From f4562b5cee38bd5f75fd79499e79d15713f07613 Mon Sep 17 00:00:00 2001
From: Hall Liu <hallliu@google.com>
Date: Wed, 31 Mar 2021 09:47:37 -0700
Subject: [PATCH] Remove fixed grant of READ_PHONE_STATE and cleanup

No longer grant READ_PHONE_STATE as a fixed permission to all apps
holding READ_PRIVILEGED_PHONE_STATE. Also clean up the previous grants
by un-fixing the permission if the app requests it in the manifest, and
removing it altogether if the app only requests READ_PRIV.

Bug: 183537857
Test: manual -- prepare two system apps, one with READ_PRIV and
READ_PHONE and one with only READ_PRIV, then go through the upgrade flow
with this CL.

Change-Id: Id1fac0f9f4391857f46c7109eadafd60420b279d
---
 data/etc/platform.xml                         |  3 ---
 .../DefaultPermissionGrantPolicy.java         | 19 ++++++++++++-------
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/data/etc/platform.xml b/data/etc/platform.xml
index 71fc29b04a803..e8eb4ac8f9a12 100644
--- a/data/etc/platform.xml
+++ b/data/etc/platform.xml
@@ -205,9 +205,6 @@
     <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE">
         <new-permission name="android.permission.READ_EXTERNAL_STORAGE" />
     </split-permission>
-    <split-permission name="android.permission.READ_PRIVILEGED_PHONE_STATE">
-        <new-permission name="android.permission.READ_PHONE_STATE" />
-    </split-permission>
     <split-permission name="android.permission.READ_CONTACTS"
                       targetSdk="16">
         <new-permission name="android.permission.READ_CALL_LOG" />
diff --git a/services/core/java/com/android/server/pm/permission/DefaultPermissionGrantPolicy.java b/services/core/java/com/android/server/pm/permission/DefaultPermissionGrantPolicy.java
index 34003c7f23412..1e92ca60ce2f9 100644
--- a/services/core/java/com/android/server/pm/permission/DefaultPermissionGrantPolicy.java
+++ b/services/core/java/com/android/server/pm/permission/DefaultPermissionGrantPolicy.java
@@ -422,19 +422,24 @@ final class DefaultPermissionGrantPolicy {
             grantRuntimePermissionsForSystemPackage(pm, userId, pkg);
         }
 
-        // Grant READ_PHONE_STATE to all system apps that have READ_PRIVILEGED_PHONE_STATE
+        // Re-grant READ_PHONE_STATE as non-fixed to all system apps that have
+        // READ_PRIVILEGED_PHONE_STATE and READ_PHONE_STATE granted -- this is to undo the fixed
+        // grant from R.
         for (PackageInfo pkg : packages) {
             if (pkg == null
                     || !doesPackageSupportRuntimePermissions(pkg)
                     || ArrayUtils.isEmpty(pkg.requestedPermissions)
                     || !pm.isGranted(Manifest.permission.READ_PRIVILEGED_PHONE_STATE,
-                            pkg, UserHandle.of(userId))) {
+                            pkg, UserHandle.of(userId))
+                    || !pm.isGranted(Manifest.permission.READ_PHONE_STATE, pkg,
+                            UserHandle.of(userId))) {
                 continue;
             }
-            grantRuntimePermissions(pm, pkg,
-                    Collections.singleton(Manifest.permission.READ_PHONE_STATE),
-                    true, // systemFixed
-                    userId);
+
+            pm.updatePermissionFlags(Manifest.permission.READ_PHONE_STATE, pkg,
+                    PackageManager.FLAG_PERMISSION_SYSTEM_FIXED,
+                    0,
+                    UserHandle.of(userId));
         }
 
     }
@@ -1723,7 +1728,7 @@ final class DefaultPermissionGrantPolicy {
                 int flagMask, int flagValues, @NonNull UserHandle user) {
             PermissionState state = getPermissionState(permission, pkg, user);
             state.initFlags();
-            state.newFlags |= flagValues & flagMask;
+            state.newFlags = (state.newFlags & ~flagMask) | (flagValues & flagMask);
         }
 
         @Override