Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d072d141 authored by Fyodor Kupolov's avatar Fyodor Kupolov
Browse files

Support disabled/log/enforce in ro.control_privapp_permissions 

Possible values:
 - disable - the feature is completely disabled - signature|privileged
   permissions are granted automatically without logging. Default behavior
 - log - log grants of signature|privileged permissions to privileged apps
   that were not whitelisted in /etc/permissions/privapp-permissions.xml.
 - enforce - enforce that only whitelisted permissions are granted.
   Only devices with ro.control_privapp_permission=enforce will pass CTS tests.

Test: Manual - device boots, permissions are granted
Bug:31008485
Change-Id: I24e0c75d2efc326c9fbec35efc92489313667212
parent 6fc01e04

core/java/com/android/internal/os/RoSystemProperties.java

+10 −2
Original line number Diff line number Diff line
@@ -27,8 +27,8 @@ public class RoSystemProperties { 
            SystemProperties.getInt("ro.debuggable", 0) == 1;

    public static final int FACTORYTEST =

            SystemProperties.getInt("ro.factorytest", 0);

    public static final boolean CONTROL_PRIVAPP_PERMISSIONS =

            SystemProperties.getBoolean("ro.control_privapp_permissions", false);

    public static final String CONTROL_PRIVAPP_PERMISSIONS =

            SystemProperties.get("ro.control_privapp_permissions");



    // ------ ro.config.* -------- //

    public static final boolean CONFIG_LOW_RAM =
@@ -50,4 +50,12 @@ public class RoSystemProperties { 
            "file".equalsIgnoreCase(CRYPTO_TYPE);

    public static final boolean CRYPTO_BLOCK_ENCRYPTED =

            "block".equalsIgnoreCase(CRYPTO_TYPE);



    public static final boolean CONTROL_PRIVAPP_PERMISSIONS_LOG =

            "log".equalsIgnoreCase(CONTROL_PRIVAPP_PERMISSIONS);

    public static final boolean CONTROL_PRIVAPP_PERMISSIONS_ENFORCE =

            "enforce".equalsIgnoreCase(CONTROL_PRIVAPP_PERMISSIONS);

    public static final boolean CONTROL_PRIVAPP_PERMISSIONS_DISABLE =

            !CONTROL_PRIVAPP_PERMISSIONS_LOG && !CONTROL_PRIVAPP_PERMISSIONS_ENFORCE;



}

services/core/java/com/android/server/pm/PackageManagerService.java

+6 −3
Original line number Diff line number Diff line
@@ -10522,18 +10522,21 @@ public class PackageManagerService extends IPackageManager.Stub { 
            BasePermission bp, PermissionsState origPermissions) {

        boolean privilegedPermission = (bp.protectionLevel

                & PermissionInfo.PROTECTION_FLAG_PRIVILEGED) != 0;

        boolean controlPrivappPermissions = RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS;

        boolean privappPermissionsDisable =

                RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS_DISABLE;

        boolean platformPermission = PLATFORM_PACKAGE_NAME.equals(bp.sourcePackage);

        boolean platformPackage = PLATFORM_PACKAGE_NAME.equals(pkg.packageName);

        if (controlPrivappPermissions && privilegedPermission && pkg.isPrivilegedApp()

        if (!privappPermissionsDisable && privilegedPermission && pkg.isPrivilegedApp()

                && !platformPackage && platformPermission) {

            ArraySet<String> wlPermissions = SystemConfig.getInstance()

                    .getPrivAppPermissions(pkg.packageName);

            boolean whitelisted = wlPermissions != null && wlPermissions.contains(perm);

            if (!whitelisted) {

                // Log for now. TODO Enforce permissions

                Slog.w(TAG, "Privileged permission " + perm + " for package "

                        + pkg.packageName + " - not in privapp-permissions whitelist");

                if (RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS_ENFORCE) {

                    return false;

                }

            }

        }

        boolean allowed = (compareSignatures(

services/tests/servicestests/src/com/android/server/pm/PackageManagerPresubmitTest.java

+2 −2
Original line number Diff line number Diff line
@@ -90,9 +90,9 @@ public class PackageManagerPresubmitTest { 
                boolean granted = (packageInfo.requestedPermissionsFlags[i]

                        & PackageInfo.REQUESTED_PERMISSION_GRANTED) != 0;

                assertTrue("Permission " + pName + " should be granted to " + testPackage, granted);

                // if CONTROL_PRIVAPP_PERMISSIONS enabled, platform permissions must be whitelisted

                // if privapp permissions are enforced, platform permissions must be whitelisted

                // in SystemConfig

                if (platformPermission && RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS) {

                if (platformPermission && RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS_ENFORCE) {

                    assertTrue("Permission " + pName

                                    + " should be declared in the xml file for package "

                                    + testPackage,