Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Don't check apex when granting priv permission unless needed" into rvc-dev am: 19f8283a01 am: c6dfff9043

Browse Source 
Change-Id: Ibed792fba9a691beba701ee9a6124e824e988102
This commit is contained in:
Philip P. Moltmann
2020-03-28 01:41:55 +00:00
committed by Automerger Merge Worker
parent 7c68006eb3 c6dfff9043
commit f5a0a6a0ea
1 changed files with 40 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

76
services/core/java/com/android/server/pm/permission/PermissionManagerService.java
View File

@@ -3319,47 +3319,51 @@ public class PermissionManagerService extends IPermissionManager.Stub {
if (!privappPermissionsDisable && privilegedPermission && pkg.isPrivileged() if (!privappPermissionsDisable && privilegedPermission && pkg.isPrivileged()
&& !platformPackage && platformPermission) { && !platformPackage && platformPermission) {
if (!hasPrivappWhitelistEntry(perm, pkg)) { if (!hasPrivappWhitelistEntry(perm, pkg)) {
ApexManager apexMgr = ApexManager.getInstance();
String apexContainingPkg = apexMgr.getActiveApexPackageNameContainingPackage(pkg);
// Only enforce whitelist this on boot // Only enforce whitelist this on boot
if (!mSystemReady if (!mSystemReady
// Updated system apps do not need to be whitelisted // Updated system apps do not need to be whitelisted
&& !pkgSetting.getPkgState().isUpdatedSystemApp() && !pkgSetting.getPkgState().isUpdatedSystemApp()) {
// Apps that are in updated apexs' do not need to be whitelisted ApexManager apexMgr = ApexManager.getInstance();
&& (apexContainingPkg == null || apexMgr.isFactory( String apexContainingPkg = apexMgr.getActiveApexPackageNameContainingPackage(
apexMgr.getPackageInfo(apexContainingPkg, MATCH_ACTIVE_PACKAGE)))) { pkg);
// it's only a reportable violation if the permission isn't explicitly denied
ArraySet<String> deniedPermissions = null;
if (pkg.isVendor()) {
deniedPermissions = SystemConfig.getInstance()
.getVendorPrivAppDenyPermissions(pkg.getPackageName());
} else if (pkg.isProduct()) {
deniedPermissions = SystemConfig.getInstance()
.getProductPrivAppDenyPermissions(pkg.getPackageName());
} else if (pkg.isSystemExt()) {
deniedPermissions = SystemConfig.getInstance()
.getSystemExtPrivAppDenyPermissions(pkg.getPackageName());
} else {
deniedPermissions = SystemConfig.getInstance()
.getPrivAppDenyPermissions(pkg.getPackageName());
}
final boolean permissionViolation =
deniedPermissions == null || !deniedPermissions.contains(perm);
if (permissionViolation) {
Slog.w(TAG, "Privileged permission " + perm + " for package "
+ pkg.getPackageName() + " (" + pkg.getCodePath()
+ ") not in privapp-permissions whitelist");
if (RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS_ENFORCE) { // Apps that are in updated apexs' do not need to be whitelisted
if (mPrivappPermissionsViolations == null) { if (apexContainingPkg == null || apexMgr.isFactory(
mPrivappPermissionsViolations = new ArraySet<>(); apexMgr.getPackageInfo(apexContainingPkg, MATCH_ACTIVE_PACKAGE))) {
} // it's only a reportable violation if the permission isn't explicitly
mPrivappPermissionsViolations.add( // denied
pkg.getPackageName() + " (" + pkg.getCodePath() + "): " + perm); ArraySet<String> deniedPermissions = null;
if (pkg.isVendor()) {
deniedPermissions = SystemConfig.getInstance()
.getVendorPrivAppDenyPermissions(pkg.getPackageName());
} else if (pkg.isProduct()) {
deniedPermissions = SystemConfig.getInstance()
.getProductPrivAppDenyPermissions(pkg.getPackageName());
} else if (pkg.isSystemExt()) {
deniedPermissions = SystemConfig.getInstance()
.getSystemExtPrivAppDenyPermissions(pkg.getPackageName());
} else {
deniedPermissions = SystemConfig.getInstance()
.getPrivAppDenyPermissions(pkg.getPackageName());
}
final boolean permissionViolation =
deniedPermissions == null || !deniedPermissions.contains(perm);
if (permissionViolation) {
Slog.w(TAG, "Privileged permission " + perm + " for package "
+ pkg.getPackageName() + " (" + pkg.getCodePath()
+ ") not in privapp-permissions whitelist");
if (RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS_ENFORCE) {
if (mPrivappPermissionsViolations == null) {
mPrivappPermissionsViolations = new ArraySet<>();
}
mPrivappPermissionsViolations.add(
pkg.getPackageName() + " (" + pkg.getCodePath() + "): "
+ perm);
}
} else {
return false;
} }
} else {
return false;
} }
} }
if (RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS_ENFORCE) { if (RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS_ENFORCE) {