Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e217ee4d authored by Jeff Sharkey's avatar Jeff Sharkey
Browse files

Access to all users' external storage. 

System services holding this permission have external storage bound
one level higher, giving them access to all users' files.

Bug: 7003520
Change-Id: Ib2bcb8455740c713ebd01f71c9a2b89b4e642832
parent 08db9df1

core/java/android/os/Process.java

+2 −0
Original line number Diff line number Diff line
@@ -584,6 +584,8 @@ public class Process { 
            }

            if (mountExternal == Zygote.MOUNT_EXTERNAL_MULTIUSER) {

                argsForZygote.add("--mount-external-multiuser");

            } else if (mountExternal == Zygote.MOUNT_EXTERNAL_MULTIUSER_ALL) {

                argsForZygote.add("--mount-external-multiuser-all");

            }

            argsForZygote.add("--target-sdk-version=" + targetSdkVersion);

core/java/com/android/internal/os/ZygoteConnection.java

+2 −0
Original line number Diff line number Diff line
@@ -529,6 +529,8 @@ class ZygoteConnection { 
                    niceName = arg.substring(arg.indexOf('=') + 1);

                } else if (arg.equals("--mount-external-multiuser")) {

                    mountExternal = Zygote.MOUNT_EXTERNAL_MULTIUSER;

                } else if (arg.equals("--mount-external-multiuser-all")) {

                    mountExternal = Zygote.MOUNT_EXTERNAL_MULTIUSER_ALL;

                } else {

                    break;

                }

core/res/AndroidManifest.xml

+7 −0
Original line number Diff line number Diff line
@@ -725,6 +725,13 @@ 
        android:description="@string/permdesc_mediaStorageWrite"

        android:protectionLevel="signature|system" />



    <!-- Allows an application to access all multi-user external storage @hide -->

    <permission android:name="android.permission.ACCESS_ALL_EXTERNAL_STORAGE"

        android:permissionGroup="android.permission-group.DEVELOPMENT_TOOLS"

        android:label="@string/permlab_sdcardAccessAll"

        android:description="@string/permdesc_sdcardAccessAll"

        android:protectionLevel="signature" />



    <!-- ============================================ -->

    <!-- Permissions for low-level system interaction -->

    <!-- ============================================ -->

core/res/res/values/strings.xml

+5 −0
Original line number Diff line number Diff line
@@ -1616,6 +1616,11 @@ 
    <!-- Description of an application permission, listed so the user can choose whether they want to allow the application to do this. [CHAR LIMIT=NONE] -->

    <string name="permdesc_mediaStorageWrite" product="default">Allows the app to modify the contents of the internal media storage.</string>



    <!-- Title of an application permission, listed so the user can choose whether they want to allow the application to do this. [CHAR LIMIT=30] -->

    <string name="permlab_sdcardAccessAll">access external storage of all users</string>

    <!-- Description of an application permission, listed so the user can choose whether they want to allow the application to do this. -->

    <string name="permdesc_sdcardAccessAll">Allows the app to access external storage for all users.</string>



    <!-- Title of an application permission, listed so the user can choose whether they want to allow the application to do this. -->

    <string name="permlab_cache_filesystem">access the cache filesystem</string>

    <!-- Description of an application permission, listed so the user can choose whether they want to allow the application to do this. -->

services/java/com/android/server/am/ActivityManagerService.java

+10 −4
Original line number Diff line number Diff line
@@ -1991,14 +1991,20 @@ public final class ActivityManagerService extends ActivityManagerNative 
                try {

                    final PackageManager pm = mContext.getPackageManager();

                    gids = pm.getPackageGids(app.info.packageName);

                } catch (PackageManager.NameNotFoundException e) {

                    Slog.w(TAG, "Unable to retrieve gids", e);

                }















                    if (Environment.isExternalStorageEmulated()) {













                        if (pm.checkPermission(













                                android.Manifest.permission.ACCESS_ALL_EXTERNAL_STORAGE,













                                app.info.packageName) == PERMISSION_GRANTED) {













                            mountExternal = Zygote.MOUNT_EXTERNAL_MULTIUSER_ALL;













                        } else {















                            mountExternal = Zygote.MOUNT_EXTERNAL_MULTIUSER;















                        }















                    }













                } catch (PackageManager.NameNotFoundException e) {













                    Slog.w(TAG, "Unable to retrieve gids", e);













                }













            }















            if (mFactoryTest != SystemServer.FACTORY_TEST_OFF) {















                if (mFactoryTest == SystemServer.FACTORY_TEST_LOW_LEVEL















                        && mTopComponent != null