commit c4ce178c261e6a2dc1aa4c1e1d570f0efd980e47
author Philip P. Moltmann <moltmann@google.com> Tue Nov 03 15:12:44 2020 -0800
committer android-build-team Robot <android-build-team-robot@google.com> Wed Nov 18 22:51:08 2020 +0000
tree e84d57d52e4ad2765082739bc14205bf4161ba8c
parent 03da463b2a94c36e3b46f0a110ec43710b82d404

Revoke permission on non-runtime -> runtime upgrade

Not only on normal -> runtime.

Test: atest PermissionEscalationTest
Bug: 154505240, 168319670
Change-Id: If3b420067b4d7111dcf67ae6f98e42176158b679
Merged-In: If3b420067b4d7111dcf67ae6f98e42176158b679
(cherry picked from commit 33e24c883c5797fe7ba05468bde967fb0e46e66d)

services/core/java/com/android/server/pm/permission/BasePermission.java

diff --git a/services/core/java/com/android/server/pm/permission/BasePermission.java b/services/core/java/com/android/server/pm/permission/BasePermission.java
index 2d4b501..5e04171 100644
--- a/services/core/java/com/android/server/pm/permission/BasePermission.java
+++ b/services/core/java/com/android/server/pm/permission/BasePermission.java
@@ -367,7 +367,7 @@
         if (bp == null) {
             bp = new BasePermission(p.getName(), p.getPackageName(), TYPE_NORMAL);
         }
-        boolean wasNormal = bp.isNormal();
+        boolean wasNonRuntime = !bp.isRuntime();
         StringBuilder r = null;
         if (bp.perm == null) {
             if (bp.sourcePackageName == null
@@ -411,7 +411,7 @@
                 && Objects.equals(bp.perm.getName(), p.getName())) {
             bp.protectionLevel = p.getProtectionLevel();
         }
-        if (bp.isRuntime() && (ownerChanged || wasNormal)) {
+        if (bp.isRuntime() && (ownerChanged || wasNonRuntime)) {
             // If this is a runtime permission and the owner has changed, or this was a normal
             // permission, then permission state should be cleaned up
             bp.mPermissionDefinitionChanged = true;