This change ensures that mNativePtr can be deleted only when its
ApkAssets is really inaccessible and prevents finalization race
conditions.
Bug: 159041693
Test: boot and add logs to ensure destructor runs
Change-Id: Iff0612fe6862a17b8c889d9e7ba230094e3cb14a
In-process API only applies to code in frameworks/base/services
so that CS mainline can't use these APIs. Thus, update these
in-process APIs to system APIs to support CS mainline usage.
Bug: 170593746
Test: atest FrameworksNetTests
Change-Id: I4c7c1e71dcb6448aed0107768b4ba8eecd3e11f7
Delegate the resetting of the INTERACT_ACROSS_PROFILES app-op to
DevicePolicyManager, which knows whether it should be pre-granted and
knows to apply it equally across all users in the profile group.
Further unit tests for DevicePolicyManagerInternal will be added in
b/175440570 when we have the better infra for that.
The CrossProfileAppsServiceImpl changes look more complex than they are.
They consist of the following:
- Inclusive language changes to 'allowlist'
- Static imports of permissions to improve readability
- Previously, the setInteractAcrossProfilesAppOp method would set the
app-op for every user within the profile group of the 'calling user'.
However, given that we are now exposing this as a server-side internal
API where we need to pass in a user ID (from AppOpsService), we don't
necessarily have the guarantee that the 'calling user' is in the same
profile group. So we split it up: the client-side API and AIDL API still
set the app-op for the calling profile group, whereas the internal API
sets the app-op for every user within the profile group of the provided
user. The changes simply abstract away references to the 'calling user
ID'.
Fixes: 166561076
Bug: 175440570
Test: atest services/robotests/src/com/android/server/pm/CrossProfileAppsServiceImplRoboTest.java --verbose -c
Test: manual
Change-Id: I2181fe66022aaf6c3e6d784c0569d2f41ab66537
If the parameter "packageName" is invalid, such as null or
empty string for package name, an IllegalArgumentException is thrown.
In PackageInstallerSession.transfer(packageName), in order to let
the throwing exception more close to the real situation, we throw
IllegalStateException rather than IllegalArgumentException when
one file isn't closed or the state is wrong.
Test: atest InstallSessionTransferTest
Bug: 158804946
Change-Id: Ib0a3e8dc19b829c7382791e622e0b86ee8b387e8
* changes:
Revert^2 "Cache resolved theme values"
Set resource id correctly when resolve fails
Revert^2 "libandroidfw hardening for IncFs"
idmap2: remove call to obsolete 'idmap2 verify' from valgrind.sh
idmap2: remove the 'scan' command
A number of permission-related methods were implemented in
ApplicationPackageManager by calling the IPermissionManager AIDL
interface. However since we are moving permission into module, the
AIDL inteface can't be an API and the implementions must be moved.
This change moves these methods into PermissionManager, with the
javadoc and interface from PackageManager and the implementation from
AppliationManager. The javadoc remains mostly the same except for
style and typo fixes. The API interface also remains the same except
for inclusive language changes since we are defining new one and have
a chance to fix them now.
We have to lazily get the PermissionManager instance because the
context passed in may be null for an instrumentation use case.
Bug: 158736025
Test: presubmit
Change-Id: I1c28433ca6200679a41e3518354fe03b866621b5
And move their implementation from PermissionManagerService to
LegacyPermissionService.
The DefaultPermissionGrantPolicy related methods are not APIs, and
are thus moved to LegacyPermissionManager and their usages are updated
to use LegacyPermissionManager.
The checkDeviceIdentifierAccess() method is also moved into
LegacyPermissionManager, because it's merely an application of
permission checking, not the permission management infra itself, and
there isn't great benefit in updating it. However since it is an API,
we still have to keep a delegate for it on PermissionManager, and make
the delegated method @SystemApi.
Bug: 158736025
Test: presubmit
Test: LegacyPermissionManagerServiceTest
Change-Id: Ic838f3685427217c8e0477551c3373258408983f
The shell command allows a temporary override of the recognition service so I can substitute a stub in cts tests. Also add permission for the shell to be able to invoke the recognition api for the sake of cts tests.
Bug: 164439465
Test: new test in topic
Change-Id: I4a8de616a70f0d6504b2eaf486d5641cb7872607
Bug: 174932174
Test: I solemnly swear I tested this conflict resolution.
Exempt-From-Owner-Approval: refactoring with team leads buy-in
Change-Id: I9262a08ffc1ccede8e519d0eed90ed2bfcf0232c
The 'scan' command has been replaced by 'create-multiple'. Remove the
unused code.
Also remove unused functions and #includes from FileUtils, and the
obsolete JNI plumbing.
Test: atest idmap2_tests OverlayDeviceTests OverlayHostTests
Change-Id: Iae073c13ce64b5db48f22f7e723bc8c0c5fcd2c9
Merged-In: Iae073c13ce64b5db48f22f7e723bc8c0c5fcd2c9
As general background, OWNERS files expedite code reviews by helping
code authors quickly find relevant reviewers, and they also ensure
that stakeholders are involved in code changes in their areas.
Some teams under frameworks/base/ have been using OWNERS files
successfully for many years, and we're ready to expand them to cover
more areas. Here's the historical coverage statistics for the last
two years of changes before these new OWNERS changes land:
-- 56% of changes are fully covered by OWNERS
-- 17% of changes are partially covered by OWNERS
-- 25% of changes have no OWNERS coverage
Working closely with team leads, we've now identified clear OWNERS on
a per-package basis, and we're using "include" directives whenever
possible to to simplify future maintenance. With this extensive
effort, we've now improved our coverage as follows:
-- 98% of changes are fully covered by OWNERS
-- 1% of changes are partially covered by OWNERS
-- 1% of changes have no OWNERS coverage
This specific change is automatically generated by a script from
detailed ownership information confirmed by team leads.
Bug: 174932174
Test: manual
Exempt-From-Owner-Approval: refactoring with team leads buy-in
Merged-In: I9789c97c1de8e5d962b48c29c57d82fe83729eba
Change-Id: I9789c97c1de8e5d962b48c29c57d82fe83729eba
This CL adds an "install scenario" field to several data structures used
by the Package Manager. This value will be used by a following CL to
adjust the invocation of dexopt based on the indicated use case.
Bug: 173137187
Test: build
Merged-In: I1d0df8edf85a598905a5e7509f6c811df5c20e2e
Change-Id: I1d0df8edf85a598905a5e7509f6c811df5c20e2e
Permissions with the new internal protection level are similar to
signature permissions in that they can be controlled internally by the
system via the specified protection flags, but they are no longer
granted according to signatures. This enables us to create role-only
permissions.
Bug: 158736025
Test: presubmit
Change-Id: Ie5f76f14d6e32b05b9113090e10b8a1a41a2d9da
Permissions with the role protection flag will be able to be managed
by role via grant/revokeRuntimePermission(), similar to development
permissions but only manageable by role.
Also fixed a bug that PermissionController can get any signature
permission.
Bug: 158736025
Test: presubmit
Change-Id: I49603cee91466a791be66055a922ba1a8bd08d4e
* changes:
Hand-migration to TypedXml interface.
Mechanically apply TypedXml refaster template.
Mechanical refactoring to new typed XML classes.
Additional hand-migration to TypedXml interface.
"Resolve" both human-readable and binary XML.
