Grant MODIFY_AUDIO_ROUTING permissions to the shell identity
for use within CTS tests.
Bug: 183428114
Test: CTS passed with the permission
Change-Id: I6e8c7553d7fe3263c0345adf0fe67340e5afcbe5
Adding SCHEDULE_PRIORITIZED_ALARM permission to Shell so the API can be
called from tests.
Test: Builds, boots.
atest CtsAlarmManagerTestCases:BasicApiTests
Bug: 183661625
Change-Id: I983b0d9d7a5ab417e74feae9dadf4d472d277b20
When an app is proxying access to runtime permission protected
data it needs to check whether the calling app has a permission
to the data it is about to proxy which leaves a trace in app ops
that the requesting app perofmed a data access. However, then the
app doing the work needs to get the protected data itself from the
OS which access gets attributed only to itself. As a result there
are two data accesses in app ops where only the first one is a
proxy one that app A got access to Foo through app B - that is the
one we want to show in the permission tracking UIs - and one
for the data access - that is the one we would want to blame on
the calling app, and in fact, these two accesses should be one -
that app A accessed Foo though B. This limitation requires fragile
one off workarounds where both accesses use the same attribution
tag and sys UI has hardcoded rules to dedupe. Since this is not
documented we cannot expect that the ecosystem would reliably
do this workaround in apps that that the workaround in the OS
would be respected by every OEM.
This change adds a mechaism to resolve this issue. It allows for
an app to create an attribution context for another app and then
any private data access thorugh this context would result in a
single app op blame that A accessed Foo though B, i.e. we no longer
have double accounting. Also this can be nested through apps, e.g.
app A asks app B which asks app C for contacts. In this case app
B creates an attribution context for app A and calls into app C
which creates an attribution context for app B. When app C gets
contacts the entire attribution chain would get a porper, single
blame: that C accessed the data, that B got the data from C, and
that A got the data form B. Furthermore, this mechanism ensures
that apps cannot forget to check permissions for the caller
before proxying private data. In our example B and C don't need
to check the permisisons for A and B, respectively, since the
permisisons for the entire attribution chain are checked before
data delivery. Attribution chains are not forgeable preventing
a bad actor to create an arbitrary one - each attribution is
created by the app it refers to and points to a chain of
attributions created by their corresponding apps.
This change also fixes a bug where all content provider accesses
were double counted in app ops due to double noting. While at
this it also fixes that apps can now access their own last ops.
There was a bug where one could not pass null getting the attributed
ops from a historical package ops while this is a valid use case
since if there is no attribution everything is mapped to the null
tag. There were some app op APIs not being piped thorough the app
ops delegate and by extension through the app ops policy. Also
now that we have nice way to express the permission chain in a
call we no longer need the special casing in activity manager to
handle content provider accesses through the OS. Fixed a bug
where we don't properly handle the android.os.shell calls with
an invlaid tag which was failing while the shell can do any tag.
Finally, to ensure the mechanims is validated and works end-to-end
we are adding support for a voice recognizer to blame the client
app for the mic access. The recognition service can create a blaming
context when opening the mic and if the mic is open, which would
do all permission checks, we would not do so again. Since changes
to PermissionChercker for handling attribution sources were made
the CL also hooks up renounced permissoins in the request permission
flow and in the permission checks.
bug:158792096
bug:180647319
Test:atest CtsPermissionsTestCases
atest CtsPermissions2TestCases
atest CtsPermissions3TestCases
atest CtsPermissions4TestCases
atest CtsPermissions5TestCases
atest CtsAppOpsTestCases
atest CtsAppOps2TestCases
Change-Id: Ib04585515d3dc3956966005ae9d94955b2f3ee08
Tooling run with the shell needs to be able to sample sensors above
200hz to facilitate with running tests.
Fixes: 183240340
Test: Run tool that requires the permission to sample at a high rate
Change-Id: Ic6782ea5afe750d3ec3167d11eef791881dceb53
An upcoming platform change is introducing a new "Nearby devices"
runtime permission which contains the new BLUETOOTH_CONNECT and
BLUETOOTH_SCAN permissions.
We have logic in place to use <split-permission> to translate the
older BLUETOOTH and BLUETOOTH_ADMIN permissions into these new
runtime permissions, but modern apps will need to pivot to
requesting them directly as part of targeting Android S.
This change requests both the old and new permissions to avoid
breakage while the new permission enforcement is being phased in.
Bug: 181813006
Test: atest CtsPermission2TestCases
Test: atest CtsPermission3TestCases
Test: atest CtsStatsdAtomHostTestCases
Change-Id: I39f45e7d22d132d44c84017cd98e6d9e98533c7f
I've decided to use a new permission since it needs to be added to
the settings app, which doesn't have INTERNAL_SYSTEM_WINDOW permission,
so I didn't want to add it as it may enable it to do some other things
it's not supposed to do.
Bug: 182448615
Test: atest android.widget.cts.ToastTest as regression test
Test: atest NotificationManagerServiceTest
Change-Id: I6adc84856f1fe9c33e0ad8470e7248a20587a1e9
Created a new permission to allow setting and verifying lock screen
credentials.
Test: N/A
Bug: 182260585
Change-Id: I3cf624f063ba582bc8d3b6aeeb11a46a2ab37636
Add permission for app hibernation state manipulation.
Bug: 183058954
Test: run hibernation job and confirm the API works for
PermissionController
Change-Id: Id57ee57f49710d0b8a49a4ec561800db43089f87
We added a new permission "MANAGE_HOTWORD_DETECTION" to allow
the application that held this permission to be able to use
setHotwordDetectionServiceConfig functions.
In order to avoid the feature leakage, we submit the change
about Shell in internal branch.
Bug: 178346114
Test: atest CtsVoiceInteractionTestCases
Test: atest PermissionPolicyTest
Change-Id: I8829c3c389fb5fe4b06ffcf21870db50fa2ede4b
Created a new permission to allow access to device audio
state and granted it to shell.
Test: N/A
Bug: 182260585
Change-Id: If1bfcb1341402717fec74cc704caa7e1eb18fa2e
There is no security risk in getFontConfig without calling permissions
but for keeping compatibility it is recommended to have permissions
to all (non-mainline) system APIs.
To be able to test these APIs, grant UPDATE_FONTS permission to shell.
Bug: 181796732
Test: atest FontManagerTest
Change-Id: Ic1f663e1e01f3625a076e68949f717366e79f5fa
This adds a permission that allows the holder to provide the source
package when setting the primary clip in clipboard. This will be done
using a new system API.
This is needed to ensure that the clipboard access notifications can be
properly attributed. For example, when a copy is performed through the
share sheet, the data should be attributed to the app that opened the
share sheet, not Android System.
Bug: 180577866
Test: builds
Change-Id: If3193d476fa923b849b505ad8b6dd893a2feae8f
BIND_VOICE_INTERACTION permission was added for GTS test code usage.
The GTS test cases relying on this permission previously have been
refactored to not require the permision any longer.
Bug: 178984748
Test: gts-tradefed run gts -m GtsAssistIntentTestCases
Change-Id: I6811b929d65400af39e17c75c638bc2c1fd9ef7e
1. Add shell command to allow a temporary override of the
TranslationService that helps e2e CTS tests.
2. Add permission to allow the shell call the UiTranslationManager
APIs for the tests.
3. Dump translation systemservice and activity translation related
information to help debugging
We don't want to leak translation feature now, so we submit the
change about Shell in internal branch.
Bug: 179047265
Test: manual.
1. Switch to temp TranslationService by "adb shell cmd transformer set
<myTranslationService> 12000" and make sure only the same app can
access the APIs when switching to the temp service.
2. adb shell dumpsys transformer
3. adb shell dumpsys activity <myactivity> --translation
(We set "transformer" now to prevent feature leak, the final value is
translation)
Change-Id: I2573b7ea226bd805a951f8346d5370d9c9776364
