From fe0253b34ec4fdb6afceb11193f29029b524866a Mon Sep 17 00:00:00 2001 From: Svet Ganov Date: Mon, 16 Jan 2017 19:22:37 -0800 Subject: [PATCH] Propagate revoked permissions in permission review mode In permission review mode we represent install permissions for legacy apps as constantly granted runtime ones since we need to keep per user flags associated with a permission. We were not propagating a revoked permission for a legacy app when the later is upgraded to a modern app when permission review is enabled. Test: CTS test passes and manual testing worked fine Change-Id: I32b8ffee89cc034661f8eb5a172dbe2349ea4a18 --- .../android/server/pm/PackageManagerService.java | 24 +++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index c9c855b30a29..5bb019898067 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -10639,12 +10639,30 @@ public class PackageManagerService extends IPackageManager.Stub { int flags = permissionState != null ? permissionState.getFlags() : 0; if (origPermissions.hasRuntimePermission(bp.name, userId)) { - if (permissionsState.grantRuntimePermission(bp, userId) == - PermissionsState.PERMISSION_OPERATION_FAILURE) { - // If we cannot put the permission as it was, we have to write. + // Don't propagate the permission in a permission review mode if + // the former was revoked, i.e. marked to not propagate on upgrade. + // Note that in a permission review mode install permissions are + // represented as constantly granted runtime ones since we need to + // keep a per user state associated with the permission. Also the + // revoke on upgrade flag is no longer applicable and is reset. + final boolean revokeOnUpgrade = (flags & PackageManager + .FLAG_PERMISSION_REVOKE_ON_UPGRADE) != 0; + if (revokeOnUpgrade) { + flags &= ~PackageManager.FLAG_PERMISSION_REVOKE_ON_UPGRADE; + // Since we changed the flags, we have to write. changedRuntimePermissionUserIds = ArrayUtils.appendInt( changedRuntimePermissionUserIds, userId); } + if (!mPermissionReviewRequired || !revokeOnUpgrade) { + if (permissionsState.grantRuntimePermission(bp, userId) == + PermissionsState.PERMISSION_OPERATION_FAILURE) { + // If we cannot put the permission as it was, + // we have to write. + changedRuntimePermissionUserIds = ArrayUtils.appendInt( + changedRuntimePermissionUserIds, userId); + } + } + // If the app supports runtime permissions no need for a review. if (mPermissionReviewRequired && appSupportsRuntimePermissions -- 2.11.0