Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 513478d6 authored by Nate Myren's avatar Nate Myren Committed by Automerger Merge Worker
Browse files

RESTRICT AUTOMERGE Revoke SYSTEM_ALERT_WINDOW on upgrade past api 23 am: fba194b9 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/20036692



Change-Id: I21fb1d0c4fe17bc61cacac9e8c6e819625812efb
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents d830baa1 fba194b9

services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java

+41 −0
Original line number Diff line number Diff line
@@ -2134,6 +2134,46 @@ public class PermissionManagerServiceImpl implements PermissionManagerServiceInt 


    }



    /**

     * If the package was below api 23, got the SYSTEM_ALERT_WINDOW permission automatically, and

     * then updated past api 23, and the app does not satisfy any of the other SAW permission flags,

     * the permission should be revoked.

     *

     * @param newPackage The new package that was installed

     * @param oldPackage The old package that was updated

     */

    private void revokeSystemAlertWindowIfUpgradedPast23(

            @NonNull AndroidPackage newPackage,

            @NonNull AndroidPackage oldPackage) {

        if (oldPackage.getTargetSdkVersion() >= Build.VERSION_CODES.M

                || newPackage.getTargetSdkVersion() < Build.VERSION_CODES.M

                || !newPackage.getRequestedPermissions()

                .contains(Manifest.permission.SYSTEM_ALERT_WINDOW)) {

            return;

        }



        Permission saw;

        synchronized (mLock) {

            saw = mRegistry.getPermission(Manifest.permission.SYSTEM_ALERT_WINDOW);

        }

        final PackageStateInternal ps =

                mPackageManagerInt.getPackageStateInternal(newPackage.getPackageName());

        if (shouldGrantPermissionByProtectionFlags(newPackage, ps, saw, new ArraySet<>())

                || shouldGrantPermissionBySignature(newPackage, saw)) {

            return;

        }

        for (int userId : getAllUserIds()) {

            try {

                revokePermissionFromPackageForUser(newPackage.getPackageName(),

                        Manifest.permission.SYSTEM_ALERT_WINDOW, false, userId,

                        mDefaultPermissionCallback);

            } catch (IllegalStateException | SecurityException e) {

                Log.e(TAG, "unable to revoke SYSTEM_ALERT_WINDOW for "

                        + newPackage.getPackageName() + " user " + userId, e);

            }

        }

    }



    /**

     * We might auto-grant permissions if any permission of the group is already granted. Hence if

     * the group of a granted permission changes we need to revoke it to avoid having permissions of
@@ -4660,6 +4700,7 @@ public class PermissionManagerServiceImpl implements PermissionManagerServiceInt 
                if (hasOldPkg) {

                    revokeRuntimePermissionsIfGroupChangedInternal(pkg, oldPkg);

                    revokeStoragePermissionsIfScopeExpandedInternal(pkg, oldPkg);

                    revokeSystemAlertWindowIfUpgradedPast23(pkg, oldPkg);

                }

                if (hasPermissionDefinitionChanges) {

                    revokeRuntimePermissionsIfPermissionDefinitionChangedInternal(