Grant installer and verifier install permissions robustly (3e7d977f) · Commits · e / os / android_frameworks_base

api/current.txt

+3 −1

Original line number	Diff line number	Diff line
		@@ -9465,10 +9465,12 @@ package android.content.pm {
		field public static final int PROTECTION_DANGEROUS = 1; // 0x1
		field public static final int PROTECTION_FLAG_APPOP = 64; // 0x40
		field public static final int PROTECTION_FLAG_DEVELOPMENT = 32; // 0x20
		field public static final int PROTECTION_FLAG_INSTALLER = 256; // 0x100
		field public static final int PROTECTION_FLAG_PRE23 = 128; // 0x80
		field public static final int PROTECTION_FLAG_SYSTEM = 16; // 0x10
		field public static final int PROTECTION_FLAG_VERIFIER = 512; // 0x200
		field public static final int PROTECTION_MASK_BASE = 15; // 0xf
		field public static final int PROTECTION_MASK_FLAGS = 240; // 0xf0
		field public static final int PROTECTION_MASK_FLAGS = 4080; // 0xff0
		field public static final int PROTECTION_NORMAL = 0; // 0x0
		field public static final int PROTECTION_SIGNATURE = 2; // 0x2
		field public static final int PROTECTION_SIGNATURE_OR_SYSTEM = 3; // 0x3

api/system-current.txt

+3 −1

Original line number	Diff line number	Diff line
		@@ -9800,10 +9800,12 @@ package android.content.pm {
		field public static final int PROTECTION_DANGEROUS = 1; // 0x1
		field public static final int PROTECTION_FLAG_APPOP = 64; // 0x40
		field public static final int PROTECTION_FLAG_DEVELOPMENT = 32; // 0x20
		field public static final int PROTECTION_FLAG_INSTALLER = 256; // 0x100
		field public static final int PROTECTION_FLAG_PRE23 = 128; // 0x80
		field public static final int PROTECTION_FLAG_SYSTEM = 16; // 0x10
		field public static final int PROTECTION_FLAG_VERIFIER = 512; // 0x200
		field public static final int PROTECTION_MASK_BASE = 15; // 0xf
		field public static final int PROTECTION_MASK_FLAGS = 240; // 0xf0
		field public static final int PROTECTION_MASK_FLAGS = 4080; // 0xff0
		field public static final int PROTECTION_NORMAL = 0; // 0x0
		field public static final int PROTECTION_SIGNATURE = 2; // 0x2
		field public static final int PROTECTION_SIGNATURE_OR_SYSTEM = 3; // 0x3

cmds/am/src/com/android/commands/am/Am.java

+4 −1

Original line number	Diff line number	Diff line
		@@ -74,6 +74,8 @@ import java.util.List;

		public class Am extends BaseCommand {

		private static final String SHELL_PACKAGE_NAME = "com.android.shell";

		private IActivityManager mAm;

		private int mStartFlags = 0;
		@@ -767,7 +769,8 @@ public class Am extends BaseCommand {
		return;
		}
		System.out.println("Starting service: " + intent);
		ComponentName cn = mAm.startService(null, intent, intent.getType(), null, mUserId);
		ComponentName cn = mAm.startService(null, intent, intent.getType(),
		SHELL_PACKAGE_NAME, mUserId);
		if (cn == null) {
		System.err.println("Error: Not found; no service started.");
		} else if (cn.getPackageName().equals("!")) {

core/java/android/content/pm/PermissionInfo.java

+15 −1

Original line number	Diff line number	Diff line
		@@ -82,6 +82,20 @@ public class PermissionInfo extends PackageItemInfo implements Parcelable {
		*/
		public static final int PROTECTION_FLAG_PRE23 = 0x80;

		/**
		* Additional flag for {@link #protectionLevel}, corresponding
		* to the <code>installer</code> value of
		* {@link android.R.attr#protectionLevel}.
		*/
		public static final int PROTECTION_FLAG_INSTALLER = 0x100;

		/**
		* Additional flag for {@link #protectionLevel}, corresponding
		* to the <code>verifier</code> value of
		* {@link android.R.attr#protectionLevel}.
		*/
		public static final int PROTECTION_FLAG_VERIFIER = 0x200;

		/**
		* Mask for {@link #protectionLevel}: the basic protection type.
		*/
		@@ -90,7 +104,7 @@ public class PermissionInfo extends PackageItemInfo implements Parcelable {
		/**
		* Mask for {@link #protectionLevel}: additional flag bits.
		*/
		public static final int PROTECTION_MASK_FLAGS = 0xf0;
		public static final int PROTECTION_MASK_FLAGS = 0xff0;

		/**
		* The level of access this permission is protecting, as per

core/res/AndroidManifest.xml

+5 −5

Original line number	Diff line number	Diff line
		@@ -1327,7 +1327,7 @@
		that removes restrictions on where broadcasts can be sent and allows other
		types of interactions. -->
		<permission android:name="android.permission.INTERACT_ACROSS_USERS_FULL"
		android:protectionLevel="signature" />
		android:protectionLevel="signature\|installer" />

		<!-- @SystemApi @hide Allows an application to call APIs that allow it to query and manage
		users on the device. This permission is not available to
		@@ -1769,7 +1769,7 @@
		<!-- @SystemApi Allows an application to update application operation statistics. Not for
		use by third party apps. @hide -->
		<permission android:name="android.permission.UPDATE_APP_OPS_STATS"
		android:protectionLevel="signature\|system" />
		android:protectionLevel="signature\|system\|installer" />

		<!-- @SystemApi Allows an application to open windows that are for use by parts
		of the system user interface.
		@@ -2016,7 +2016,7 @@
		@hide
		-->
		<permission android:name="android.permission.CLEAR_APP_USER_DATA"
		android:protectionLevel="signature" />
		android:protectionLevel="signature\|installer" />

		<!-- @SystemApi Allows an application to delete cache files.
		<p>Not for use by third-party applications. -->
		@@ -2041,7 +2041,7 @@

		<!-- @hide Allows an application to grant or revoke specific permissions. -->
		<permission android:name="android.permission.GRANT_REVOKE_PERMISSIONS"
		android:protectionLevel="signature" />
		android:protectionLevel="signature\|installer" />

		<!-- @hide Allows an application to observe permission changes. -->
		<permission android:name="android.permission.OBSERVE_GRANT_REVOKE_PERMISSIONS"
		@@ -2552,7 +2552,7 @@
		<p>Not for use by third-party applications.
		@hide -->
		<permission android:name="android.permission.KILL_UID"
		android:protectionLevel="signature" />
		android:protectionLevel="signature\|installer" />

		<!-- Allows applications to act as network scorers. @hide @SystemApi-->
		<permission android:name="android.permission.LOCAL_MAC_ADDRESS"