Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 63777c0c authored by Hai Zhang's avatar Hai Zhang Committed by Android Build Coastguard Worker
Browse files

Revoke internal permissions upon owner change. 

Similar to runtime permissions.

Bug: 195338390
Test: manual
Change-Id: I4f35ef021629810ea8854de2582c57b899b46db0
(cherry picked from commit ce576f8f)
parent 57f6ccc1

services/core/java/com/android/server/pm/permission/Permission.java

+4 −3
Original line number Diff line number Diff line
@@ -480,9 +480,10 @@ public final class Permission { 
            r.append("DUP:");

            r.append(permissionInfo.name);

        }

        if (permission.isRuntime() && (ownerChanged || wasNonRuntime)) {

            // If this is a runtime permission and the owner has changed, or this wasn't a runtime

            // permission, then permission state should be cleaned up

        if ((permission.isInternal() && ownerChanged)

                || (permission.isRuntime() && (ownerChanged || wasNonRuntime))) {

            // If this is an internal/runtime permission and the owner has changed, or this wasn't a

            // runtime permission, then permission state should be cleaned up.

            permission.mDefinitionChanged = true;

        }

        if (PackageManagerService.DEBUG_PACKAGE_SCANNING && r != null) {

services/core/java/com/android/server/pm/permission/PermissionManagerService.java

+17 −8
Original line number Diff line number Diff line
@@ -1643,7 +1643,8 @@ public class PermissionManagerService extends IPermissionManager.Stub { 
            isRolePermission = permission.isRole();

        }

        final boolean mayRevokeRolePermission = isRolePermission

                && mayManageRolePermission(callingUid);

                // Allow ourselves to revoke role permissions due to definition changes.

                && (callingUid == Process.myUid() || mayManageRolePermission(callingUid));



        final boolean isRuntimePermission;

        synchronized (mLock) {
@@ -2321,11 +2322,13 @@ public class PermissionManagerService extends IPermissionManager.Stub { 


        for (int permNum = 0; permNum < numPermissions; permNum++) {

            final String permName = permissionsToRevoke.get(permNum);

            final boolean isInternalPermission;

            synchronized (mLock) {

                final Permission bp = mRegistry.getPermission(permName);

                if (bp == null || !bp.isRuntime()) {

                if (bp == null || !(bp.isInternal() || bp.isRuntime())) {

                    continue;

                }

                isInternalPermission = bp.isInternal();

            }

            mPackageManagerInt.forEachPackage(pkg -> {

                final String packageName = pkg.getPackageName();
@@ -2345,12 +2348,18 @@ public class PermissionManagerService extends IPermissionManager.Stub { 
                    if (permissionState == PackageManager.PERMISSION_GRANTED

                            && (flags & flagMask) == 0) {

                        final int uid = UserHandle.getUid(userId, appId);

                        if (isInternalPermission) {

                            EventLog.writeEvent(0x534e4554, "195338390", uid,

                                    "Revoking permission " + permName + " from package "

                                            + packageName + " due to definition change");

                        } else {

                            EventLog.writeEvent(0x534e4554, "154505240", uid,

                                    "Revoking permission " + permName + " from package "

                                            + packageName + " due to definition change");

                            EventLog.writeEvent(0x534e4554, "168319670", uid,

                                    "Revoking permission " + permName + " from package "

                                            + packageName + " due to definition change");

                        }

                        Slog.e(TAG, "Revoking permission " + permName + " from package "

                                + packageName + " due to definition change");

                        try {