Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 62a8f713 authored by Roman Birg's avatar Roman Birg Committed by Adnan Begovic
Browse files

Explicitly declare which permissions can be granted via signature 



This moves the older <allow-permissions> implementation inline with the
newer one, which requires any permission that can be granted via a
signature to explicitly add the attribute allowViaWhitelist="true".

Change-Id: Ie9f9bf6e2138075b750c58090dcd7030eff174f1
Signed-off-by: default avatarRoman Birg <roman@cyngn.com>
parent 9c0efca1

core/res/AndroidManifest.xml

+23 −11
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ 
*/

-->

<manifest xmlns:android="http://schemas.android.com/apk/res/android"

    xmlns:androidprv="http://schemas.android.com/apk/prv/res/android"

    package="android" coreApp="true" android:sharedUserId="android.uid.system"

    android:sharedUserLabel="@string/android_system_label">
@@ -1317,7 +1318,8 @@ 
    <!-- @SystemApi Allows an application to write to internal media storage

         @hide  -->

    <permission android:name="android.permission.WRITE_MEDIA_STORAGE"

        android:protectionLevel="signature|privileged" />

        android:protectionLevel="signature|privileged"

        androidprv:allowViaWhitelist="true" />



    <!-- Allows an application to manage access to documents, usually as part

         of a document picker.
@@ -1723,7 +1725,8 @@ 
         interacting with the recovery (system update) system.

         @hide -->

    <permission android:name="android.permission.RECOVERY"

        android:protectionLevel="signature|privileged" />

        android:protectionLevel="signature|privileged"

        androidprv:allowViaWhitelist="true" />



    <!-- Allows the system to bind to an application's task services

         @hide -->
@@ -1747,7 +1750,8 @@ 
    <!-- @SystemApi Allows an application to read or write the secure system settings.

    <p>Not for use by third-party applications. -->

    <permission android:name="android.permission.WRITE_SECURE_SETTINGS"

        android:protectionLevel="signature|privileged|development" />

        android:protectionLevel="signature|privileged|development"

        androidprv:allowViaWhitelist="true" />



    <!-- @SystemApi Allows an application to retrieve state dump information from system services.

    <p>Not for use by third-party applications. -->
@@ -1883,7 +1887,8 @@ 
         @hide

    -->

    <permission android:name="android.permission.SET_ACTIVITY_WATCHER"

        android:protectionLevel="signature" />

        android:protectionLevel="signature"

        androidprv:allowViaWhitelist="true" />



    <!-- @SystemApi Allows an application to call the activity manager shutdown() API

         to put the higher-level system there into a shutdown state.
@@ -2130,7 +2135,8 @@ 
         get access to the frame buffer data.

         <p>Not for use by third-party applications. -->

    <permission android:name="android.permission.READ_FRAME_BUFFER"

        android:protectionLevel="signature|privileged" />

        android:protectionLevel="signature|privileged"

        androidprv:allowViaWhitelist="true" />



    <!-- Allows an application to use InputFlinger's low level features.

         @hide -->
@@ -2176,12 +2182,14 @@ 
    <!-- @SystemApi Allows an application to capture video output.

         <p>Not for use by third-party applications.</p> -->

    <permission android:name="android.permission.CAPTURE_VIDEO_OUTPUT"

        android:protectionLevel="signature|privileged" />

        android:protectionLevel="signature|privileged"

        androidprv:allowViaWhitelist="true" />



    <!-- @SystemApi Allows an application to capture secure video output.

         <p>Not for use by third-party applications.</p> -->

    <permission android:name="android.permission.CAPTURE_SECURE_VIDEO_OUTPUT"

        android:protectionLevel="signature|privileged" />

        android:protectionLevel="signature|privileged"

        androidprv:allowViaWhitelist="true" />



    <!-- @SystemApi Allows an application to know what content is playing and control its playback.

         <p>Not for use by third-party applications due to privacy of media consumption</p>  -->
@@ -2198,7 +2206,8 @@ 
    <!-- @SystemApi Required to be able to reboot the device.

    <p>Not for use by third-party applications. -->

    <permission android:name="android.permission.REBOOT"

        android:protectionLevel="signature|privileged" />

        android:protectionLevel="signature|privileged"

        androidprv:allowViaWhitelist="true" />



   <!-- @SystemApi Allows low-level access to power management.

        <p>Not for use by third-party applications.
@@ -2312,7 +2321,8 @@ 
    <p>Not for use by third-party applications.

         @hide pending API council -->

    <permission android:name="android.permission.BACKUP"

        android:protectionLevel="signature|privileged" />

        android:protectionLevel="signature|privileged"

        androidprv:allowViaWhitelist="true" />



    <!-- Allows a package to launch the secure full-backup confirmation UI.

         ONLY the system process may hold this permission.
@@ -2397,7 +2407,8 @@ 
    <!-- @SystemApi Allow an application to read and write the cache partition.

         @hide -->

    <permission android:name="android.permission.ACCESS_CACHE_FILESYSTEM"

        android:protectionLevel="signature|privileged" />

        android:protectionLevel="signature|privileged"

        androidprv:allowViaWhitelist="true" />



    <!-- Must be required by default container service so that only

         the system can bind to it and use it to copy
@@ -2508,7 +2519,8 @@ 
    <!-- Allows an application to control keyguard.  Only allowed for system processes.

        @hide -->

    <permission android:name="android.permission.CONTROL_KEYGUARD"

        android:protectionLevel="signature" />

        android:protectionLevel="signature"

        androidprv:allowViaWhitelist="true" />



    <!-- Allows an application to listen to trust changes.  Only allowed for system processes.

        @hide -->

services/core/java/com/android/server/pm/PackageManagerService.java

+2 −3
Original line number Diff line number Diff line
@@ -8630,8 +8630,7 @@ public class PackageManagerService extends IPackageManager.Stub { 
                        == PackageManager.SIGNATURE_MATCH);

        if (!allowed && (bp.protectionLevel

                & PermissionInfo.PROTECTION_FLAG_PRIVILEGED) != 0) {

            boolean allowedSig = isAllowedSignature(pkg, perm);

            if (isSystemApp(pkg) || allowedSig) {

            if (isSystemApp(pkg)) {

                // For updated system applications, a system permission

                if (pkg.isUpdatedSystemApp()) {

                    final PackageSetting sysPs = mSettings
@@ -8662,7 +8661,7 @@ public class PackageManagerService extends IPackageManager.Stub { 
                        }

                    }

                } else {

                    allowed = isPrivilegedApp(pkg) || allowedSig;

                    allowed = isPrivilegedApp(pkg);

                }

            }

        }