From 2f630c61f79d9767df6bab1d038205778a6b212e Mon Sep 17 00:00:00 2001
From: Evan Severson <evanseverson@google.com>
Date: Thu, 1 Apr 2021 16:35:58 -0700
Subject: [PATCH] Remove the signature protection for sensor privacy
 permissions

Only a couple distinguished packages will need to hold these
permissions. We can grant via role for these cases.

Previously system ui was started assuming the system server was
initialized enough but the problem was that the role service may not
have finished granting all permissions. If we start sys ui after system
services have finished onUserStarting then we can _probably_ safely
assume the state of user 0 is initiallized.

Test: Wipe & reboot; dumpsys package com.android.systemui
Test: atest SystemUiTests
Bug: 184303952
Change-Id: I160ac8e0f2fbc36a76e8f2ee99d73e613ddc3c11
---
 core/api/system-current.txt                       |  1 +
 core/res/AndroidManifest.xml                      |  4 ++--
 core/res/res/values/config.xml                    |  2 ++
 core/res/res/values/public.xml                    |  2 ++
 .../java/com/android/server/SystemServer.java     | 15 ++++++++-------
 5 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/core/api/system-current.txt b/core/api/system-current.txt
index ce408d1a80f17..03daf992ce195 100644
--- a/core/api/system-current.txt
+++ b/core/api/system-current.txt
@@ -379,6 +379,7 @@ package android {
     field public static final int config_systemSpeechRecognizer;
     field public static final int config_systemTelevisionNotificationHandler;
     field public static final int config_systemTextIntelligence;
+    field public static final int config_systemUi;
     field public static final int config_systemUiIntelligence;
     field public static final int config_systemVisualIntelligence;
     field public static final int config_systemWellbeing;
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index 925a212d10cbd..23243ca242ece 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -5569,12 +5569,12 @@
     <!-- @SystemApi Allows sensor privacy to be modified.
          @hide -->
     <permission android:name="android.permission.MANAGE_SENSOR_PRIVACY"
-                android:protectionLevel="signature" />
+                android:protectionLevel="internal|role" />
 
     <!-- @SystemApi Allows sensor privacy changes to be observed.
          @hide -->
     <permission android:name="android.permission.OBSERVE_SENSOR_PRIVACY"
-                android:protectionLevel="signature|installer" />
+                android:protectionLevel="internal|role|installer" />
 
     <!-- @SystemApi Permission that protects the {@link Intent#ACTION_REVIEW_ACCESSIBILITY_SERVICES}
          intent.
diff --git a/core/res/res/values/config.xml b/core/res/res/values/config.xml
index 906a7403298f0..7168da9d1fb7d 100644
--- a/core/res/res/values/config.xml
+++ b/core/res/res/values/config.xml
@@ -1946,6 +1946,8 @@
     <string name="config_systemTelevisionNotificationHandler" translatable="false"></string>
     <!-- The name of the package that will hold the system activity recognizer role. -->
     <string name="config_systemActivityRecognizer" translatable="false"></string>
+    <!-- The name of the package that will hold the system ui role -->
+    <string name="config_systemUi" translatable="false">com.android.systemui</string>
 
     <!-- The name of the package that will be allowed to change its components' label/icon. -->
     <string name="config_overrideComponentUiPackage" translatable="false">com.android.stk</string>
diff --git a/core/res/res/values/public.xml b/core/res/res/values/public.xml
index f6a67d2ae7105..51e34477724f9 100644
--- a/core/res/res/values/public.xml
+++ b/core/res/res/values/public.xml
@@ -3227,6 +3227,8 @@
     <public name="config_systemActivityRecognizer" />
     <!-- @hide @SystemApi -->
     <public name="config_systemCompanionDeviceProvider"/>
+    <!-- @hide @SystemApi -->
+    <public name="config_systemUi" />
   </staging-public-group>
 
   <staging-public-group type="id" first-id="0x01020055">
diff --git a/services/java/com/android/server/SystemServer.java b/services/java/com/android/server/SystemServer.java
index 912b8cad952c8..75996b8e099b0 100644
--- a/services/java/com/android/server/SystemServer.java
+++ b/services/java/com/android/server/SystemServer.java
@@ -2724,13 +2724,6 @@ public final class SystemServer implements Dumpable {
                 t.traceEnd();
             }
 
-            t.traceBegin("StartSystemUI");
-            try {
-                startSystemUi(context, windowManagerF);
-            } catch (Throwable e) {
-                reportWtf("starting System UI", e);
-            }
-            t.traceEnd();
             // Enable airplane mode in safe mode. setAirplaneMode() cannot be called
             // earlier as it sends broadcasts to other services.
             // TODO: This may actually be too late if radio firmware already started leaking
@@ -2932,6 +2925,14 @@ public final class SystemServer implements Dumpable {
             }
         }, t);
 
+        t.traceBegin("StartSystemUI");
+        try {
+            startSystemUi(context, windowManagerF);
+        } catch (Throwable e) {
+            reportWtf("starting System UI", e);
+        }
+        t.traceEnd();
+
         t.traceEnd(); // startOtherServices
     }