A previous change mistakenly added the dependency on <uses-library>.
Bug: 30188076
Test: make, flash, install, check that it works properly
Change-Id: If2a769896e705c4c301c14e3e0f3288469f01c17
for supported keys
RestoreAnyVersion is supported only for K/V, as full backup
of SettingsProvider has been deprecated (b/71746093).
The supported keys whitelist only contains KEY_WIFI_NEW_CONFIG
and KEY_NETWORK_POLICIES for now, and will be extended in future CLs.
Bug: 64988620
Test: manual (P->P - master without changes to master with changes)
Test: manual (Q->P = API29 -> API28)
Test: a lot of other scenarios covered by our end-to-end tests
Change-Id: I381617b5db9a33b24d400945cffbc59db78ebbd2
Statically including legacy-android-test leads to duplicate classes
which causes build time problems (with Proguard) and runtime problems on
older SDK versions. This change:
* Stops statically including legacy-android-test.
* Adds compile time dependencies on andoid.test.base, android.test.mock
and android.test.runner where necessary.
* Adds <uses-library android:name="android.test.runner"/> to any
affected package to ensure that the classes that were included by
legacy-android-test are still available at runtime. That also adds a
dependency on android.test.base and android.test.mock.
The following change descriptions were generated automatically and so
may be a little repetitive. They are provided to give the reviewer
enough information to check the comments match what has actually been
changed and check the reasoning behind the changes.
* apct-tests/perftests/core/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in CorePerfTests results
in duplicate classes which leads to build time and compile time
issues.
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
CorePerfTests's source depends on its classes and because of these
changes they are no longer present on the compilation path.
* core/tests/ConnectivityManagerTest/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
ConnectivityManagerTest's source depends on its classes and because
of these changes they are no longer present on the compilation
path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in ConnectivityManagerTest
results in duplicate classes which leads to build time and compile
time issues.
* core/tests/bandwidthtests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
BandwidthTests's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in BandwidthTests results
in duplicate classes which leads to build time and compile time
issues.
* core/tests/bluetoothtests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
BluetoothTests's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in BluetoothTests results
in duplicate classes which leads to build time and compile time
issues.
* core/tests/hosttests/test-apps/DownloadManagerTestApp/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in DownloadManagerTestApp
results in duplicate classes which leads to build time and compile
time issues.
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
DownloadManagerTestApp's source depends on its classes and because
of these changes they are no longer present on the compilation
path.
* core/tests/hosttests/test-apps/ExternalSharedPerms/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
ExternalSharedPermsTestApp results in duplicate classes which leads
to build time and compile time issues.
* core/tests/hosttests/test-apps/ExternalSharedPermsBT/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
ExternalSharedPermsBTTestApp results in duplicate classes which
leads to build time and compile time issues.
* core/tests/hosttests/test-apps/ExternalSharedPermsDiffKey/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
ExternalSharedPermsDiffKeyTestApp results in duplicate classes
which leads to build time and compile time issues.
* core/tests/hosttests/test-apps/ExternalSharedPermsFL/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
ExternalSharedPermsFLTestApp results in duplicate classes which
leads to build time and compile time issues.
* core/tests/notificationtests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
NotificationStressTests's source depends on its classes and because
of these changes they are no longer present on the compilation
path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in NotificationStressTests
results in duplicate classes which leads to build time and compile
time issues.
* keystore/tests/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in KeystoreTests results
in duplicate classes which leads to build time and compile time
issues.
* media/mca/tests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
CameraEffectsTests's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in CameraEffectsTests
results in duplicate classes which leads to build time and compile
time issues.
* media/tests/MediaFrameworkTest/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
mediaframeworktest's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in mediaframeworktest
results in duplicate classes which leads to build time and compile
time issues.
* nfc-extras/tests/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in NfcExtrasTests results
in duplicate classes which leads to build time and compile time
issues.
* packages/CarrierDefaultApp/tests/unit/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
CarrierDefaultAppUnitTests's source depends on its classes and
because of these changes they are no longer present on the
compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
CarrierDefaultAppUnitTests results in duplicate classes which leads
to build time and compile time issues.
* packages/ExtServices/tests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
ExtServicesUnitTests's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in ExtServicesUnitTests
results in duplicate classes which leads to build time and compile
time issues.
* packages/MtpDocumentsProvider/tests/Android.mk
Added 'android.test.base' and 'android.test.mock' to
LOCAL_JAVA_LIBRARIES because MtpDocumentsProviderTests's source
depends on their classes and because of these changes they are no
longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
MtpDocumentsProviderTests results in duplicate classes which leads
to build time and compile time issues.
* packages/SettingsLib/tests/integ/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
SettingsLibTests's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in SettingsLibTests
results in duplicate classes which leads to build time and compile
time issues.
* packages/SettingsProvider/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in SettingsProvider
results in duplicate classes which leads to build time and compile
time issues.
* packages/SettingsProvider/AndroidManifest.xml
Add uses-library for android.test.runner because otherwise this
change would change the set of files available to SettingsProvider
at runtime.
* packages/Shell/tests/Android.mk
Added 'android.test.base' and 'android.test.mock' to
LOCAL_JAVA_LIBRARIES because ShellTests's source depends on their
classes and because of these changes they are no longer present on
the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in ShellTests results in
duplicate classes which leads to build time and compile time
issues.
* packages/SystemUI/shared/tests/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in SystemUISharedLibTests
results in duplicate classes which leads to build time and compile
time issues.
* packages/SystemUI/tests/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in SystemUITests results
in duplicate classes which leads to build time and compile time
issues.
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
SystemUITests's source depends on its classes and because of these
changes they are no longer present on the compilation path.
* packages/WAPPushManager/tests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
WAPPushManagerTests's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in WAPPushManagerTests
results in duplicate classes which leads to build time and compile
time issues.
* sax/tests/saxtests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
FrameworksSaxTests's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in FrameworksSaxTests
results in duplicate classes which leads to build time and compile
time issues.
* tests/BrowserPowerTest/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
BrowserPowerTests's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in BrowserPowerTests
results in duplicate classes which leads to build time and compile
time issues.
* tests/CanvasCompare/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
CanvasCompare's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in CanvasCompare results
in duplicate classes which leads to build time and compile time
issues.
* tests/CoreTests/android/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
CoreTests's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in CoreTests results in
duplicate classes which leads to build time and compile time
issues.
* tests/DataIdleTest/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
DataIdleTest's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in DataIdleTest results in
duplicate classes which leads to build time and compile time
issues.
* tests/FrameworkPerf/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
FrameworkPerf's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in FrameworkPerf results
in duplicate classes which leads to build time and compile time
issues.
* tests/HierarchyViewerTest/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
HierarchyViewerTest's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in HierarchyViewerTest
results in duplicate classes which leads to build time and compile
time issues.
* tests/ImfTest/tests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
ImfTestTests's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in ImfTestTests results in
duplicate classes which leads to build time and compile time
issues.
* tests/Internal/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in InternalTests results
in duplicate classes which leads to build time and compile time
issues.
* tests/MemoryUsage/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
MemoryUsage's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in MemoryUsage results in
duplicate classes which leads to build time and compile time
issues.
* tests/NetworkSecurityConfigTest/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
NetworkSecurityConfigTests's source depends on its classes and
because of these changes they are no longer present on the
compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
NetworkSecurityConfigTests results in duplicate classes which leads
to build time and compile time issues.
* tests/SoundTriggerTests/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in SoundTriggerTests
results in duplicate classes which leads to build time and compile
time issues.
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
SoundTriggerTests's source depends on its classes and because of
these changes they are no longer present on the compilation path.
* tests/SurfaceComposition/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in SurfaceComposition
results in duplicate classes which leads to build time and compile
time issues.
Added 'android.test.runner.stubs' to LOCAL_JAVA_LIBRARIES because
SurfaceComposition's source depends on its classes and because of
these changes they are no longer present on the compilation path.
* tests/TtsTests/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in TtsTests results in
duplicate classes which leads to build time and compile time
issues.
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
TtsTests's source depends on its classes and because of these
changes they are no longer present on the compilation path.
* tests/WindowAnimationJank/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in WindowAnimationJank
results in duplicate classes which leads to build time and compile
time issues.
* tests/permission/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
FrameworkPermissionTests's source depends on its classes and
because of these changes they are no longer present on the
compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
FrameworkPermissionTests results in duplicate classes which leads
to build time and compile time issues.
* tests/testables/tests/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in TestablesTests results
in duplicate classes which leads to build time and compile time
issues.
Added 'android.test.base' and 'android.test.mock' to
LOCAL_JAVA_LIBRARIES because TestablesTests's source depends on
their classes and because of these changes they are no longer
present on the compilation path.
Bug: 30188076
Test: make checkbuild
Change-Id: Iacfc939c97415314366ed61c5f3b7aa1a40f0ec9
Provider enforcement is not yet in, but the settings provider is needed
so expose it now.
Test: Builds
Change-Id: I9afffb45043220e4b85778bbd4f5c4143831fc74
Mostly consists of removing the word "encryption" from most APIs,
since we can't actually make promises about the data being encrypted.
Bug: 27531029
Change-Id: Iace9d7c4e64716abf86ed11847c40f3947e1d625
Add granular StorageManager APIs for key creation/destruction and
unlocking/locking. Start passing through an opaque token as part
of the unlock command, but leave it empty for now. We now have a
separate "prepare" method that sanity checks that user directories
are correctly setup.
Define a handful of system properties used for marking devices that
should be operating in FBE mode, and if they're emulating FBE. Wire
a command to "sm", but persisting will come later.
Start using new "encryptionAware" flag on apps previously marked with
coreApp flag, which were apps running in the legacy CryptKeeper
model. Small tweaks to handle non-encryptionAware voice interaction
services. Switch PackageManager to consult StorageManager about the
unlocked state of a user.
Bug: 22358539
Change-Id: Ic2865f9b81c10ea39369c441422f7427a3c3c3d6
Permission checks are enforced within the SettingsProvider specifically
for SECURE/SYSTEM/GLOBAL. Now WRITE_SETTINGS is runtime, so it shouldn't
apply to all the settings types.
Bug: 22044704
Change-Id: I9ed25d96b2fa4f46d3d049efa4300cd1d37bbd24
There is only one instance of the Settings ContentProvider, running in the user 0.
So it should be marked as singleUser.
BUG: 17133716
Change-Id: I426667ddbc8e682e7ea81f04633c0ad4f42782cb
In a future version of Android, the default value for
<provider android:exported> will change from true to false.
Explicitly set android:exported="true"
Bug: 3306452
Change-Id: Iffe4dca4fefc92bb9f89698f149a87c16a7ce3c5
A core app is one that has coreApp="true" in its manifest tag.
The system can successfully boot (though a little painfully) with
only framework-res.apk, SettingsProvider.apk, SystemUI.apk,
DefaultContainerService.apk, and Launcher2.apk set as core apps.
Currently this boot mode is always turned off.
Change-Id: Ieaa4a8031c2c391a12996aa8d8b1d65fc2b09d6b
New methods for full backup/restore have been added to BackupAgent
(still hidden): onFullBackup() and onRestoreFile(). The former is the
entry point for a full app backup to adb/socket/etc: the app then writes
all of its files, entire, to the output. During restore, the latter
new callback is invoked, once for each file being restored.
The full backup/restore interface does not use the previously-defined
BackupDataInput / BackupDataOutput classes, because those classes
provide an API designed for incremental key/value data structuring.
Instead, a new FullBackupDataOutput class has been introduced, through
which we restrict apps' abilities to write data during a full backup
operation to *only* writing entire on-disk files via a new BackupAgent
method called fullBackupFile().
"FullBackupAgent" exists now solely as a concrete shell class that
can be instantiated in the case of apps that do not have their own
BackupAgent implementations.
Along with the API change, responsibility for backing up the .apk
file and OBB container has been moved into the framework rather than
have the application side of the transaction do it.
Change-Id: I12849b06b1a6e4c44d080587c1e9828a52b70dae
This is the basic infrastructure for pulling a full(*) backup of the
device's data over an adb(**) connection to the local device. The
basic process consists of these interacting pieces:
1. The framework's BackupManagerService, which coordinates the
collection of app data and routing to the destination.
2. A new framework-provided BackupAgent implementation called
FullBackupAgent, which is instantiated in the target applications'
processes in turn, and knows how to emit a datastream that contains
all of the app's saved data files.
3. A new shell-level program called "bu" that is used to bridge from
adb to the framework's Backup Manager.
4. adb itself, which now knows how to use 'bu' to kick off a backup
operation and pull the resulting data stream to the desktop host.
5. A system-provided application that verifies with the user that
an attempted backup/restore operation is in fact expected and to
be allowed.
The full agent implementation is not used during normal operation of
the delta-based app-customized remote backup process. Instead it's
used during user-confirmed *full* backup of applications and all their
data to a local destination, e.g. via the adb connection.
The output format is 'tar'. This makes it very easy for the end
user to examine the resulting dataset, e.g. for purpose of extracting
files for debug purposes; as well as making it easy to contemplate
adding things like a direct gzip stage to the data pipeline during
backup/restore. It also makes it convenient to construct and maintain
synthetic backup datasets for testing purposes.
Within the tar format, certain artificial conventions are used.
All files are stored within top-level directories according to
their semantic origin:
apps/pkgname/a/ : Application .apk file itself
apps/pkgname/obb/: The application's associated .obb containers
apps/pkgname/f/ : The subtree rooted at the getFilesDir() location
apps/pkgname/db/ : The subtree rooted at the getDatabasePath() parent
apps/pkgname/sp/ : The subtree rooted at the getSharedPrefsFile() parent
apps/pkgname/r/ : Files stored relative to the root of the app's file tree
apps/pkgname/c/ : Reserved for the app's getCacheDir() tree; not stored.
For each package, the first entry in the tar stream is a file called
"_manifest", nominally rooted at apps/pkgname. This file contains some
metadata about the package whose data is stored in the archive.
The contents of shared storage can optionally be included in the tar
stream. It is placed in the synthetic location:
shared/...
uid/gid are ignored; app uids are assigned at install time, and the
app's data is handled from within its own execution environment, so
will automatically have the app's correct uid.
Forward-locked .apk files are never backed up. System-partition
.apk files are not backed up unless they have been overridden by a
post-factory upgrade, in which case the current .apk *is* backed up --
i.e. the .apk that matches the on-disk data. The manifest preceding
each application's portion of the tar stream provides version numbers
and signature blocks for version checking, as well as an indication
of whether the restore logic should expect to install the .apk before
extracting the data.
System packages can designate their own full backup agents. This is
to manage things like the settings provider which (a) cannot be shut
down on the fly in order to do a clean snapshot of their file trees,
and (b) manage data that is not only irrelevant but actively hostile
to non-identical devices -- CDMA telephony settings would seriously
mess up a GSM device if emplaced there blind, for example.
When a full backup or restore is initiated from adb, the system will
present a confirmation UI that the user must explicitly respond to
within a short [~ 30 seconds] timeout. This is to avoid the
possibility of malicious desktop-side software secretly grabbing a copy
of all the user's data for nefarious purposes.
(*) The backup is not strictly a full mirror. In particular, the
settings database is not cloned; it is handled the same way that
it is in cloud backup/restore. This is because some settings
are actively destructive if cloned onto a different (or
especially a different-model) device: telephony settings and
AndroidID are good examples of this.
(**) On the framework side it doesn't care that it's adb; it just
sends the tar stream to a file descriptor. This can easily be
retargeted around whatever transport we might decide to use
in the future.
KNOWN ISSUES:
* the security UI is desperately ugly; no proper designs have yet
been done for it
* restore is not yet implemented
* shared storage backup is not yet implemented
* symlinks aren't yet handled, though some infrastructure for
dealing with them has been put in place.
Change-Id: Ia8347611e23b398af36ea22c36dff0a276b1ce91
Note in docs that callbacks are on main thread.
Rename to DeviceAdminReceiver?
Document resetPassword is the device's password.
Also hide android.R.attr.neverEncrypt.
Any package can now participate in backup/restore, without requiring any
manifest-declared permission. *Control* of the backup manager is still
guarded by the BACKUP permission, which is signatureOrSystem.
Change-Id: I116fcfcd4cd255e3c976330da1c4dea7d4faae9d
Applications can now specify two more aspects of the restore process: whether
they need to run with their own custom Application subclass rather than being
launched in the usual restricted mode during restore, and whether it's okay for
the backup manager to kill the app process once restore has completed. The new
manifest attributes for these are, respectively, android:restoreNeedsApplication
and android:killAfterRestore.
If unspecified in the manifest, restoreNeedsApplication is false, and
killAfterRestore is true.
In order to support kill-after-restore cleanly, this change also adds a new
system-process-only interface to the Activity Manager, which will schedule a
"commit suicide" event on the target app's main thread looper.
The framework backup agents have been given the appropriate new backup
attributes as well.
Packages that do not use android.permission.BACKUP_DATA will neither be backed
up nor restored. That permission is currently signature-only. In the future if
access to the backup/restore infrastructure is made available to arbitrary 3rd
party applications, the permission checks (and indeed, the permission itself)
can simply be removed.
This backs up the basic system and secure settings. THe restoration doesn't
take effect immediately. You many need to restart the runtime to see all
restored values take effect.
made public, and wouldn't be used by any third party applications,
and no longer does anything regardless).
Also remove the WRITE_GSERVICES permission from the SettingsProvider
package's manifest (the declaration there was redundant with the one
in the core manifest, where all the other settings-related permissions
live -- no other core package includes its own permission definitions).
