum); final String permName = permissionsToRevoke.get(permNum);
final boolean isInternalPermission;
synchronized (mLock) { synchronized (mLock) {
final Permission bp = mRegistry.getPermission(permName); final Permission bp = mRegistry.getPermission(permName);
if (bp == null || !bp.isRuntime()) { if (bp == null || !(bp.isInternal() || bp.isRuntime())) {
continue; continue;
} }
isInternalPermission = bp.isInternal();
} }
mPackageManagerInt.forEachPackage(pkg -> { mPackageManagerInt.forEachPackage(pkg -> {
final String packageName = pkg.getPackageName(); final String packageName = pkg.getPackageName();
@@ -2356,12 +2359,18 @@ public class PermissionManagerService extends IPermissionManager.Stub {
if (permissionState == PackageManager.PERMISSION_GRANTED if (permissionState == PackageManager.PERMISSION_GRANTED
&& (flags & flagMask) == 0) { && (flags & flagMask) == 0) {
final int uid = UserHandle.getUid(userId, appId); final int uid = UserHandle.getUid(userId, appId);
EventLog.writeEvent(0x534e4554, "154505240", uid, if (isInternalPermission) {
"Revoking permission " + permName + " from package " EventLog.writeEvent(0x534e4554, "195338390", uid,
+ packageName + " due to definition change"); "Revoking permission " + permName + " from package "
EventLog.writeEvent(0x534e4554, "168319670", uid, + packageName + " due to definition change");
"Revoking permission " + permName + " from package " } else {
+ packageName + " due to definition change"); EventLog.writeEvent(0x534e4554, "154505240", uid,
"Revoking permission " + permName + " from package "
+ packageName + " due to definition change");
EventLog.writeEvent(0x534e4554, "168319670", uid,
"Revoking permission " + permName + " from package "
+ packageName + " due to definition change");
}
Slog.e(TAG, "Revoking permission " + permName + " from package " Slog.e(TAG, "Revoking permission " + permName + " from package "
+ packageName + " due to definition change"); + packageName + " due to definition change");
try { try {