Merge "Don't allow permission change to runtime" (d3b9e316) · Commits · e / os / android_frameworks_base

services/core/java/com/android/server/pm/PackageManagerService.java

+14 −0

Original line number	Diff line number	Diff line
		@@ -15689,6 +15689,20 @@ public class PackageManagerService extends IPackageManager.Stub {
		+ perm.info.name + "; ignoring new declaration");
		pkg.permissions.remove(i);
		}
		} else if (!PLATFORM_PACKAGE_NAME.equals(pkg.packageName)) {
		// Prevent apps to change protection level to dangerous from any other
		// type as this would allow a privilege escalation where an app adds a
		// normal/signature permission in other app's group and later redefines
		// it as dangerous leading to the group auto-grant.
		if ((perm.info.protectionLevel & PermissionInfo.PROTECTION_MASK_BASE)
		== PermissionInfo.PROTECTION_DANGEROUS) {
		if (bp != null && !bp.isRuntime()) {
		Slog.w(TAG, "Package " + pkg.packageName + " trying to change a "
		+ "non-runtime permission " + perm.info.name
		+ " to runtime; keeping old protection level");
		perm.info.protectionLevel = bp.protectionLevel;
		}
		}
		}
		}
		}