Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge changes I6f314a65,I8020f029 into sc-dev

Browse Source 
* changes:
  Properly fix allowlisting restricted permissions for secondary users on app upgrade.
  Revert "Fix allowlisting restricted permissions for secondary users on app"
This commit is contained in:
TreeHugger Robot
2021-07-15 03:16:15 +00:00
committed by Android (Google) Code Review
parent e0c972a2be 160508ed0a
commit e5c0de0d2e
2 changed files with 68 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
services/core/java/com/android/server/pm/PackageManagerService.java
View File

@@ -7955,12 +7955,9 @@ public class PackageManagerService extends IPackageManager.Stub
} catch (PackageManagerException e) { } catch (PackageManagerException e) {
Slog.w(TAG, "updateAllSharedLibrariesLPw failed: ", e); Slog.w(TAG, "updateAllSharedLibrariesLPw failed: ", e);
} }
final int[] userIds = mUserManager.getUserIds(); mPermissionManager.onPackageInstalled(pkg,
for (final int userId : userIds) { PermissionManagerServiceInternal.PackageInstalledParams.DEFAULT,
mPermissionManager.onPackageInstalled(pkg, UserHandle.USER_ALL);
PermissionManagerServiceInternal.PackageInstalledParams.DEFAULT,
userId);
}
writeSettingsLPrTEMP(); writeSettingsLPrTEMP();
} }
} catch (PackageManagerException e) { } catch (PackageManagerException e) {
@@ -19213,12 +19210,7 @@ public class PackageManagerService extends IPackageManager.Stub
} }
final int autoRevokePermissionsMode = installArgs.autoRevokePermissionsMode; final int autoRevokePermissionsMode = installArgs.autoRevokePermissionsMode;
permissionParamsBuilder.setAutoRevokePermissionsMode(autoRevokePermissionsMode); permissionParamsBuilder.setAutoRevokePermissionsMode(autoRevokePermissionsMode);
for (int currentUserId : allUsersList) { mPermissionManager.onPackageInstalled(pkg, permissionParamsBuilder.build(), userId);
if (ps.getInstalled(currentUserId)) {
mPermissionManager.onPackageInstalled(pkg, permissionParamsBuilder.build(),
currentUserId);
}
}
} }
res.name = pkgName; res.name = pkgName;
res.uid = pkg.getUid(); res.uid = pkg.getUid();
@@ -21862,10 +21854,8 @@ public class PackageManagerService extends IPackageManager.Stub
if (sharedUserPkgs == null) { if (sharedUserPkgs == null) {
sharedUserPkgs = Collections.emptyList(); sharedUserPkgs = Collections.emptyList();
} }
for (final int userId : allUserHandles) { mPermissionManager.onPackageUninstalled(packageName, deletedPs.appId,
mPermissionManager.onPackageUninstalled(packageName, deletedPs.appId, deletedPs.pkg, sharedUserPkgs, UserHandle.USER_ALL);
deletedPs.pkg, sharedUserPkgs, userId);
}
} }
clearPackagePreferredActivitiesLPw( clearPackagePreferredActivitiesLPw(
deletedPs.name, changedUsers, UserHandle.USER_ALL); deletedPs.name, changedUsers, UserHandle.USER_ALL);
@@ -22082,11 +22072,12 @@ public class PackageManagerService extends IPackageManager.Stub
} }
} }
// The method below will take care of removing obsolete permissions and granting
// install permissions.
mPermissionManager.onPackageInstalled(pkg,
PermissionManagerServiceInternal.PackageInstalledParams.DEFAULT,
UserHandle.USER_ALL);
for (final int userId : allUserHandles) { for (final int userId : allUserHandles) {
// The method below will take care of removing obsolete permissions and granting
// install permissions.
mPermissionManager.onPackageInstalled(pkg,
PermissionManagerServiceInternal.PackageInstalledParams.DEFAULT, userId);
if (applyUserRestrictions) { if (applyUserRestrictions) {
mSettings.writePermissionStateForUserLPr(userId, false); mSettings.writePermissionStateForUserLPr(userId, false);
} }
@@ -22409,10 +22400,9 @@ public class PackageManagerService extends IPackageManager.Stub
} }
removeKeystoreDataIfNeeded(mInjector.getUserManagerInternal(), nextUserId, ps.appId); removeKeystoreDataIfNeeded(mInjector.getUserManagerInternal(), nextUserId, ps.appId);
clearPackagePreferredActivities(ps.name, nextUserId); clearPackagePreferredActivities(ps.name, nextUserId);
mPermissionManager.onPackageUninstalled(ps.name, ps.appId, pkg, sharedUserPkgs,
nextUserId);
mDomainVerificationManager.clearPackageForUser(ps.name, nextUserId); mDomainVerificationManager.clearPackageForUser(ps.name, nextUserId);
} }
mPermissionManager.onPackageUninstalled(ps.name, ps.appId, pkg, sharedUserPkgs, userId);
if (outInfo != null) { if (outInfo != null) {
if ((flags & PackageManager.DELETE_KEEP_DATA) == 0) { if ((flags & PackageManager.DELETE_KEEP_DATA) == 0) {

104
services/core/java/com/android/server/pm/permission/PermissionManagerService.java
View File

@@ -4040,17 +4040,14 @@ public class PermissionManagerService extends IPermissionManager.Stub {
* *
* @param packageName The package that is updated * @param packageName The package that is updated
* @param pkg The package that is updated, or {@code null} if package is deleted * @param pkg The package that is updated, or {@code null} if package is deleted
* @param filterUserId If not {@link UserHandle.USER_ALL}, only restore the permission state for
* this particular user
*/ */
private void updatePermissions(@NonNull String packageName, @Nullable AndroidPackage pkg, private void updatePermissions(@NonNull String packageName, @Nullable AndroidPackage pkg) {
@UserIdInt int filterUserId) {
// If the package is being deleted, update the permissions of all the apps // If the package is being deleted, update the permissions of all the apps
final int flags = final int flags =
(pkg == null ? UPDATE_PERMISSIONS_ALL | UPDATE_PERMISSIONS_REPLACE_PKG (pkg == null ? UPDATE_PERMISSIONS_ALL | UPDATE_PERMISSIONS_REPLACE_PKG
: UPDATE_PERMISSIONS_REPLACE_PKG); : UPDATE_PERMISSIONS_REPLACE_PKG);
updatePermissions(packageName, pkg, getVolumeUuidForPackage(pkg), flags, updatePermissions(
mDefaultPermissionCallback, filterUserId); packageName, pkg, getVolumeUuidForPackage(pkg), flags, mDefaultPermissionCallback);
} }
/** /**
@@ -4072,8 +4069,7 @@ public class PermissionManagerService extends IPermissionManager.Stub {
(fingerprintChanged (fingerprintChanged
? UPDATE_PERMISSIONS_REPLACE_PKG | UPDATE_PERMISSIONS_REPLACE_ALL ? UPDATE_PERMISSIONS_REPLACE_PKG | UPDATE_PERMISSIONS_REPLACE_ALL
: 0); : 0);
updatePermissions(null, null, volumeUuid, flags, mDefaultPermissionCallback, updatePermissions(null, null, volumeUuid, flags, mDefaultPermissionCallback);
UserHandle.USER_ALL);
} finally { } finally {
PackageManager.uncorkPackageInfoCache(); PackageManager.uncorkPackageInfoCache();
} }
@@ -4122,14 +4118,12 @@ public class PermissionManagerService extends IPermissionManager.Stub {
* all volumes * all volumes
* @param flags Control permission for which apps should be updated * @param flags Control permission for which apps should be updated
* @param callback Callback to call after permission changes * @param callback Callback to call after permission changes
* @param filterUserId If not {@link UserHandle.USER_ALL}, only restore the permission state for
* this particular user
*/ */
private void updatePermissions(final @Nullable String changingPkgName, private void updatePermissions(final @Nullable String changingPkgName,
final @Nullable AndroidPackage changingPkg, final @Nullable AndroidPackage changingPkg,
final @Nullable String replaceVolumeUuid, final @Nullable String replaceVolumeUuid,
@UpdatePermissionFlags int flags, @UpdatePermissionFlags int flags,
final @Nullable PermissionCallback callback, @UserIdInt int filterUserId) { final @Nullable PermissionCallback callback) {
// TODO: Most of the methods exposing BasePermission internals [source package name, // TODO: Most of the methods exposing BasePermission internals [source package name,
// etc..] shouldn't be needed. Instead, when we've parsed a permission that doesn't // etc..] shouldn't be needed. Instead, when we've parsed a permission that doesn't
// have package settings, we should make note of it elsewhere [map between // have package settings, we should make note of it elsewhere [map between
@@ -4165,7 +4159,8 @@ public class PermissionManagerService extends IPermissionManager.Stub {
// Only replace for packages on requested volume // Only replace for packages on requested volume
final String volumeUuid = getVolumeUuidForPackage(pkg); final String volumeUuid = getVolumeUuidForPackage(pkg);
final boolean replace = replaceAll && Objects.equals(replaceVolumeUuid, volumeUuid); final boolean replace = replaceAll && Objects.equals(replaceVolumeUuid, volumeUuid);
restorePermissionState(pkg, replace, changingPkgName, callback, filterUserId); restorePermissionState(pkg, replace, changingPkgName, callback,
UserHandle.USER_ALL);
}); });
} }
@@ -4174,7 +4169,8 @@ public class PermissionManagerService extends IPermissionManager.Stub {
final String volumeUuid = getVolumeUuidForPackage(changingPkg); final String volumeUuid = getVolumeUuidForPackage(changingPkg);
final boolean replace = ((flags & UPDATE_PERMISSIONS_REPLACE_PKG) != 0) final boolean replace = ((flags & UPDATE_PERMISSIONS_REPLACE_PKG) != 0)
&& Objects.equals(replaceVolumeUuid, volumeUuid); && Objects.equals(replaceVolumeUuid, volumeUuid);
restorePermissionState(changingPkg, replace, changingPkgName, callback, filterUserId); restorePermissionState(changingPkg, replace, changingPkgName, callback,
UserHandle.USER_ALL);
} }
Trace.traceEnd(TRACE_TAG_PACKAGE_MANAGER); Trace.traceEnd(TRACE_TAG_PACKAGE_MANAGER);
} }
@@ -4841,18 +4837,20 @@ public class PermissionManagerService extends IPermissionManager.Stub {
private void onPackageInstalledInternal(@NonNull AndroidPackage pkg, private void onPackageInstalledInternal(@NonNull AndroidPackage pkg,
@NonNull PermissionManagerServiceInternal.PackageInstalledParams params, @NonNull PermissionManagerServiceInternal.PackageInstalledParams params,
@UserIdInt int userId) { @UserIdInt int[] userIds) {
updatePermissions(pkg.getPackageName(), pkg, userId); updatePermissions(pkg.getPackageName(), pkg);
addAllowlistedRestrictedPermissionsInternal(pkg, for (final int userId : userIds) {
params.getAllowlistedRestrictedPermissions(), addAllowlistedRestrictedPermissionsInternal(pkg,
FLAG_PERMISSION_WHITELIST_INSTALLER, userId); params.getAllowlistedRestrictedPermissions(),
final int autoRevokePermissionsMode = params.getAutoRevokePermissionsMode(); FLAG_PERMISSION_WHITELIST_INSTALLER, userId);
if (autoRevokePermissionsMode == AppOpsManager.MODE_ALLOWED final int autoRevokePermissionsMode = params.getAutoRevokePermissionsMode();
|| autoRevokePermissionsMode == AppOpsManager.MODE_IGNORED) { if (autoRevokePermissionsMode == AppOpsManager.MODE_ALLOWED
setAutoRevokeExemptedInternal(pkg, || autoRevokePermissionsMode == AppOpsManager.MODE_IGNORED) {
autoRevokePermissionsMode == AppOpsManager.MODE_IGNORED, userId); setAutoRevokeExemptedInternal(pkg,
autoRevokePermissionsMode == AppOpsManager.MODE_IGNORED, userId);
}
grantRequestedRuntimePermissionsInternal(pkg, params.getGrantedPermissions(), userId);
} }
grantRequestedRuntimePermissionsInternal(pkg, params.getGrantedPermissions(), userId);
} }
private void addAllowlistedRestrictedPermissionsInternal(@NonNull AndroidPackage pkg, private void addAllowlistedRestrictedPermissionsInternal(@NonNull AndroidPackage pkg,
@@ -4875,7 +4873,7 @@ public class PermissionManagerService extends IPermissionManager.Stub {
private void onPackageUninstalledInternal(@NonNull String packageName, int appId, private void onPackageUninstalledInternal(@NonNull String packageName, int appId,
@Nullable AndroidPackage pkg, @NonNull List<AndroidPackage> sharedUserPkgs, @Nullable AndroidPackage pkg, @NonNull List<AndroidPackage> sharedUserPkgs,
@UserIdInt int userId) { @UserIdInt int[] userIds) {
// TODO: Move these checks to check PackageState to be more reliable. // TODO: Move these checks to check PackageState to be more reliable.
// System packages should always have an available APK. // System packages should always have an available APK.
if (pkg != null && pkg.isSystem() if (pkg != null && pkg.isSystem()
@@ -4886,27 +4884,31 @@ public class PermissionManagerService extends IPermissionManager.Stub {
// If we are only marking a system package as uninstalled, we need to keep its // If we are only marking a system package as uninstalled, we need to keep its
// pregranted permission state so that it still works once it gets reinstalled, thus // pregranted permission state so that it still works once it gets reinstalled, thus
// only reset the user modifications to its permission state. // only reset the user modifications to its permission state.
resetRuntimePermissionsInternal(pkg, userId); for (final int userId : userIds) {
resetRuntimePermissionsInternal(pkg, userId);
}
return; return;
} }
updatePermissions(packageName, null, userId); updatePermissions(packageName, null);
if (sharedUserPkgs.isEmpty()) { for (final int userId : userIds) {
removeUidStateAndResetPackageInstallPermissionsFixed(appId, packageName, userId); if (sharedUserPkgs.isEmpty()) {
} else { removeUidStateAndResetPackageInstallPermissionsFixed(appId, packageName, userId);
// Remove permissions associated with package. Since runtime } else {
// permissions are per user we have to kill the removed package // Remove permissions associated with package. Since runtime
// or packages running under the shared user of the removed // permissions are per user we have to kill the removed package
// package if revoking the permissions requested only by the removed // or packages running under the shared user of the removed
// package is successful and this causes a change in gids. // package if revoking the permissions requested only by the removed
final int userIdToKill = revokeSharedUserPermissionsForDeletedPackageInternal(pkg, // package is successful and this causes a change in gids.
sharedUserPkgs, userId); final int userIdToKill = revokeSharedUserPermissionsForDeletedPackageInternal(pkg,
final boolean shouldKill = userIdToKill != UserHandle.USER_NULL; sharedUserPkgs, userId);
// If gids changed, kill all affected packages. final boolean shouldKill = userIdToKill != UserHandle.USER_NULL;
if (shouldKill) { // If gids changed, kill all affected packages.
mHandler.post(() -> { if (shouldKill) {
// This has to happen with no lock held. mHandler.post(() -> {
killUid(appId, UserHandle.USER_ALL, KILL_APP_REASON_GIDS_CHANGED); // This has to happen with no lock held.
}); killUid(appId, UserHandle.USER_ALL, KILL_APP_REASON_GIDS_CHANGED);
});
}
} }
} }
} }
@@ -5181,8 +5183,11 @@ public class PermissionManagerService extends IPermissionManager.Stub {
@NonNull PackageInstalledParams params, @UserIdInt int userId) { @NonNull PackageInstalledParams params, @UserIdInt int userId) {
Objects.requireNonNull(pkg, "pkg"); Objects.requireNonNull(pkg, "pkg");
Objects.requireNonNull(params, "params"); Objects.requireNonNull(params, "params");
Preconditions.checkArgumentNonNegative(userId, "userId"); Preconditions.checkArgument(userId >= UserHandle.USER_SYSTEM
onPackageInstalledInternal(pkg, params, userId); || userId == UserHandle.USER_ALL, "userId");
final int[] userIds = userId == UserHandle.USER_ALL ? getAllUserIds()
: new int[] { userId };
onPackageInstalledInternal(pkg, params, userIds);
} }
@Override @Override
@@ -5197,8 +5202,11 @@ public class PermissionManagerService extends IPermissionManager.Stub {
@UserIdInt int userId) { @UserIdInt int userId) {
Objects.requireNonNull(packageName, "packageName"); Objects.requireNonNull(packageName, "packageName");
Objects.requireNonNull(sharedUserPkgs, "sharedUserPkgs"); Objects.requireNonNull(sharedUserPkgs, "sharedUserPkgs");
Preconditions.checkArgumentNonNegative(userId, "userId"); Preconditions.checkArgument(userId >= UserHandle.USER_SYSTEM
onPackageUninstalledInternal(packageName, appId, pkg, sharedUserPkgs, userId); || userId == UserHandle.USER_ALL, "userId");
final int[] userIds = userId == UserHandle.USER_ALL ? getAllUserIds()
: new int[] { userId };
onPackageUninstalledInternal(packageName, appId, pkg, sharedUserPkgs, userIds);
} }
@NonNull @NonNull