Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove fixed grant of READ_PHONE_STATE and cleanup

Browse Source 
No longer grant READ_PHONE_STATE as a fixed permission to all apps
holding READ_PRIVILEGED_PHONE_STATE. Also clean up the previous grants
by un-fixing the permission if the app requests it in the manifest, and
removing it altogether if the app only requests READ_PRIV.

Bug: 183537857
Test: manual -- prepare two system apps, one with READ_PRIV and
READ_PHONE and one with only READ_PRIV, then go through the upgrade flow
with this CL.

Change-Id: Id1fac0f9f4391857f46c7109eadafd60420b279d
This commit is contained in:
Hall Liu
2021-03-31 09:47:37 -07:00
parent 61ce1506ca
commit f4562b5cee
2 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
data/etc/platform.xml
View File

@@ -205,9 +205,6 @@
<split-permission name="android.permission.WRITE_EXTERNAL_STORAGE">
<new-permission name="android.permission.READ_EXTERNAL_STORAGE" />
</split-permission>
<split-permission name="android.permission.READ_PRIVILEGED_PHONE_STATE">
<new-permission name="android.permission.READ_PHONE_STATE" />
</split-permission>
<split-permission name="android.permission.READ_CONTACTS"
targetSdk="16">
<new-permission name="android.permission.READ_CALL_LOG" />

19
services/core/java/com/android/server/pm/permission/DefaultPermissionGrantPolicy.java
View File

@@ -422,19 +422,24 @@ final class DefaultPermissionGrantPolicy {
grantRuntimePermissionsForSystemPackage(pm, userId, pkg);
}
// Grant READ_PHONE_STATE to all system apps that have READ_PRIVILEGED_PHONE_STATE
// Re-grant READ_PHONE_STATE as non-fixed to all system apps that have
// READ_PRIVILEGED_PHONE_STATE and READ_PHONE_STATE granted -- this is to undo the fixed
// grant from R.
for (PackageInfo pkg : packages) {
if (pkg == null
|| !doesPackageSupportRuntimePermissions(pkg)
|| ArrayUtils.isEmpty(pkg.requestedPermissions)
|| !pm.isGranted(Manifest.permission.READ_PRIVILEGED_PHONE_STATE,
pkg, UserHandle.of(userId))) {
pkg, UserHandle.of(userId))
|| !pm.isGranted(Manifest.permission.READ_PHONE_STATE, pkg,
UserHandle.of(userId))) {
continue;
}
grantRuntimePermissions(pm, pkg,
Collections.singleton(Manifest.permission.READ_PHONE_STATE),
true, // systemFixed
userId);
pm.updatePermissionFlags(Manifest.permission.READ_PHONE_STATE, pkg,
PackageManager.FLAG_PERMISSION_SYSTEM_FIXED,
0,
UserHandle.of(userId));
}
}
@@ -1723,7 +1728,7 @@ final class DefaultPermissionGrantPolicy {
int flagMask, int flagValues, @NonNull UserHandle user) {
PermissionState state = getPermissionState(permission, pkg, user);
state.initFlags();
state.newFlags |= flagValues & flagMask;
state.newFlags = (state.newFlags & ~flagMask) | (flagValues & flagMask);
}
@Override