Now that we have LocalCallingIdentity, we can start caching it in
very narrow cases. We must be careful to not cache too long, since
any changes to granted permissions for the UID mean we need to
re-evaluate any cached answers.
The best middle-ground for this in the Q release is to use an active
camera session as a proxy for when we should create a cache object
and then later invalidate it. (It's very unlikely that a user
changes permissions while actively using the camera, and this is
a strong signal that the caller is sensitive to performance.)
Many other sprinkled optimizations to avoid extra binder calls into
the OS, such as aggressively caching VolumeInfo related details.
Track IDs that are owned by each LocalCallingIdentity, to speed up
all future security checks.
Dispatch all change notifications asynchronously, and delay them by
several seconds while the camera is being actively used, to give
more important foreground work a fighting chance. Invalidate
thumbnails asynchronously.
Optimizations to ModernMediaScanner where it's safe to skip the
"reconcile" and "clean" steps when we're focused on a single file
that we successfully scanned.
Local tests show this CL improves performance of a test app that
takes 100 rapid shots by 45%. (All the collective optimizations
done so far this week add up to a 70% improvement.)
Bug: 130758409
Test: atest --test-mapping packages/providers/MediaProvider
Exempt-From-Owner-Approval: trivial manifest change
Change-Id: I38cc826af47d41219ef44eae6fbd293caa0c01d5
Allows for testing APIs protected by this permission from CTS tests
Test: adb shell dumpsys package com.android.shell | grep "\bSTATUS_BAR:
granted=true" # should find the permission
Bug: 130178313
Change-Id: Ida0950664b98217d9c0801c0f19436c754ee6744
This change adds a mechanism for restricting permissions (only runtime
for now), so that an app cannot hold the permission if it is not white
listed. The whitelisting can happen at install or at any later point.
There are three whitelists: system: OS managed with default grants
and role holders being on it; upgrade: only OS puts on this list
apps when upgrading from a pre to post restriction permission database
version and OS and installer on record can remove; installer: only
the installer on record can add and remove (and the system of course).
Added a permission policy service that sits on top of permissions
and app ops and is responsible to sync between permissions and app
ops when there is an interdependecy in any direction.
Added versioning to the runtime permissions database to allow operations
that need to be done once on upgrade such as adding all permissions held
by apps pre upgrade to the upgrade whitelist if the new permisison version
inctroduces a new restricted permission. The upgrade logic is in the
permission controller and we will eventually put the default grants there.
NOTE: This change is reacting to a VP feedback for how we would handle
SMS/CallLog restriction as we pivoted from role based approach to roles
for things the user would understand plus whitelist for everything else.
This would also help us roll out softly the storage permisison as there
is too much churm coming from developer feedback.
Exempt-From-Owner-Approval: trivial change due to APi adjustment
Test: atest CtsAppSecurityHostTestCases:android.appsecurity.cts.PermissionsHostTest
Test: atest CtsPermissionTestCases
Test: atest CtsPermission2TestCases
Test: atest RoleManagerTestCases
bug:124769181
Change-Id: Ic48e3c728387ecf02f89d517ba1fe785ab9c75fd
Add NETWORK_SCAN to shell permissions to enable CTS testing of the
network scan changes
Bug: 126779616
Test: CTS
Change-Id: I1f75c9005620b3b0e06f066677cba6190f1d266c
Add Shell permission for new CTS tests to test the multi-display
functionality in WallpaperService/WallpaperManagerService.
Bug: 123707989
Test: atest WallpaperManagerMultiDisplayTests
Test: atest ActivityManagerMultiDisplayTests
Change-Id: Id97db050a0b9d1940c2dfaa793fbe526df578105
This change adds PACKET_KEEPALIVE_OFFLOAD to shell, which allows
shell or code with shell permission identity to use privileged
tcp keepalive offload API.
Bug: 114151147
Test: -atest ConnectivityManagerTest#testCreateTcpKeepalive
-build, flash, boot
Change-Id: Ib6660a5eaa72f83042596481452be4d415383f02
Shell app needs the permission when we run KeyguardManager CTS for
allowing private notifications as a privileged app.
Bug: 127351183
Test: m -j
Change-Id: I199bac8c8fed9ff0fc63b8c62f8002a6b273b28f
Only allow rollback to be enabled on the modules included in a mainline
update. We don't want to support rollbacks for all apks in general yet.
Enforce that only installers granted the MANAGE_ROLLBACKS permission can
enable rollback for a package.
Introduce a new TEST_MANAGE_ROLLBACKS permission that can be used to
enable rollback on packages that are not modules. This allows us to
continue testing rollbacks, given we can't do a mainline update as part
of the rollback tests.
Test: atest RollbackTest, with new tests for permissions added.
Bug: 128277794
Change-Id: I29ab9a750a1283592b8a855322ece516e42260ca
This commit adds a new permission for test networks, granted to the
shell permission identity.
Bug: 124519473
Test: In-progress CTS tests
Change-Id: I995b93a66d283b9e37381b616843dd44dbafe319
This allows testing relevant APIs in CTS tests. The listener itself
only gives the changed role name and user affected.
Bug: 125404675
Test: build
Merged-In: I5c979a26dae103ea1b633c2119c59363d8953aa2
Change-Id: I29ca1827e597d318cbd74ba3e70796c5853a9dc4
This allows testing relevant APIs in CTS tests. The listener itself
only gives the changed role name and user affected.
Bug: 125404675
Test: build
Change-Id: I5c979a26dae103ea1b633c2119c59363d8953aa2
Test Harness Mode is a feature for device farms that want to wipe
their devices after each test run. It stores the ADB keys in the
persistent partition (used for Factory Reset Protection) then performs
a factory reset by broadcasting the MASTER_CLEAR intent.
Upon rebooting, the Setup Wizard is skipped, and a few settings are set:
* Package Verifier is disabled
* Stay Awake While Charging is enabled
* OTA Updates are disabled
* Auto-Sync for accounts is disabled
Other apps may configure themselves differently in Test Harness Mode by
checking ActivityManager.isRunningInUserTestHarness()
Bug: 80137798
Test: make && fastboot flashall -w
Test: adb shell cmd testharness enable
Change-Id: I91285c056666e36ad0caf778bffc140a0656fcfa
signature|privileged|vendorPrivileged|oem
permission
And grant it to SystemUI and Shell (adb shell am start).
Bug: 110956953
Test: atest WmTests:ActivityStarterTests
Change-Id: I4885a9a62ee8d47a3aef85f0e34b746c3f51ca2b
This change is the main check in for the historical app op feature.
The idea is to store a historical data about past app op rejections,
accesses, and durations per op for any UID state indefinitely.
Keeping all operations on record is not practical as app ops are
very frequently performed. To address this we are storing aggregated
data as snapshots where we store for every UID and its packages
how many times each op was accessed, rejected, lasted as an aggregate.
To allow history scaling indefinitely we are taking a logarithmic
approach with only the most recent state stored in memory and all
preceding state stored on disk. State on disk is stored in separate
files where each preceding file, i.e. for an older period, would
cover X times longer period with X number of snapshots covering
X times longer period. Initially X is ten but can be tweaked. For
example, the first file could contain data for ten days with daily
snapshots, while the file for older period would have data
for a hundred days with snapshots every ten days, etc.
The implementation is optimized for fast history update and no impact
on system runtime performance and minimizing memory footprint. We
are lazily persisting state to disk on a dedicated thread as this is
slow. We are also reading the relevant historical files on a query
as this is very rare as opposed to state updates.
The base snapshot interval, i.e. snapshot time span, in the initial
iteration and the logarithmic step are configurable. These can be
changed dynamically and the history would be rewriten to take this
into account.
Test: atest CtsAppOpsTestCases
bug:111061782
Change-Id: I55c32c79911ba12b2ace58d2a782b8df1e6bff60
Require callers hold a new MANAGE_ROLLBACKS permission to interact with
the RollbackManager.
Bug: 112431924
Test: atest RollbackTest, with new test for permissions added,
and with selinux in permissive mode.
Test: atest CtsPermission2TestCases:PermissionPolicyTest
Change-Id: I73f4f3457d85be580670cd69c89066d2cc348186
1. decouple disconnectCause and preciseDisconnectCuase from
preciseCallState.
2. expose preciseCallState to SystemAPI and expose
onPreciseCallStateChanged to System API
3. remove/hide ImsReasonInfo from PreciseDisconnectCuase
4. expose DiconnectCuase and PreciseDisconnectCause to System API
5. new onDisconnectCauseChanged API on PhoneStateListener for CS call
and use ImsCallSessionListener for IMS call(imsreasonInfo)
6. add read_precise_phone_state to shell apk to enable GTS test
Bug: 119890559
Test: atest GtsGmscoreHostTestCases:TelephonyHostTest#testPhoneStateListener
Change-Id: If9256feff16b6bcaef1dfe194c2b0df2a48436b0
(cherry picked from commit 6a942d488a)
Merged-in: If9256feff16b6bcaef1dfe194c2b0df2a48436b0
1. decouple disconnectCause and preciseDisconnectCuase from
preciseCallState.
2. expose preciseCallState to SystemAPI and expose
onPreciseCallStateChanged to System API
3. remove/hide ImsReasonInfo from PreciseDisconnectCuase
4. expose DiconnectCuase and PreciseDisconnectCause to System API
5. new onDisconnectCauseChanged API on PhoneStateListener for CS call
and use ImsCallSessionListener for IMS call(imsreasonInfo)
6. add read_precise_phone_state to shell apk to enable GTS test
Bug: 119890559
Test: atest GtsGmscoreHostTestCases:TelephonyHostTest#testPhoneStateListener
Change-Id: If9256feff16b6bcaef1dfe194c2b0df2a48436b0
If a system component calls to a remote provider, and that provider
hangs, we end up burning that Binder thread until the remote process
is killed for some unrelated reason.
This change adds an API to detect these hangs, and kill the remote
process after a specific timeout, but only when the caller holds a
permission that lets them kill other apps.
Bug: 117635768
Test: atest android.content.cts.ContentResolverTest
Change-Id: I81b0d993d9d585cdeb5e2559c68052ba6cbbced9
Bunch of changes:
- Split public SmartSuggestionsService info ContentCaptureService and
AugmentedAutofillService
- Renamed 'intelligence' packages to either 'contentcapture' or
'autofil.augmented'
- Renamed internal packages and classes.
- Changed permissions, resource names, etc...
- Moved Augmented Autofill logic from IntelligeceManagerService (R.I.P.) to
Autofill.
- Optimized IPCs by passing a String instead of the InteractionSessionId
(that also solves the view -> service dependency).
Test: atest CtsContentCaptureServiceTestCases \
CtsAutoFillServiceTestCases \
FrameworksCoreTests:SettingsBackupTest
Test: manual verification with Augmented Autofill Service
Bug: 119638877
Bug: 117944706
Change-Id: I787fc2a0dbd9ad53e4d5edb0d2a9242346e4652d
This change adds the MANAGE_ROLE_HOLDERS permission to shell, which
allows shell or code with Shell permission identity to use privileged
RoleManager APIs.
Bug: 110557011
Test: build
Change-Id: I6b8be9eec2a1dfb169536cfcda9d21cb802df327
This creates the PowerManager APIs that allow apps with the
appropriate permissions to interact with Dynamic Power Saver.
Bug: 111450127
Test: WIP
Change-Id: I5b9483fa0fba81a4ade622b1f3dbaec580b68a67
It already has grant to clear data of application, and instant
application is a subset of that.
This permission is needed for correct performing of the test:
`android.appsecurity.cts.InstantCookieHostTest#
testCookieUpdateAndRetrieval`.
Bug: 77849650
Test: run several times in a row (at least two), note that first time
on the fresh DUT the result is always successful:
cts-tradefed run commandAndExit cts-dev \
-m CtsAppSecurityHostTestCases \
-t android.appsecurity.cts.InstantCookieHostTest#testCookieUpdateAndRetrieval
Change-Id: I2d6080259e22ebfa40481213238f569e0988d271
Signed-off-by: Sergii Piatakov <sergii.piatakov@globallogic.com>
A lot of CTS tests involve the clipboard and making all of them input
focus is somewhat wasteful and invasive, instead we will adopt the
shell's permissions when relevant.
Test: atest ClipboardManagerTest
Bug: 6229949
Change-Id: I10f07e89b0baead625464c2afd5da1e229a45473
This splits the
- review permissions
- individually control permissions
- consent to manage wireleess (wifi + bluetooth)
properties.
Almost all code cares only for the first and it is now always true.
Hence a lot of code can be simplified.
Bug: 110431654
Test: atest PermissionsHostTest
started pre-M app
Change-Id: I733cd476ccd0bf5eaa59e9a9506db34f57c6baee
