From ff32c808ec5dc57591e7901a9d1ab6d09a87a9d1 Mon Sep 17 00:00:00 2001 From: Sam Dubey Date: Thu, 25 Aug 2022 13:10:35 +0000 Subject: [PATCH] Revert "[pm] reject data apps using privileged sharedUserId" This reverts commit c8993d843509563aec04500195799199971de908. Reason for revert: Creating a revert to assess the breakage in postsubmit and presubmit tests Change-Id: Ibdbd0ac494f5e1a705da3fc4dd75cdf96e7fcb78 --- .../server/pm/InstallPackageHelper.java | 4 +- .../server/pm/ReconcilePackageUtils.java | 47 ++----------------- tests/testables/tests/AndroidManifest.xml | 2 +- tests/testables/tests/AndroidTest.xml | 27 ----------- 4 files changed, 7 insertions(+), 73 deletions(-) delete mode 100644 tests/testables/tests/AndroidTest.xml diff --git a/services/core/java/com/android/server/pm/InstallPackageHelper.java b/services/core/java/com/android/server/pm/InstallPackageHelper.java index fee65341f2620..728d2d1540784 100644 --- a/services/core/java/com/android/server/pm/InstallPackageHelper.java +++ b/services/core/java/com/android/server/pm/InstallPackageHelper.java @@ -899,7 +899,7 @@ final class InstallPackageHelper { Trace.traceBegin(TRACE_TAG_PACKAGE_MANAGER, "reconcilePackages"); reconciledPackages = ReconcilePackageUtils.reconcilePackages( reconcileRequest, mSharedLibraries, - mPm.mSettings.getKeySetManagerService(), mPm.mSettings, mContext); + mPm.mSettings.getKeySetManagerService(), mPm.mSettings); } catch (ReconcileFailure e) { for (InstallRequest request : requests) { request.mInstallResult.setError("Reconciliation failed...", e); @@ -3669,7 +3669,7 @@ final class InstallPackageHelper { final Map reconcileResult = ReconcilePackageUtils.reconcilePackages(reconcileRequest, mSharedLibraries, mPm.mSettings.getKeySetManagerService(), - mPm.mSettings, mContext); + mPm.mSettings); if ((scanFlags & SCAN_AS_APEX) == 0) { appIdCreated = optimisticallyRegisterAppId(scanResult); } else { diff --git a/services/core/java/com/android/server/pm/ReconcilePackageUtils.java b/services/core/java/com/android/server/pm/ReconcilePackageUtils.java index 3c4780171ee5a..d6a133e437896 100644 --- a/services/core/java/com/android/server/pm/ReconcilePackageUtils.java +++ b/services/core/java/com/android/server/pm/ReconcilePackageUtils.java @@ -16,7 +16,6 @@ package com.android.server.pm; -import static android.content.pm.PackageManager.INSTALL_FAILED_INVALID_APK; import static android.content.pm.PackageManager.INSTALL_FAILED_UPDATE_INCOMPATIBLE; import static android.content.pm.PackageManager.INSTALL_PARSE_FAILED_INCONSISTENT_CERTIFICATES; import static android.content.pm.SigningDetails.CapabilityMergeRule.MERGE_RESTRICTED_CAPABILITY; @@ -24,31 +23,25 @@ import static android.content.pm.SigningDetails.CapabilityMergeRule.MERGE_RESTRI import static com.android.server.pm.PackageManagerService.SCAN_BOOTING; import static com.android.server.pm.PackageManagerService.SCAN_DONT_KILL_APP; -import android.content.Context; import android.content.pm.PackageManager; -import android.content.pm.PermissionInfo; import android.content.pm.SharedLibraryInfo; import android.content.pm.SigningDetails; import android.os.SystemProperties; -import android.permission.PermissionManager; import android.util.ArrayMap; import android.util.Log; import com.android.server.pm.parsing.pkg.AndroidPackage; import com.android.server.pm.parsing.pkg.ParsedPackage; -import com.android.server.pm.pkg.component.ParsedUsesPermission; import com.android.server.pm.pkg.parsing.ParsingPackageUtils; import com.android.server.utils.WatchedLongSparseArray; -import java.util.ArrayList; -import java.util.Arrays; import java.util.List; import java.util.Map; final class ReconcilePackageUtils { public static Map reconcilePackages( final ReconcileRequest request, SharedLibrariesImpl sharedLibraries, - KeySetManagerService ksms, Settings settings, Context context) + KeySetManagerService ksms, Settings settings) throws ReconcileFailure { final Map scannedPackages = request.mScannedPackages; @@ -168,43 +161,11 @@ final class ReconcilePackageUtils { // over the latest parsed certs. signingDetails = parsedPackage.getSigningDetails(); - // if this is a sharedUser, check to see if the new package is signed by a - // newer signing certificate than the existing one, and if so, copy over the new + // if this is is a sharedUser, check to see if the new package is signed by a + // newer + // signing certificate than the existing one, and if so, copy over the new // details if (sharedUserSetting != null) { - if (prepareResult != null && !prepareResult.mPackageToScan.isTestOnly() - && sharedUserSetting.isPrivileged() - && !signatureCheckPs.isSystem()) { - final List usesPermissions = - parsedPackage.getUsesPermissions(); - final List usesPrivilegedPermissions = new ArrayList<>(); - final PermissionManager permissionManager = context.getSystemService( - PermissionManager.class); - // Check if the app requests any privileged permissions because that - // violates the privapp-permissions allowlist check during boot. - if (permissionManager != null) { - for (int i = 0; i < usesPermissions.size(); i++) { - final String permissionName = usesPermissions.get(i).getName(); - final PermissionInfo permissionInfo = - permissionManager.getPermissionInfo(permissionName, 0); - if (permissionInfo != null - && (permissionInfo.getProtectionFlags() - & PermissionInfo.PROTECTION_FLAG_PRIVILEGED) != 0) { - usesPrivilegedPermissions.add(permissionName); - } - } - } - - if (!usesPrivilegedPermissions.isEmpty()) { - throw new ReconcileFailure(INSTALL_FAILED_INVALID_APK, - "Non-system package: " + parsedPackage.getPackageName() - + " shares signature and sharedUserId with" - + " a privileged package but requests" - + " privileged permissions that are not" - + " allowed: " + Arrays.toString( - usesPrivilegedPermissions.toArray())); - } - } // Attempt to merge the existing lineage for the shared SigningDetails with // the lineage of the new package; if the shared SigningDetails are not // returned this indicates the new package added new signers to the lineage diff --git a/tests/testables/tests/AndroidManifest.xml b/tests/testables/tests/AndroidManifest.xml index 1731f6be4bf29..2bfb04fdb765b 100644 --- a/tests/testables/tests/AndroidManifest.xml +++ b/tests/testables/tests/AndroidManifest.xml @@ -21,7 +21,7 @@ - + diff --git a/tests/testables/tests/AndroidTest.xml b/tests/testables/tests/AndroidTest.xml deleted file mode 100644 index de1165fca1a24..0000000000000 --- a/tests/testables/tests/AndroidTest.xml +++ /dev/null @@ -1,27 +0,0 @@ - - - - \ No newline at end of file