RESTRICT AUTOMERGE: Revoke permissions defined in a to-be removed package.
Bug: 67319274
Test: run cts-dev --module CtsPermissionTestCases --test android.permission.cts.RemovePermissionTest#permissionShouldBeRevokedIfRemoved
Change-Id: I69edee8ed044cc2a8cdb01515f7996b004209c81
(cherry picked from commit fa69d725eb99b8c20a15135304bf5be4ea811573)
diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 8ac229e..abb5735 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -512,6 +512,8 @@
/** Special library name that skips shared libraries check during compilation. */
private static final String SKIP_SHARED_LIBRARY_CHECK = "&";
+ private static final int PROTECTION_MASK_BASE = 0xf;
+
final ServiceThread mHandlerThread;
final PackageHandler mHandler;
@@ -4214,6 +4216,11 @@
@Override
public void revokeRuntimePermission(String packageName, String name, int userId) {
+ revokeRuntimePermission(packageName, name, userId, mSettings.getPermission(name));
+ }
+
+ private void revokeRuntimePermission(String packageName, String name, int userId,
+ BasePermission bp) {
if (!sUserManager.exists(userId)) {
Log.e(TAG, "No such user:" + userId);
return;
@@ -4234,8 +4241,6 @@
if (pkg == null) {
throw new IllegalArgumentException("Unknown package: " + packageName);
}
-
- final BasePermission bp = mSettings.mPermissions.get(name);
if (bp == null) {
throw new IllegalArgumentException("Unknown permission: " + name);
}
@@ -4352,7 +4357,8 @@
oldPermissionGroupName, "to", newPermissionGroupName);
try {
- revokeRuntimePermission(packageName, permissionName, userId);
+ revokeRuntimePermission(packageName, permissionName, userId,
+ mSettings.getPermission(permissionName));
} catch (IllegalArgumentException e) {
Slog.e(TAG, "Could not revoke " + permissionName + " from "
+ packageName, e);
@@ -9807,7 +9813,10 @@
if (DEBUG_REMOVE) Log.d(TAG, " Activities: " + r);
}
+ final ArrayList<String> allPackageNames = new ArrayList<>(mPackages.keySet());
+
N = pkg.permissions.size();
+ List<BasePermission> bps = new ArrayList<BasePermission>(N);
r = null;
for (i=0; i<N; i++) {
PackageParser.Permission p = pkg.permissions.get(i);
@@ -9816,6 +9825,10 @@
bp = mSettings.mPermissionTrees.get(p.info.name);
}
if (bp != null && bp.perm == p) {
+ if (((p.info.protectionLevel & PROTECTION_MASK_BASE) &
+ PermissionInfo.PROTECTION_DANGEROUS) != 0) {
+ bps.add(bp);
+ }
bp.perm = null;
if (DEBUG_REMOVE && chatty) {
if (r == null) {
@@ -9833,6 +9846,44 @@
}
}
}
+
+ AsyncTask.execute(() -> {
+ final int numRemovedPermissions = bps.size();
+ for (int permissionNum = 0; permissionNum < numRemovedPermissions; permissionNum++) {
+ final int[] userIds = sUserManager.getUserIds();
+ final int numUserIds = userIds.length;
+
+ final int numPackages = allPackageNames.size();
+ for (int packageNum = 0; packageNum < numPackages; packageNum++) {
+ final String packageName = allPackageNames.get(packageNum);
+ final PackageManagerInternal packageManagerInt =
+ LocalServices.getService(PackageManagerInternal.class);
+ final ApplicationInfo applicationInfo = packageManagerInt.getApplicationInfo(
+ packageName, UserHandle.USER_SYSTEM);
+ if (applicationInfo != null
+ && applicationInfo.targetSdkVersion < Build.VERSION_CODES.M) {
+ continue;
+ }
+ for (int userIdNum = 0; userIdNum < numUserIds; userIdNum++) {
+ final int userId = userIds[userIdNum];
+ final String permissionName = bps.get(permissionNum).name;
+ if (checkPermission(permissionName, packageName,
+ userId) == PackageManager.PERMISSION_GRANTED) {
+ try {
+ revokeRuntimePermission(packageName,
+ permissionName,
+ userId,
+ bps.get(permissionNum));
+ } catch (IllegalArgumentException e) {
+ Slog.e(TAG, "Could not revoke " + permissionName + " from "
+ + packageName, e);
+ }
+ }
+ }
+ }
+ }
+ });
+
if (r != null) {
if (DEBUG_REMOVE) Log.d(TAG, " Permissions: " + r);
}
diff --git a/services/core/java/com/android/server/pm/Settings.java b/services/core/java/com/android/server/pm/Settings.java
index dfd6dfe..530f7bc 100644
--- a/services/core/java/com/android/server/pm/Settings.java
+++ b/services/core/java/com/android/server/pm/Settings.java
@@ -454,6 +454,17 @@
return mPackages.get(name);
}
+ public BasePermission getPermission(@NonNull String permName) {
+ synchronized (mLock) {
+ return getPermissionLocked(permName);
+ }
+ }
+
+ @GuardedBy("mLock")
+ BasePermission getPermissionLocked(@NonNull String permName) {
+ return mPermissions.get(permName);
+ }
+
void setInstallStatus(String pkgName, final int status) {
PackageSetting p = mPackages.get(pkgName);
if(p != null) {