Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 933c8e06 authored by Philip P. Moltmann's avatar Philip P. Moltmann Committed by Android (Google) Code Review
Browse files

Merge changes from topics "policy_fixed_set_via_perm_controller", "protect-policy-flags" 

* changes:
  Ask Perm Controller to set policy-fixed perms
  Guard changing policy_fixed flag behind permission
parents e346f753 41df9f94

api/current.txt

+2 −2
Original line number Diff line number Diff line
@@ -6664,7 +6664,7 @@ package android.app.admin { 
    method public int getPasswordMinimumUpperCase(@Nullable android.content.ComponentName);

    method public int getPasswordQuality(@Nullable android.content.ComponentName);

    method @Nullable public android.app.admin.SystemUpdateInfo getPendingSystemUpdate(@NonNull android.content.ComponentName);

    method public int getPermissionGrantState(@Nullable android.content.ComponentName, String, String);

    method public int getPermissionGrantState(@Nullable android.content.ComponentName, @NonNull String, @NonNull String);

    method public int getPermissionPolicy(android.content.ComponentName);

    method @Nullable public java.util.List<java.lang.String> getPermittedAccessibilityServices(@NonNull android.content.ComponentName);

    method @Nullable public java.util.List<java.lang.String> getPermittedCrossProfileNotificationListeners(@NonNull android.content.ComponentName);
@@ -6775,7 +6775,7 @@ package android.app.admin { 
    method public void setPasswordMinimumSymbols(@NonNull android.content.ComponentName, int);

    method public void setPasswordMinimumUpperCase(@NonNull android.content.ComponentName, int);

    method public void setPasswordQuality(@NonNull android.content.ComponentName, int);

    method public boolean setPermissionGrantState(@NonNull android.content.ComponentName, String, String, int);

    method public boolean setPermissionGrantState(@NonNull android.content.ComponentName, @NonNull String, @NonNull String, int);

    method public void setPermissionPolicy(@NonNull android.content.ComponentName, int);

    method public boolean setPermittedAccessibilityServices(@NonNull android.content.ComponentName, java.util.List<java.lang.String>);

    method public boolean setPermittedCrossProfileNotificationListeners(@NonNull android.content.ComponentName, @Nullable java.util.List<java.lang.String>);

api/system-current.txt

+2 −0
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ package android { 
    field public static final String ACCESS_SHORTCUTS = "android.permission.ACCESS_SHORTCUTS";

    field public static final String ACCESS_SURFACE_FLINGER = "android.permission.ACCESS_SURFACE_FLINGER";

    field public static final String ACTIVITY_EMBEDDING = "android.permission.ACTIVITY_EMBEDDING";

    field public static final String ADJUST_RUNTIME_PERMISSIONS_POLICY = "android.permission.ADJUST_RUNTIME_PERMISSIONS_POLICY";

    field public static final String ALLOCATE_AGGRESSIVE = "android.permission.ALLOCATE_AGGRESSIVE";

    field public static final String ALLOW_ANY_CODEC_FOR_PLAYBACK = "android.permission.ALLOW_ANY_CODEC_FOR_PLAYBACK";

    field public static final String AMBIENT_WALLPAPER = "android.permission.AMBIENT_WALLPAPER";
@@ -5626,6 +5627,7 @@ package android.permission { 
    method @BinderThread public abstract void onRestoreRuntimePermissionsBackup(@NonNull android.os.UserHandle, @NonNull java.io.InputStream);

    method public abstract void onRevokeRuntimePermission(@NonNull String, @NonNull String);

    method @NonNull public abstract java.util.Map<java.lang.String,java.util.List<java.lang.String>> onRevokeRuntimePermissions(@NonNull java.util.Map<java.lang.String,java.util.List<java.lang.String>>, boolean, int, @NonNull String);

    method public abstract boolean onSetRuntimePermissionGrantStateByDeviceAdmin(@NonNull String, @NonNull String, @NonNull String, int);

    field public static final String SERVICE_INTERFACE = "android.permission.PermissionControllerService";

  }

































core/java/android/app/ApplicationPackageManager.java



+3
−1




























Original line number
Diff line number
Diff line








@@ -696,7 +696,9 @@ public class ApplicationPackageManager extends PackageManager {













            int flagMask, int flagValues, UserHandle user) {















        try {















            mPM.updatePermissionFlags(permissionName, packageName, flagMask,













                    flagValues, user.getIdentifier());













                    flagValues,













                    mContext.getApplicationInfo().targetSdkVersion >= Build.VERSION_CODES.Q,













                    user.getIdentifier());















        } catch (RemoteException e) {















            throw e.rethrowFromSystemServer();















        }

































core/java/android/app/admin/DevicePolicyManager.java



+38
−8




























Original line number
Diff line number
Diff line








@@ -59,6 +59,7 @@ import android.os.Build;













import android.os.Bundle;















import android.os.ParcelFileDescriptor;















import android.os.Parcelable;













import android.os.ParcelableException;















import android.os.PersistableBundle;















import android.os.Process;















import android.os.RemoteCallback;










@@ -115,6 +116,8 @@ import java.util.Arrays;













import java.util.Collections;















import java.util.List;















import java.util.Set;













import java.util.concurrent.CompletableFuture;













import java.util.concurrent.ExecutionException;















import java.util.concurrent.Executor;































/**










@@ -1575,6 +1578,19 @@ public class DevicePolicyManager {













     */















    public static final int PERMISSION_POLICY_AUTO_DENY = 2;





























    /**













     * Possible policy values for permissions.













     *













     * @hide













     */













    @IntDef(prefix = { "PERMISSION_GRANT_STATE_" }, value = {













            PERMISSION_GRANT_STATE_DEFAULT,













            PERMISSION_GRANT_STATE_GRANTED,













            PERMISSION_GRANT_STATE_DENIED













    })













    @Retention(RetentionPolicy.SOURCE)













    public @interface PermissionGrantState {}





























    /**















     * Runtime permission state: The user can manage the permission















     * through the UI.










@@ -8667,8 +8683,15 @@ public class DevicePolicyManager {













     * Setting the grant state to {@link #PERMISSION_GRANT_STATE_DEFAULT default} does not revoke















     * the permission. It retains the previous grant, if any.















     * <p/>













     * Permissions can be granted or revoked only for applications built with a













     * {@code targetSdkVersion} of {@link android.os.Build.VERSION_CODES#M} or later.













     * Device admins with a {@code targetSdkVersion} &lt; {@link android.os.Build.VERSION_CODES#Q}













     * cannot grant and revoke permissions for applications built with a {@code targetSdkVersion}













     * &lt; {@link android.os.Build.VERSION_CODES#M}.













     * <p/>













     * Admins with a {@code targetSdkVersion} &ge; {@link android.os.Build.VERSION_CODES#Q} can













     * grant and revoke permissions of all apps. Similar to the user revoking a permission from a













     * application built with a {@code targetSdkVersion} &lt;













     * {@link android.os.Build.VERSION_CODES#M} the app-op matching the permission is set to













     * {@link android.app.AppOpsManager#MODE_IGNORED}, but the permission stays granted.















     *















     * @param admin Which profile or device owner this request is associated with.















     * @param packageName The application to grant or revoke a permission to.









@@ -8684,14 +8707,21 @@ public class DevicePolicyManager {













     * @see #setDelegatedScopes















     * @see #DELEGATION_PERMISSION_GRANT















     */













    public boolean setPermissionGrantState(@NonNull ComponentName admin, String packageName,













            String permission, int grantState) {













    public boolean setPermissionGrantState(@NonNull ComponentName admin,













            @NonNull String packageName, @NonNull String permission,













            @PermissionGrantState int grantState) {















        throwIfParentInstance("setPermissionGrantState");















        try {













            return mService.setPermissionGrantState(admin, mContext.getPackageName(), packageName,













                    permission, grantState);













            CompletableFuture<Boolean> result = new CompletableFuture<>();



























            mService.setPermissionGrantState(admin, mContext.getPackageName(), packageName,













                    permission, grantState, new RemoteCallback((b) -> result.complete(b != null)));



























            return result.get();















        } catch (RemoteException re) {















            throw re.rethrowFromSystemServer();













        } catch (InterruptedException | ExecutionException e) {













            throw new RuntimeException(e);















        }















    }


























@@ -8719,8 +8749,8 @@ public class DevicePolicyManager {













     * @see #setDelegatedScopes















     * @see #DELEGATION_PERMISSION_GRANT















     */













    public int getPermissionGrantState(@Nullable ComponentName admin, String packageName,













            String permission) {













    public @PermissionGrantState int getPermissionGrantState(@Nullable ComponentName admin,













            @NonNull String packageName, @NonNull String permission) {















        throwIfParentInstance("getPermissionGrantState");















        try {















            return mService.getPermissionGrantState(admin, mContext.getPackageName(), packageName,

































core/java/android/app/admin/IDevicePolicyManager.aidl



+2
−2




























Original line number
Diff line number
Diff line








@@ -311,8 +311,8 @@ interface IDevicePolicyManager {





























    void setPermissionPolicy(in ComponentName admin, in String callerPackage, int policy);















    int  getPermissionPolicy(in ComponentName admin);













    boolean setPermissionGrantState(in ComponentName admin, in String callerPackage, String packageName,













            String permission, int grantState);













    void setPermissionGrantState(in ComponentName admin, in String callerPackage, String packageName,













            String permission, int grantState, in RemoteCallback resultReceiver);















    int getPermissionGrantState(in ComponentName admin, in String callerPackage, String packageName, String permission);















    boolean isProvisioningAllowed(String action, String packageName);















    int checkProvisioningPreCondition(String action, String packageName);