Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f8bc5a09 authored by Philip P. Moltmann's avatar Philip P. Moltmann
Browse files

Don't grant policy fixed permission on request 

Since Q the permission controller can grant policy fixed permissions.
This is needed to move the POLICY_FIXED logic into the permission
controller.

A permission group can have both policy-fixed/granted and
policy-fixed/denied permissions.

Before this change it could happen that if we have such a group the
app could get a policy-fixed/denied individual permission granted by
accident as the whole group is classified as policy-fixed/granted .

Test: created a group with denied and allowed permission and then tried
          to grant the denied permission.
      atest com.android.cts.devicepolicy.MixedManagedProfileOwnerTest#testPermissionGrantOfDisallowedPermissionWhileOtherPermIsGranted
Fixes: 133871568
Change-Id: I5569b96bcc9549f646dd1f0f9b64b2baa968a1d9
parent 3f8f673c

src/com/android/packageinstaller/permission/ui/GrantPermissionsActivity.java

+18 −15
Original line number Diff line number Diff line
@@ -133,33 +133,36 @@ public class GrantPermissionsActivity extends Activity 
     * affected permissions}.

     *

     * @param group The group the permission belongs to (might be a background permission group)

     * @param permission The permission to add

     * @param permName The name of the permission to add

     * @param isFirstInstance Is this the first time the groupStates get created

     */

    private void addRequestedPermissions(AppPermissionGroup group, String permission,

    private void addRequestedPermissions(AppPermissionGroup group, String permName,

            boolean isFirstInstance) {

        if (!group.isGrantingAllowed()) {

            reportRequestResult(permission,

            reportRequestResult(permName,

                    PERMISSION_GRANT_REQUEST_RESULT_REPORTED__RESULT__IGNORED);

            // Skip showing groups that we know cannot be granted.

            return;

        }



        Permission permission = group.getPermission(permName);



        // If the permission is restricted it does not show in the UI and

        // is not added to the group at all, so check that first.

        if (group.getPermission(permission) == null && ArrayUtils.contains(mAppPermissions

                .getPackageInfo().requestedPermissions, permission)) {

            reportRequestResult(permission,

        if (permission == null && ArrayUtils.contains(

                mAppPermissions.getPackageInfo().requestedPermissions, permName)) {

            reportRequestResult(permName,

                  PERMISSION_GRANT_REQUEST_RESULT_REPORTED__RESULT__IGNORED_RESTRICTED_PERMISSION);

            return;

        // We allow the user to choose only non-fixed permissions. A permission

        // is fixed either by device policy or the user denying with prejudice.

        } else if (group.isUserFixed()) {

            reportRequestResult(permission,

            reportRequestResult(permName,

                    PERMISSION_GRANT_REQUEST_RESULT_REPORTED__RESULT__IGNORED_USER_FIXED);

            return;

        } else if (group.isPolicyFixed() && !group.areRuntimePermissionsGranted()) {

            reportRequestResult(permission,

        } else if (group.isPolicyFixed() && !group.areRuntimePermissionsGranted()

                || permission.isPolicyFixed()) {

            reportRequestResult(permName,

                    PERMISSION_GRANT_REQUEST_RESULT_REPORTED__RESULT__IGNORED_POLICY_FIXED);

            return;

        }
@@ -173,17 +176,17 @@ public class GrantPermissionsActivity extends Activity 
            mRequestGrantPermissionGroups.put(groupKey, state);

        }

        state.affectedPermissions = ArrayUtils.appendString(

                state.affectedPermissions, permission);

                state.affectedPermissions, permName);



        boolean skipGroup = false;

        switch (getPermissionPolicy()) {

            case DevicePolicyManager.PERMISSION_POLICY_AUTO_GRANT: {

                group.grantRuntimePermissions(false, new String[]{permission});

                group.grantRuntimePermissions(false, new String[]{permName});

                state.mState = GroupState.STATE_ALLOWED;

                group.setPolicyFixed();

                skipGroup = true;



                reportRequestResult(permission,

                reportRequestResult(permName,

                        PERMISSION_GRANT_REQUEST_RESULT_REPORTED__RESULT__AUTO_GRANTED);

            } break;
@@ -192,17 +195,17 @@ public class GrantPermissionsActivity extends Activity 
                group.setPolicyFixed();

                skipGroup = true;



                reportRequestResult(permission,

                reportRequestResult(permName,

                        PERMISSION_GRANT_REQUEST_RESULT_REPORTED__RESULT__AUTO_DENIED);

            } break;



            default: {

                if (group.areRuntimePermissionsGranted()) {

                    group.grantRuntimePermissions(false, new String[]{permission});

                    group.grantRuntimePermissions(false, new String[]{permName});

                    state.mState = GroupState.STATE_ALLOWED;

                    skipGroup = true;



                    reportRequestResult(permission,

                    reportRequestResult(permName,

                            PERMISSION_GRANT_REQUEST_RESULT_REPORTED__RESULT__AUTO_GRANTED);

                }

            } break;

src/com/android/packageinstaller/permission/ui/TEST_MAPPING

+8 −0
Original line number Diff line number Diff line
@@ -7,6 +7,14 @@ 
                    "include-filter": "android.appsecurity.cts.PermissionsHostTest"

                }

            ]

        },

        {

            "name": "CtsDevicePolicyManagerTestCases",

            "options": [

                {

                    "include-filter": "com.android.cts.devicepolicy.MixedManagedProfileOwnerTest#testPermissionGrantOfDisallowedPermissionWhileOtherPermIsGranted"

                }

            ]

        }

    ]

}
 
 No newline at end of file