Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 91afb8ad authored by Hai Zhang's avatar Hai Zhang
Browse files

Remove retailDemo protection flag implemenetation in the new subsystem. 

This partially reverts commit 7e8b4c01.

Reason for revert: Retail demo now has a proper role.

Bug: 294122862
Test: presubmit
Change-Id: I07ee1ed5cb8538ac62298f73777214cdcddac90f
parent f2906c1c

services/permission/java/com/android/server/permission/access/AccessCheckingService.kt

+41 −61
Original line number Diff line number Diff line
@@ -16,7 +16,6 @@ 


package com.android.server.permission.access



import android.app.admin.DevicePolicyManagerInternal

import android.content.Context

import android.content.pm.PackageManager

import android.content.pm.PackageManagerInternal
@@ -75,7 +74,7 @@ class AccessCheckingService(context: Context) : SystemService(context) { 


        val userIds = MutableIntSet(userManagerService.userIdsIncludingPreCreated)

        val (packageStates, disabledSystemPackageStates) = packageManagerLocal.allPackageStates

        val knownPackages = packageManagerInternal.getKnownPackages(packageStates)

        val knownPackages = packageManagerInternal.knownPackages

        val isLeanback = systemConfig.isLeanback

        val configPermissions = systemConfig.permissions

        val privilegedPermissionAllowlistPackages =
@@ -152,7 +151,7 @@ class AccessCheckingService(context: Context) : SystemService(context) { 
        isSystemUpdated: Boolean

    ) {

        val (packageStates, disabledSystemPackageStates) = packageManagerLocal.allPackageStates

        val knownPackages = packageManagerInternal.getKnownPackages(packageStates)

        val knownPackages = packageManagerInternal.knownPackages

        mutateState {

            with(policy) {

                onStorageVolumeMounted(
@@ -169,7 +168,7 @@ class AccessCheckingService(context: Context) : SystemService(context) { 


    internal fun onPackageAdded(packageName: String) {

        val (packageStates, disabledSystemPackageStates) = packageManagerLocal.allPackageStates

        val knownPackages = packageManagerInternal.getKnownPackages(packageStates)

        val knownPackages = packageManagerInternal.knownPackages

        mutateState {

            with(policy) {

                onPackageAdded(
@@ -184,7 +183,7 @@ class AccessCheckingService(context: Context) : SystemService(context) { 


    internal fun onPackageRemoved(packageName: String, appId: Int) {

        val (packageStates, disabledSystemPackageStates) = packageManagerLocal.allPackageStates

        val knownPackages = packageManagerInternal.getKnownPackages(packageStates)

        val knownPackages = packageManagerInternal.knownPackages

        mutateState {

            with(policy) {

                onPackageRemoved(
@@ -200,7 +199,7 @@ class AccessCheckingService(context: Context) : SystemService(context) { 


    internal fun onPackageInstalled(packageName: String, userId: Int) {

        val (packageStates, disabledSystemPackageStates) = packageManagerLocal.allPackageStates

        val knownPackages = packageManagerInternal.getKnownPackages(packageStates)

        val knownPackages = packageManagerInternal.knownPackages

        mutateState {

            with(policy) {

                onPackageInstalled(
@@ -216,7 +215,7 @@ class AccessCheckingService(context: Context) : SystemService(context) { 


    internal fun onPackageUninstalled(packageName: String, appId: Int, userId: Int) {

        val (packageStates, disabledSystemPackageStates) = packageManagerLocal.allPackageStates

        val knownPackages = packageManagerInternal.getKnownPackages(packageStates)

        val knownPackages = packageManagerInternal.knownPackages

        mutateState {

            with(policy) {

                onPackageUninstalled(
@@ -232,68 +231,49 @@ class AccessCheckingService(context: Context) : SystemService(context) { 
    }



    internal fun onSystemReady() {

        val (packageStates, disabledSystemPackageStates) = packageManagerLocal.allPackageStates

        val knownPackages = packageManagerInternal.getKnownPackages(packageStates)

        mutateState {

            with(policy) {

                onSystemReady(packageStates, disabledSystemPackageStates, knownPackages)

            }

        }

        mutateState { with(policy) { onSystemReady() } }

    }



    private val PackageManagerLocal.allPackageStates:

        Pair<Map<String, PackageState>, Map<String, PackageState>>

        get() = withUnfilteredSnapshot().use { it.packageStates to it.disabledSystemPackageStates }



    private fun PackageManagerInternal.getKnownPackages(

        packageStates: Map<String, PackageState>

    ): IntMap<Array<String>> =

    private val PackageManagerInternal.knownPackages: IntMap<Array<String>>

        get() =

            MutableIntMap<Array<String>>().apply {

            this[KnownPackages.PACKAGE_INSTALLER] =

                getKnownPackageNames(KnownPackages.PACKAGE_INSTALLER, UserHandle.USER_SYSTEM)

            this[KnownPackages.PACKAGE_PERMISSION_CONTROLLER] =

                getKnownPackageNames(

                    KnownPackages.PACKAGE_PERMISSION_CONTROLLER,

                    UserHandle.USER_SYSTEM

                this[KnownPackages.PACKAGE_INSTALLER] = getKnownPackageNames(

                    KnownPackages.PACKAGE_INSTALLER, UserHandle.USER_SYSTEM

                )

            this[KnownPackages.PACKAGE_VERIFIER] =

                getKnownPackageNames(KnownPackages.PACKAGE_VERIFIER, UserHandle.USER_SYSTEM)

            this[KnownPackages.PACKAGE_SETUP_WIZARD] =

                getKnownPackageNames(KnownPackages.PACKAGE_SETUP_WIZARD, UserHandle.USER_SYSTEM)

            this[KnownPackages.PACKAGE_SYSTEM_TEXT_CLASSIFIER] =

                getKnownPackageNames(

                    KnownPackages.PACKAGE_SYSTEM_TEXT_CLASSIFIER,

                    UserHandle.USER_SYSTEM

                this[KnownPackages.PACKAGE_PERMISSION_CONTROLLER] = getKnownPackageNames(

                    KnownPackages.PACKAGE_PERMISSION_CONTROLLER, UserHandle.USER_SYSTEM

                )

            this[KnownPackages.PACKAGE_CONFIGURATOR] =

                getKnownPackageNames(KnownPackages.PACKAGE_CONFIGURATOR, UserHandle.USER_SYSTEM)

            this[KnownPackages.PACKAGE_INCIDENT_REPORT_APPROVER] =

                getKnownPackageNames(

                    KnownPackages.PACKAGE_INCIDENT_REPORT_APPROVER,

                    UserHandle.USER_SYSTEM

                this[KnownPackages.PACKAGE_VERIFIER] = getKnownPackageNames(

                    KnownPackages.PACKAGE_VERIFIER, UserHandle.USER_SYSTEM

                )

                this[KnownPackages.PACKAGE_SETUP_WIZARD] = getKnownPackageNames(

                    KnownPackages.PACKAGE_SETUP_WIZARD, UserHandle.USER_SYSTEM

                )

                this[KnownPackages.PACKAGE_SYSTEM_TEXT_CLASSIFIER] = getKnownPackageNames(

                    KnownPackages.PACKAGE_SYSTEM_TEXT_CLASSIFIER, UserHandle.USER_SYSTEM

                )

                this[KnownPackages.PACKAGE_CONFIGURATOR] = getKnownPackageNames(

                    KnownPackages.PACKAGE_CONFIGURATOR, UserHandle.USER_SYSTEM

                )

                this[KnownPackages.PACKAGE_INCIDENT_REPORT_APPROVER] = getKnownPackageNames(

                    KnownPackages.PACKAGE_INCIDENT_REPORT_APPROVER, UserHandle.USER_SYSTEM

                )

                this[KnownPackages.PACKAGE_APP_PREDICTOR] = getKnownPackageNames(

                    KnownPackages.PACKAGE_APP_PREDICTOR, UserHandle.USER_SYSTEM

                )

                this[KnownPackages.PACKAGE_COMPANION] = getKnownPackageNames(

                    KnownPackages.PACKAGE_COMPANION, UserHandle.USER_SYSTEM

                )

                this[KnownPackages.PACKAGE_RETAIL_DEMO] = getKnownPackageNames(

                    KnownPackages.PACKAGE_RETAIL_DEMO, UserHandle.USER_SYSTEM

                )

                this[KnownPackages.PACKAGE_RECENTS] = getKnownPackageNames(

                    KnownPackages.PACKAGE_RECENTS, UserHandle.USER_SYSTEM

                )

            this[KnownPackages.PACKAGE_APP_PREDICTOR] =

                getKnownPackageNames(KnownPackages.PACKAGE_APP_PREDICTOR, UserHandle.USER_SYSTEM)

            this[KnownPackages.PACKAGE_COMPANION] =

                getKnownPackageNames(KnownPackages.PACKAGE_COMPANION, UserHandle.USER_SYSTEM)

            this[KnownPackages.PACKAGE_RETAIL_DEMO] =

                getKnownPackageNames(KnownPackages.PACKAGE_RETAIL_DEMO, UserHandle.USER_SYSTEM)

                    .filter { isProfileOwner(it, packageStates) }

                    .toTypedArray()

            this[KnownPackages.PACKAGE_RECENTS] =

                getKnownPackageNames(KnownPackages.PACKAGE_RECENTS, UserHandle.USER_SYSTEM)

        }



    private fun isProfileOwner(

        packageName: String,

        packageStates: Map<String, PackageState>

    ): Boolean {

        val appId = packageStates[packageName]?.appId ?: return false

        val devicePolicyManagerInternal =

            LocalServices.getService(DevicePolicyManagerInternal::class.java) ?: return false

        // TODO(b/169395065): Figure out if this flow makes sense in Device Owner mode.

        return devicePolicyManagerInternal.isActiveProfileOwner(appId) ||

            devicePolicyManagerInternal.isActiveDeviceOwner(appId)

            }



    @OptIn(ExperimentalContracts::class)

services/permission/java/com/android/server/permission/access/AccessPolicy.kt

+2 −11
Original line number Diff line number Diff line
@@ -262,17 +262,8 @@ private constructor( 
        forEachSchemePolicy { with(it) { onPackageUninstalled(packageName, appId, userId) } }

    }



    fun MutateStateScope.onSystemReady(

        packageStates: Map<String, PackageState>,

        disabledSystemPackageStates: Map<String, PackageState>,

        knownPackages: IntMap<Array<String>>

    ) {

        newState.mutateExternalState().apply {

            setPackageStates(packageStates)

            setDisabledSystemPackageStates(disabledSystemPackageStates)

            setKnownPackages(knownPackages)

            setSystemReady(true)

        }

    fun MutateStateScope.onSystemReady() {

        newState.mutateExternalState().setSystemReady(true)

        forEachSchemePolicy { with(it) { onSystemReady() } }

    }

services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt

+0 −30
Original line number Diff line number Diff line
@@ -1448,15 +1448,6 @@ class AppIdPermissionPolicy : SchemePolicy() { 
            // Special permissions for the system companion device manager.

            return true

        }

        if (

            permission.isRetailDemo &&

                packageName in knownPackages[KnownPackages.PACKAGE_RETAIL_DEMO]!!

        ) {

            // Special permission granted only to the OEM specified retail demo app.

            // Note that the original code was passing app ID as UID, so this behavior is kept

            // unchanged.

            return true

        }

        if (permission.isRecents && packageName in knownPackages[KnownPackages.PACKAGE_RECENTS]!!) {

            // Special permission for the recents app.

            return true
@@ -1511,27 +1502,6 @@ class AppIdPermissionPolicy : SchemePolicy() { 
    }



    override fun MutateStateScope.onSystemReady() {

        // HACK: PACKAGE_USAGE_STATS is the only permission with the retailDemo protection flag,

        // and we have to wait until DevicePolicyManagerService is started to know whether the

        // retail demo package is a profile owner so that it can have the permission.

        // Since there's no simple callback for profile owner change, and we are deprecating and

        // removing the retailDemo protection flag in favor of a proper role soon, we can just

        // re-evaluate the permission here, which is also how the old implementation has been

        // working.

        // TODO: Partially revert ag/22690114 once we can remove support for the retailDemo

        //  protection flag.

        val externalState = newState.externalState

        for (packageName in externalState.knownPackages[KnownPackages.PACKAGE_RETAIL_DEMO]!!) {

            val appId = externalState.packageStates[packageName]?.appId ?: continue

            newState.userStates.forEachIndexed { _, userId, _ ->

                evaluatePermissionState(

                    appId,

                    userId,

                    Manifest.permission.PACKAGE_USAGE_STATS,

                    null

                )

            }

        }

        if (!privilegedPermissionAllowlistViolations.isEmpty()) {

            throw IllegalStateException(

                "Signature|privileged permissions not in privileged" +