Revert "[pm] reject data apps using privileged sharedUserId"
This reverts commit c8993d8435.
Reason for revert: Creating a revert to assess the breakage in postsubmit and presubmit tests
Change-Id: Ibdbd0ac494f5e1a705da3fc4dd75cdf96e7fcb78
This commit is contained in:
Sam Dubey
@@ -899,7 +899,7 @@ final class InstallPackageHelper {
|
||||
Trace.traceBegin(TRACE_TAG_PACKAGE_MANAGER, "reconcilePackages");
|
||||
reconciledPackages = ReconcilePackageUtils.reconcilePackages(
|
||||
reconcileRequest, mSharedLibraries,
|
||||
mPm.mSettings.getKeySetManagerService(), mPm.mSettings, mContext);
|
||||
mPm.mSettings.getKeySetManagerService(), mPm.mSettings);
|
||||
} catch (ReconcileFailure e) {
|
||||
for (InstallRequest request : requests) {
|
||||
request.mInstallResult.setError("Reconciliation failed...", e);
|
||||
@@ -3669,7 +3669,7 @@ final class InstallPackageHelper {
|
||||
final Map<String, ReconciledPackage> reconcileResult =
|
||||
ReconcilePackageUtils.reconcilePackages(reconcileRequest,
|
||||
mSharedLibraries, mPm.mSettings.getKeySetManagerService(),
|
||||
mPm.mSettings, mContext);
|
||||
mPm.mSettings);
|
||||
if ((scanFlags & SCAN_AS_APEX) == 0) {
|
||||
appIdCreated = optimisticallyRegisterAppId(scanResult);
|
||||
} else {
|
||||
|
||||
@@ -16,7 +16,6 @@
|
||||
|
||||
package com.android.server.pm;
|
||||
|
||||
import static android.content.pm.PackageManager.INSTALL_FAILED_INVALID_APK;
|
||||
import static android.content.pm.PackageManager.INSTALL_FAILED_UPDATE_INCOMPATIBLE;
|
||||
import static android.content.pm.PackageManager.INSTALL_PARSE_FAILED_INCONSISTENT_CERTIFICATES;
|
||||
import static android.content.pm.SigningDetails.CapabilityMergeRule.MERGE_RESTRICTED_CAPABILITY;
|
||||
@@ -24,31 +23,25 @@ import static android.content.pm.SigningDetails.CapabilityMergeRule.MERGE_RESTRI
|
||||
import static com.android.server.pm.PackageManagerService.SCAN_BOOTING;
|
||||
import static com.android.server.pm.PackageManagerService.SCAN_DONT_KILL_APP;
|
||||
|
||||
import android.content.Context;
|
||||
import android.content.pm.PackageManager;
|
||||
import android.content.pm.PermissionInfo;
|
||||
import android.content.pm.SharedLibraryInfo;
|
||||
import android.content.pm.SigningDetails;
|
||||
import android.os.SystemProperties;
|
||||
import android.permission.PermissionManager;
|
||||
import android.util.ArrayMap;
|
||||
import android.util.Log;
|
||||
|
||||
import com.android.server.pm.parsing.pkg.AndroidPackage;
|
||||
import com.android.server.pm.parsing.pkg.ParsedPackage;
|
||||
import com.android.server.pm.pkg.component.ParsedUsesPermission;
|
||||
import com.android.server.pm.pkg.parsing.ParsingPackageUtils;
|
||||
import com.android.server.utils.WatchedLongSparseArray;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
|
||||
final class ReconcilePackageUtils {
|
||||
public static Map<String, ReconciledPackage> reconcilePackages(
|
||||
final ReconcileRequest request, SharedLibrariesImpl sharedLibraries,
|
||||
KeySetManagerService ksms, Settings settings, Context context)
|
||||
KeySetManagerService ksms, Settings settings)
|
||||
throws ReconcileFailure {
|
||||
final Map<String, ScanResult> scannedPackages = request.mScannedPackages;
|
||||
|
||||
@@ -168,43 +161,11 @@ final class ReconcilePackageUtils {
|
||||
// over the latest parsed certs.
|
||||
signingDetails = parsedPackage.getSigningDetails();
|
||||
|
||||
// if this is a sharedUser, check to see if the new package is signed by a
|
||||
// newer signing certificate than the existing one, and if so, copy over the new
|
||||
// if this is is a sharedUser, check to see if the new package is signed by a
|
||||
// newer
|
||||
// signing certificate than the existing one, and if so, copy over the new
|
||||
// details
|
||||
if (sharedUserSetting != null) {
|
||||
if (prepareResult != null && !prepareResult.mPackageToScan.isTestOnly()
|
||||
&& sharedUserSetting.isPrivileged()
|
||||
&& !signatureCheckPs.isSystem()) {
|
||||
final List<ParsedUsesPermission> usesPermissions =
|
||||
parsedPackage.getUsesPermissions();
|
||||
final List<String> usesPrivilegedPermissions = new ArrayList<>();
|
||||
final PermissionManager permissionManager = context.getSystemService(
|
||||
PermissionManager.class);
|
||||
// Check if the app requests any privileged permissions because that
|
||||
// violates the privapp-permissions allowlist check during boot.
|
||||
if (permissionManager != null) {
|
||||
for (int i = 0; i < usesPermissions.size(); i++) {
|
||||
final String permissionName = usesPermissions.get(i).getName();
|
||||
final PermissionInfo permissionInfo =
|
||||
permissionManager.getPermissionInfo(permissionName, 0);
|
||||
if (permissionInfo != null
|
||||
&& (permissionInfo.getProtectionFlags()
|
||||
& PermissionInfo.PROTECTION_FLAG_PRIVILEGED) != 0) {
|
||||
usesPrivilegedPermissions.add(permissionName);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (!usesPrivilegedPermissions.isEmpty()) {
|
||||
throw new ReconcileFailure(INSTALL_FAILED_INVALID_APK,
|
||||
"Non-system package: " + parsedPackage.getPackageName()
|
||||
+ " shares signature and sharedUserId with"
|
||||
+ " a privileged package but requests"
|
||||
+ " privileged permissions that are not"
|
||||
+ " allowed: " + Arrays.toString(
|
||||
usesPrivilegedPermissions.toArray()));
|
||||
}
|
||||
}
|
||||
// Attempt to merge the existing lineage for the shared SigningDetails with
|
||||
// the lineage of the new package; if the shared SigningDetails are not
|
||||
// returned this indicates the new package added new signers to the lineage
|
||||
|
||||
@@ -21,7 +21,7 @@
|
||||
<uses-permission android:name="android.permission.INTERACT_ACROSS_USERS_FULL" />
|
||||
<uses-permission android:name="android.permission.MANAGE_USERS" />
|
||||
|
||||
<application android:debuggable="true" android:testOnly="true">
|
||||
<application android:debuggable="true">
|
||||
<uses-library android:name="android.test.runner" />
|
||||
</application>
|
||||
|
||||
|
||||
@@ -1,27 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!--
|
||||
~ Copyright (C) 2022 The Android Open Source Project
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
<configuration description="Runs Testable Tests.">
|
||||
<option name="test-tag" value="TestablesTests" />
|
||||
<target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
|
||||
<option name="cleanup-apks" value="true" />
|
||||
<option name="install-arg" value="-t" />
|
||||
<option name="test-file-name" value="TestablesTests.apk" />
|
||||
</target_preparer>
|
||||
<test class="com.android.tradefed.testtype.AndroidJUnitTest">
|
||||
<option name="package" value="com.android.testables"/>
|
||||
</test>
|
||||
</configuration>
|
||||
Reference in New Issue
Block a user