Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c91a5e37 authored by Nate Myren's avatar Nate Myren Committed by mse1969
Browse files

[BACKPORT] Apps clearing self data shouldn't get permissions restored 

when an app calls clearApplicationUserData for itself, do not restore
default or role granted permissions. However, maintain a privileged
version that can.

Bug: 339109116
Test: atest ActivityManagerTest
Flag: EXEMPT CVE_FIX
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:86aab9fb0242fed4d773b2fbe7593810bc8577d8
Merged-In: I84968fc0d6f51d2c38416403a1f2e0a9faf9589e
Change-Id: I84968fc0d6f51d2c38416403a1f2e0a9faf9589e
parent 53958e68

core/java/android/app/ActivityManager.java

+18 −3
Original line number Diff line number Diff line
@@ -2921,9 +2921,24 @@ public class ActivityManager { 
            Manifest.permission.ACCESS_INSTANT_APPS})

    @UnsupportedAppUsage

    public boolean clearApplicationUserData(String packageName, IPackageDataObserver observer) {

        return clearApplicationUserData(packageName, observer, true);

    }



    /**

     * @hide

     */

    @RequiresPermission(anyOf = {Manifest.permission.CLEAR_APP_USER_DATA,

            Manifest.permission.ACCESS_INSTANT_APPS})

    private boolean clearApplicationUserData(String packageName, IPackageDataObserver observer,

            boolean restorePregrantedPermissions) {

        try {

            if (restorePregrantedPermissions) {

                return getService().clearApplicationUserData(packageName, false,

                        observer, mContext.getUserId());

            } else {

                return getService().clearApplicationUserDataWithoutPermissionReset(packageName,

                        false, observer, mContext.getUserId());

            }

        } catch (RemoteException e) {

            throw e.rethrowFromSystemServer();

        }
@@ -2941,7 +2956,7 @@ public class ActivityManager { 
     *     data be erased; {@code false} otherwise.

     */

    public boolean clearApplicationUserData() {

        return clearApplicationUserData(mContext.getPackageName(), null);

        return clearApplicationUserData(mContext.getPackageName(), null, false);

    }



    /**

core/java/android/app/ApplicationPackageManager.java

+2 −1
Original line number Diff line number Diff line
@@ -2800,7 +2800,8 @@ public class ApplicationPackageManager extends PackageManager { 
    public void clearApplicationUserData(String packageName,

                                         IPackageDataObserver observer) {

        try {

            mPM.clearApplicationUserData(packageName, observer, getUserId());

            mPM.clearApplicationUserData(packageName, observer, getUserId(),

                    /* restorePregrantedPermissions */ true);

        } catch (RemoteException e) {

            throw e.rethrowFromSystemServer();

        }

core/java/android/app/IActivityManager.aidl

+2 −0
Original line number Diff line number Diff line
@@ -281,6 +281,8 @@ interface IActivityManager { 
    List<ActivityManager.ProcessErrorStateInfo> getProcessesInErrorState();

    boolean clearApplicationUserData(in String packageName, boolean keepState,

            in IPackageDataObserver observer, int userId);

    boolean clearApplicationUserDataWithoutPermissionReset(in String packageName, boolean keepState,

            in IPackageDataObserver observer, int userId);

    void stopAppForUser(in String packageName, int userId);

    /** Returns {@code false} if the callback could not be registered, {@true} otherwise. */

    boolean registerForegroundServiceObserver(in IForegroundServiceObserver callback);

core/java/android/content/pm/IPackageManager.aidl

+4 −1
Original line number Diff line number Diff line
@@ -459,8 +459,11 @@ interface IPackageManager { 
     * @param packageName The package name of the application whose cache

     * files need to be deleted

     * @param observer a callback used to notify when the operation is completed.

     * @param userId the user to delete application data for

     * @param restorePregrantedPermissions whether to restore the pre-granted permissions, or leave

     *        them untouched

     */

    void clearApplicationUserData(in String packageName, IPackageDataObserver observer, int userId);

    void clearApplicationUserData(in String packageName, IPackageDataObserver observer, int userId, boolean restorePregrantedPermissions);



    /**

     * Clear the profile data of an application.

core/java/android/content/pm/PackageManager.java

+1 −0
Original line number Diff line number Diff line
@@ -8490,6 +8490,7 @@ public abstract class PackageManager { 
     */

    @SuppressWarnings("HiddenAbstractMethod")

    @UnsupportedAppUsage

    @RequiresPermission(Manifest.permission.CLEAR_APP_USER_DATA)

    public abstract void clearApplicationUserData(@NonNull String packageName,

            @Nullable IPackageDataObserver observer);

    /**