From a2875a1adf6bed98192bbbecb9ce6507d2fe5235 Mon Sep 17 00:00:00 2001 From: Chad Brubaker Date: Tue, 5 Mar 2019 16:40:33 -0800 Subject: [PATCH] Do not call noteOp if checkPermission fails This causes an access to be logged for runtime permissions even if the permission is denied, which is incorrect. Fixes: 127297477 Bug: 116258458 Test: Verified using steps in b/127297477 Change-Id: I8306aa273b7d4dfab40a2a6d8d1ef6f4d8cc2c54 --- .../telephony/LocationAccessPolicy.java | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/telephony/java/android/telephony/LocationAccessPolicy.java b/telephony/java/android/telephony/LocationAccessPolicy.java index d98f37d976dfe..b9d8eb637c346 100644 --- a/telephony/java/android/telephony/LocationAccessPolicy.java +++ b/telephony/java/android/telephony/LocationAccessPolicy.java @@ -174,22 +174,22 @@ public final class LocationAccessPolicy { boolean hasManifestPermission = checkManifestPermission(context, query.callingPid, query.callingUid, permissionToCheck); - int appOpMode = context.getSystemService(AppOpsManager.class) - .noteOpNoThrow(AppOpsManager.permissionToOpCode(permissionToCheck), - query.callingUid, query.callingPackage); - - if (hasManifestPermission && appOpMode == AppOpsManager.MODE_ALLOWED) { - // If the app did everything right, return without logging. - return LocationPermissionResult.ALLOWED; - } - - // If the app has the manifest permission but not the app-op permission, it means that - // it's aware of the requirement and the user denied permission explicitly. If we see - // this, don't let any of the overrides happen. if (hasManifestPermission) { - Log.i(TAG, query.callingPackage + " is aware of " + locationTypeForLog + " but the" - + " app-ops permission is specifically denied."); - return appOpsModeToPermissionResult(appOpMode); + // Only check the app op if the app has the permission. + int appOpMode = context.getSystemService(AppOpsManager.class) + .noteOpNoThrow(AppOpsManager.permissionToOpCode(permissionToCheck), + query.callingUid, query.callingPackage); + if (appOpMode == AppOpsManager.MODE_ALLOWED) { + // If the app did everything right, return without logging. + return LocationPermissionResult.ALLOWED; + } else { + // If the app has the manifest permission but not the app-op permission, it means + // that it's aware of the requirement and the user denied permission explicitly. + // If we see this, don't let any of the overrides happen. + Log.i(TAG, query.callingPackage + " is aware of " + locationTypeForLog + " but the" + + " app-ops permission is specifically denied."); + return appOpsModeToPermissionResult(appOpMode); + } } int minSdkVersion = Manifest.permission.ACCESS_FINE_LOCATION.equals(permissionToCheck)