Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Only log a warning if it's an actual violation

Browse Source 
Otherwise the message can be confusing if deny-permission is used or
app is updated.

Test: manual
Bug: 64693550
Change-Id: I19943d8cbd13a5173356a32565db88856428009e
This commit is contained in:
Fyodor Kupolov
2017-10-25 17:03:50 -07:00
parent 794fab5b4c
commit f5e600d073
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
services/core/java/com/android/server/pm/permission/PermissionManagerService.java
View File

@@ -996,8 +996,6 @@ public class PermissionManagerService {
if (!privappPermissionsDisable && privilegedPermission && pkg.isPrivileged()
&& !platformPackage && platformPermission) {
if (!hasPrivappWhitelistEntry(perm, pkg)) {
Slog.w(TAG, "Privileged permission " + perm + " for package "
+ pkg.packageName + " - not in privapp-permissions whitelist");
// Only report violations for apps on system image
if (!mSystemReady && !pkg.isUpdatedSystemApp()) {
// it's only a reportable violation if the permission isn't explicitly denied
@@ -1005,12 +1003,16 @@ public class PermissionManagerService {
.getPrivAppDenyPermissions(pkg.packageName);
final boolean permissionViolation =
deniedPermissions == null || !deniedPermissions.contains(perm);
if (permissionViolation
&& RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS_ENFORCE) {
if (mPrivappPermissionsViolations == null) {
mPrivappPermissionsViolations = new ArraySet<>();
if (permissionViolation) {
Slog.w(TAG, "Privileged permission " + perm + " for package "
+ pkg.packageName + " - not in privapp-permissions whitelist");
if (RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS_ENFORCE) {
if (mPrivappPermissionsViolations == null) {
mPrivappPermissionsViolations = new ArraySet<>();
}
mPrivappPermissionsViolations.add(pkg.packageName + ": " + perm);
}
mPrivappPermissionsViolations.add(pkg.packageName + ": " + perm);
} else {
return false;
}