Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2509b12e authored by Nate Myren's avatar Nate Myren
Browse files

RESTRICT AUTOMERGE Revoke SYSTEM_ALERT_WINDOW on upgrade past api 23 

Bug: 221040577
Test: atest PermissionTest23#testPre23AppsWithSystemAlertWindowGetDeniedOnUpgrade
Change-Id: I4b4605aaae107875811070dea6d031c5d9f25c96
parent ec6bffc8

services/core/java/com/android/server/pm/permission/PermissionManagerService.java

+41 −0
Original line number Diff line number Diff line
@@ -2248,6 +2248,46 @@ public class PermissionManagerService extends IPermissionManager.Stub { 


    }



    /**

     * If the package was below api 23, got the SYSTEM_ALERT_WINDOW permission automatically, and

     * then updated past api 23, and the app does not satisfy any of the other SAW permission flags,

     * the permission should be revoked.

     *

     * @param newPackage The new package that was installed

     * @param oldPackage The old package that was updated

     */

    private void revokeSystemAlertWindowIfUpgradedPast23(

            @NonNull AndroidPackage newPackage,

            @NonNull AndroidPackage oldPackage) {

        if (oldPackage.getTargetSdkVersion() >= Build.VERSION_CODES.M

                || newPackage.getTargetSdkVersion() < Build.VERSION_CODES.M

                || !newPackage.getRequestedPermissions()

                .contains(Manifest.permission.SYSTEM_ALERT_WINDOW)) {

            return;

        }



        Permission saw;

        synchronized (mLock) {

            saw = mRegistry.getPermission(Manifest.permission.SYSTEM_ALERT_WINDOW);

        }

        final PackageSetting ps = (PackageSetting)

                mPackageManagerInt.getPackageSetting(newPackage.getPackageName());

        if (shouldGrantPermissionByProtectionFlags(newPackage, ps, saw, new ArraySet<>())

                    || shouldGrantPermissionBySignature(newPackage, saw)) {

            return;

        }

        for (int userId : getAllUserIds()) {

            try {

                revokePermissionFromPackageForUser(newPackage.getPackageName(),

                        Manifest.permission.SYSTEM_ALERT_WINDOW, false, userId,

                        mDefaultPermissionCallback);

            } catch (IllegalStateException | SecurityException e) {

                Log.e(TAG, "unable to revoke SYSTEM_ALERT_WINDOW for "

                        + newPackage.getPackageName() + " user " + userId, e);

            }

        }

    }



    /**

     * We might auto-grant permissions if any permission of the group is already granted. Hence if

     * the group of a granted permission changes we need to revoke it to avoid having permissions of
@@ -4814,6 +4854,7 @@ public class PermissionManagerService extends IPermissionManager.Stub { 
                if (hasOldPkg) {

                    revokeRuntimePermissionsIfGroupChangedInternal(pkg, oldPkg);

                    revokeStoragePermissionsIfScopeExpandedInternal(pkg, oldPkg);

                    revokeSystemAlertWindowIfUpgradedPast23(pkg, oldPkg);

                }

                if (hasPermissionDefinitionChanges) {

                    revokeRuntimePermissionsIfPermissionDefinitionChangedInternal(