Don't check apex when granting priv permission unless needed (67655a14) · Commits · e / os / android_frameworks_base

services/core/java/com/android/server/pm/permission/PermissionManagerService.java

+40 −36

Original line number	Diff line number	Diff line
		@@ -3319,17 +3319,19 @@ public class PermissionManagerService extends IPermissionManager.Stub {
		if (!privappPermissionsDisable && privilegedPermission && pkg.isPrivileged()
		&& !platformPackage && platformPermission) {
		if (!hasPrivappWhitelistEntry(perm, pkg)) {
		ApexManager apexMgr = ApexManager.getInstance();
		String apexContainingPkg = apexMgr.getActiveApexPackageNameContainingPackage(pkg);

		// Only enforce whitelist this on boot
		if (!mSystemReady
		// Updated system apps do not need to be whitelisted
		&& !pkgSetting.getPkgState().isUpdatedSystemApp()
		&& !pkgSetting.getPkgState().isUpdatedSystemApp()) {
		ApexManager apexMgr = ApexManager.getInstance();
		String apexContainingPkg = apexMgr.getActiveApexPackageNameContainingPackage(
		pkg);

		// Apps that are in updated apexs' do not need to be whitelisted
		&& (apexContainingPkg == null \|\| apexMgr.isFactory(
		apexMgr.getPackageInfo(apexContainingPkg, MATCH_ACTIVE_PACKAGE)))) {
		// it's only a reportable violation if the permission isn't explicitly denied
		if (apexContainingPkg == null \|\| apexMgr.isFactory(
		apexMgr.getPackageInfo(apexContainingPkg, MATCH_ACTIVE_PACKAGE))) {
		// it's only a reportable violation if the permission isn't explicitly
		// denied
		ArraySet<String> deniedPermissions = null;
		if (pkg.isVendor()) {
		deniedPermissions = SystemConfig.getInstance()
		@@ -3356,12 +3358,14 @@ public class PermissionManagerService extends IPermissionManager.Stub {
		mPrivappPermissionsViolations = new ArraySet<>();
		}
		mPrivappPermissionsViolations.add(
		pkg.getPackageName() + " (" + pkg.getCodePath() + "): " + perm);
		pkg.getPackageName() + " (" + pkg.getCodePath() + "): "
		+ perm);
		}
		} else {
		return false;
		}
		}
		}
		if (RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS_ENFORCE) {
		return false;
		}