Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7b9a9069 authored by Nate Myren's avatar Nate Myren Committed by Android Build Coastguard Worker
Browse files

Apps clearing self data shouldn't get permissions restored 

when an app calls clearApplicationUserData for itself, do not restore
default or role granted permissions. However, maintain a privileged
version that can.

Bug: 339109116
Test: atest ActivityManagerTest
Flag: EXEMPT CVE_FIX
(cherry picked from commit 8dba23c13100882f37d3792b5e0b43dc061f9d16)
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:e14f875f6b56dd1d599bfae46efd4b6350e2ef76
Merged-In: I84968fc0d6f51d2c38416403a1f2e0a9faf9589e
Change-Id: I84968fc0d6f51d2c38416403a1f2e0a9faf9589e
parent b88956f3

core/java/android/app/ActivityManager.java

+18 −3
Original line number Diff line number Diff line
@@ -3533,9 +3533,24 @@ public class ActivityManager { 
            Manifest.permission.ACCESS_INSTANT_APPS})

    @UnsupportedAppUsage

    public boolean clearApplicationUserData(String packageName, IPackageDataObserver observer) {

        return clearApplicationUserData(packageName, observer, true);

    }



    /**

     * @hide

     */

    @RequiresPermission(anyOf = {Manifest.permission.CLEAR_APP_USER_DATA,

            Manifest.permission.ACCESS_INSTANT_APPS})

    private boolean clearApplicationUserData(String packageName, IPackageDataObserver observer,

            boolean restorePregrantedPermissions) {

        try {

            if (restorePregrantedPermissions) {

                return getService().clearApplicationUserData(packageName, false,

                        observer, mContext.getUserId());

            } else {

                return getService().clearApplicationUserDataWithoutPermissionReset(packageName,

                        false, observer, mContext.getUserId());

            }

        } catch (RemoteException e) {

            throw e.rethrowFromSystemServer();

        }
@@ -3553,7 +3568,7 @@ public class ActivityManager { 
     *     data be erased; {@code false} otherwise.

     */

    public boolean clearApplicationUserData() {

        return clearApplicationUserData(mContext.getPackageName(), null);

        return clearApplicationUserData(mContext.getPackageName(), null, false);

    }



    /**

core/java/android/app/ApplicationPackageManager.java

+2 −1
Original line number Diff line number Diff line
@@ -2947,7 +2947,8 @@ public class ApplicationPackageManager extends PackageManager { 
    public void clearApplicationUserData(String packageName,

                                         IPackageDataObserver observer) {

        try {

            mPM.clearApplicationUserData(packageName, observer, getUserId());

            mPM.clearApplicationUserData(packageName, observer, getUserId(),

                    /* restorePregrantedPermissions */ true);

        } catch (RemoteException e) {

            throw e.rethrowFromSystemServer();

        }

core/java/android/app/IActivityManager.aidl

+2 −0
Original line number Diff line number Diff line
@@ -334,6 +334,8 @@ interface IActivityManager { 
    List<ActivityManager.ProcessErrorStateInfo> getProcessesInErrorState();

    boolean clearApplicationUserData(in String packageName, boolean keepState,

            in IPackageDataObserver observer, int userId);

    boolean clearApplicationUserDataWithoutPermissionReset(in String packageName, boolean keepState,

            in IPackageDataObserver observer, int userId);

    void stopAppForUser(in String packageName, int userId);

    /** Returns {@code false} if the callback could not be registered, {@true} otherwise. */

    boolean registerForegroundServiceObserver(in IForegroundServiceObserver callback);

core/java/android/content/pm/IPackageManager.aidl

+4 −1
Original line number Diff line number Diff line
@@ -499,9 +499,12 @@ interface IPackageManager { 
     * @param packageName The package name of the application whose cache

     * files need to be deleted

     * @param observer a callback used to notify when the operation is completed.

     * @param userId the user to delete application data for

     * @param restorePregrantedPermissions whether to restore the pre-granted permissions, or leave

     *        them untouched

     */

    @EnforcePermission("CLEAR_APP_USER_DATA")

    void clearApplicationUserData(in String packageName, IPackageDataObserver observer, int userId);

    void clearApplicationUserData(in String packageName, IPackageDataObserver observer, int userId, boolean restorePregrantedPermissions);



    /**

     * Clear the profile data of an application.

core/java/android/content/pm/PackageManager.java

+1 −0
Original line number Diff line number Diff line
@@ -9486,6 +9486,7 @@ public abstract class PackageManager { 
     */

    @SuppressWarnings("HiddenAbstractMethod")

    @UnsupportedAppUsage

    @RequiresPermission(Manifest.permission.CLEAR_APP_USER_DATA)

    public abstract void clearApplicationUserData(@NonNull String packageName,

            @Nullable IPackageDataObserver observer);

    /**