summaryrefslogtreecommitdiff
path: root/core/java/android/permission/PermissionControllerService.java
Commit message (Collapse)AuthorAgeFilesLines
* Rename revokeOwnPermissionsOnKill to revokeSelfPermissionsOnKillThomas Vannet2022-03-161-4/+4
| | | | | | Bug: 215555831 Test: atest android.permission.cts.RevokeSelfPermissionTest Change-Id: I887e2b8a86868352e772537addd8cd20ef305d7b
* Self-revocation: Call PermissionControllerManager directly from ContextThomas Vannet2022-03-161-3/+10
| | | | | | | | | | | | | | | | This fixes a bug where self-revocation didn't work in multi-user settings. Now the correct context is used throughout the call stack and the permission for the calling user will be revoked. Also added a checked IllegalArgumentException (previously unchecked SecurityException) when trying to revoke a permission that is not currently granted. Test: manual using two users and atest android.permission.cts.RevokeOwnPermissionTest Bug: 218788609 Change-Id: I3dce34b8b956b4d1eb0ac1e34b6fdbf1795aa269
* Update self-revocation doc: revoke by permission, not groupThomas Vannet2022-02-031-3/+5
| | | | | | Test: None, this is just a doc update Bug: 210387494 Change-Id: Ib6555c9c419e2f5b890d31c249f09207632d7724
* Add killed delay param to startOneTimePermissionSessionThomas Vannet2022-02-031-1/+1
| | | | | | | | | | | | | | | This param controls how long to wait before revoking permission after every process has been killed. Deprecate previous API and update all known uses of the deprecated API. Use updated API for self-revocation feature. If multiple one-time permission sessions are started for the same package with different parameters, always use the shortest parameters. Test: atest android.permission.cts.RevokeOwnPermissionTest, atest android.permission.cts.OneTimePermissionTest Bug: 210387494 Change-Id: I0c0e21b3b48dd31f0c267d5c8b89336714835289
* Add API to get hibernation eligibilityKevin Han2022-01-211-0/+32
| | | | | | | | | | | | | | Add an API to get a package's eligibility for hibernation for a given user. A package is either eligible, exempt by the system, or exempt by the user. This information can be used to show more accurate UI for hibernation controls (e.g. disabling the user-controlled exemption toggle if the app is already exempt by the system) Bug: 200087723 Test: CTS test in topic Change-Id: Iea844477184fadb55ea14485dff172ed7be2b715
* Rename selfRevokePermissions to revokeOwnPermissionsOnKillThomas Vannet2022-01-211-4/+4
| | | | | | | | Test: atest android.permission.cts.RevokeOwnPermissionTest Bug: 215555831 Bug: 210575642 Bug: 210387494 Change-Id: I94e29f66d13ac76669fab2ccc08879c30c26b7ea
* Add self revocation public APIThomas Vannet2022-01-111-0/+35
| | | | | | | | | | | | | Test: Manual test using a non-privileged app, atest android.permission.cts.SelfRevokeRuntimePermissionTest When calling the API, the permission (along with any other permissions from the same group) for the current package is downgraded to a one-time permission, and a one-time permission session is started. Bug: 210387494 Change-Id: I9f061cbc8c3db720127c96200fe94a644246b6d7
* Add unused count APIKevin Han2021-12-161-0/+28
| | | | | | | | | | Add unused count API to PermissionControllerManager to allow Settings to pull the number of unused apps from PermissionController. Bug: 200087723 Bug: 187465752 Test: CTS test in topic Change-Id: I197b07af0e7a40bb5daececd8ef7d053a2895016
* Merge "Add missing permission enforcement." into sc-devTreeHugger Robot2021-06-011-3/+4
|\
| * Add missing permission enforcement.Hai Zhang2021-06-011-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | Since, we are opening PermissionControllerService to instant apps for the permission group mapping API, I'm reviewing the permission checks and this is the only missing one. However, this API is just a trigger to update our state so calling it some more times shouldn't pose a security risk, so this fix is just a nice-to-have. Bug: 189836392 Test: presubmit Change-Id: I6e9159ce090acaad2ecf522bd04c613169e03252
* | Fix wrong permission check inHai Zhang2021-06-011-1/+2
|/ | | | | | | | | | | setRuntimePermissionGrantStateByDeviceAdminFromParams(). This is nice to have, but not necessarily a security fix because we are already always enforcing ADJUST_RUNTIME_PERMISSIONS_POLICY. Bug: 158735247 Test: presubmit Change-Id: I629969e04e1d5e7e3ef47c8833780f19d83b9e0b
* Add Api to get permission group info from PermissionControllerNate Myren2021-03-311-0/+53
| | | | | | Bug: 182094776 Test: atest GetPermissionGroupInfoTest Change-Id: I872b0658ea0d8a5aca80a83cff1e29f25b7d6d3d
* Restrict Admin grant of sensors-related permissionsEran Messeri2021-02-161-14/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Restrict the admin of a fully-managed device or managed profile from granting sensors-related permissions. The admin of a managed profile cannot control permission grants for sensors-related permissions at all. The admin of a fully-managed device can opt-out of having said control by providing a provisioning extra. This change passes the boolean flag in ActiveAdmin indicating whether the admin has control over sensor permission grants into the permission controller. Manual testing: * Install TestDPC * Create a work profile using TestDPC. * Get the BasicLocation app by checking out https://github.com/android/location-samples and building it from there. * Install the app onto the device but do not start it. * In TestDPC, Find "Manage app permissions", choose "Basic Location Sample" from the drop-down menu. * Toggle each of the "ACCESS_COARSE_LOCATION" and "ACCESS_BACKGROUND_LOCATION" to "Allow". * Observe that no notification appears. * Start the BasicLocation app and observe the runtime permission prompt shows up. Bug: 158735247 Test: Manual (more to be added). Test: cts (see topic) Change-Id: I12d9f7e24ad4bc09651a5e5f60b864298506c2c4
* Replace CDM profiles hardcoded strings with real valuesEugene Susla2021-01-121-4/+5
| | | | | | Test: manual Bug: 165951651 Change-Id: Ie3771df49dca43b9c91f64b32a6b56b211e754ad
* Introduce API to get CDM profile permissions description stringEugene Susla2021-01-061-0/+36
| | | | | | Bug: 165951651 Test: presubmit Change-Id: Ic59f7a70f0a1b8b53510fc313e0e3e2155cd3b31
* Add changeId to gate R-QPR tests behindNate Myren2020-08-111-0/+11
| | | | | | Bug: 162551686 Test: none Change-Id: I6df669785db4d4684b8207fa7234d4793d652cb3
* No need for copying dump state for PCPhilip P. Moltmann2020-05-111-0/+5
| | | | | | | | | Also - enforce permission when dumping PC data Bug: 155680199 Test: dumpsys permissionmgr Change-Id: I2cacd6f9d8db0ea329de1d15c96bea9f2ae15dd1
* Forward dumps from PermissionControllerManager to permissionmgrPhilip P. Moltmann2020-05-061-0/+7
| | | | | | Test: adb shell dumpsys permissionmgr Bug: 155680199 Change-Id: Iab5da24277eb6333ef047ab84dfcb65b7c4c2ff2
* Add executor to onUpdateUserSensitiveFlagsNate Myren2020-03-161-1/+15
| | | | | | | | Added an executor to the onUpdateUserSensitiveFlags api Test: None Fixes: 141311767 Change-Id: I90ac4e6f61e461147fc2059680976d05e715ad29
* Update USER_SENSITIVE flags on app install and optimize itEugene Susla2020-03-121-6/+12
| | | | | | | | | | | | | | | This also parallelizes flag updating. Currently, the broadcast listener is disabled, due to test flake, so it will not update on app install/changes Bug: 141311767 Test: - on first boot go to permissions screen, and ensure system apps categorization makes sense - install app that requests location, and ensure it's not listed as system app in permission screen Change-Id: I37ea4b196313fe9fa71150c21e7cca591067d572
* Upgrade permissions on PermissionController version changeEvan Severson2020-03-041-1/+2
| | | | | | | | | | | | | | If the version of the permsision controller is different than what was persisted then call the upgrade controller defined in the permission controller. Exempt-From-Owner-Approval: Got verbal approval from an OWNER Bug: 148595539 Test: Manual; verify the version is persisted in runtime-permissions.xml verify the upgrade is run when changing the version number move runtime-permissions.xml to old location, verify works Change-Id: I873ea4d5a0f1f66fed121e38cc6be62fa046a210
* Create system server component for one-time permissionsEvan Severson2019-12-181-0/+21
| | | | | | | | | | | | | | In this change we introduce new system api to manage tracking apps for inactivity when they hold one-time permissions. The api includes adding a package, removing a package, and a callback to notify the app has gone inactive and which permissions are considered one-time. Also introduce a new permission flag so that it is possible to determine if a currently granted permission is one-time. Test: Manual Bug: 136219229 Change-Id: Iac3cb776a0204c64953f0a03abe76c8e320c9e56
* Rename updateUSerSensitive APIEugene Susla2019-11-141-2/+2
| | | | | | Fixes: 141226832 Test: presubmit Change-Id: I545f710296a4f05db01bb64c4014eba96373b526
* Allow an app to drive permission backup+restorePhilip P. Moltmann2019-10-071-24/+76
| | | | | | | | | | In AOSP the permission backup+restore is driven by the system server, but some OEMs might drive it from an app. Hence allow a privilidged app to backup + restore permission backups. Test: atest CtsBackupTestCases Fixes: 141007569 Change-Id: Ic89b476948872c491de8ea54b83667afc0183bb4
* updateUserSensitive asynchronouslyEugene Susla2019-09-131-0/+20
| | | | | | | | | This is known to take 500ms and affects only UI, so can be done async Test: Ensure nothing looks badly broken; presubmit Fixes: 139485700 Change-Id: I2b83b51ec5b002e08986019b4b6be3d681741544
* [fixed] Replace RemoteCallback with AndroidFuture in PermControlerEugene Susla2019-05-171-62/+20
| | | | | | | | This is ag/7529281 + fix ag/7572218 Test: atest AddConfigWidgetTest#testConfigCancelled atest android.permission.cts.PermissionControllerTest Change-Id: I9d8f28c0665a7ae4040ea471ed6a0187628a0306
* Revert "Replace RemoteCallback with AndroidFuture in PermControler"Eugene Susla2019-05-171-20/+62
| | | | | | | | This reverts commit e7daff9fa385c2d455d3542a970d76e7316a44c5. Reason for revert: Broke some tests: b/132981879 Change-Id: I3a707c0a67316246532437718132717f0c601255
* Replace RemoteCallback with AndroidFuture in PermControlerEugene Susla2019-05-161-62/+20
| | | | | | | | | - saves ~3 allocation per ipc - no longer need to [un]bundleize result - will become typesafe down the road (b/132732312) Test: atest android.permission.cts.PermissionControllerTest Change-Id: I6cd9ec5ae31179474536f22f557afb0d9db6a4b9
* Allow PermissionControllerService implementer control own threadingPhilip P. Moltmann2019-04-251-156/+121
| | | | | | | | Hence execute on binder-thread and send callback. Fixes: 131314749 Test: atest --test-mapping packages/apps/PermissionController/src/com/android/packageinstaller/permission/service:presubmit Change-Id: Ic5286a1b02532bcc0241877d970d0fc933b27f85
* Call PermissionControllerService on workerthreadPhilip P. Moltmann2019-04-181-29/+34
| | | | | | | | As otherwise the mainthread is overwhelmed and blocking. Test: atest CtsPermissionTestCases:android.permission.cts.PermissionControllerTest Fixes: 130738002 Change-Id: I1d6cbc60411802cef1c8aedbb6e89430e65b2aa9
* Restricted permission mechanism - frameworkSvet Ganov2019-04-071-0/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change adds a mechanism for restricting permissions (only runtime for now), so that an app cannot hold the permission if it is not white listed. The whitelisting can happen at install or at any later point. There are three whitelists: system: OS managed with default grants and role holders being on it; upgrade: only OS puts on this list apps when upgrading from a pre to post restriction permission database version and OS and installer on record can remove; installer: only the installer on record can add and remove (and the system of course). Added a permission policy service that sits on top of permissions and app ops and is responsible to sync between permissions and app ops when there is an interdependecy in any direction. Added versioning to the runtime permissions database to allow operations that need to be done once on upgrade such as adding all permissions held by apps pre upgrade to the upgrade whitelist if the new permisison version inctroduces a new restricted permission. The upgrade logic is in the permission controller and we will eventually put the default grants there. NOTE: This change is reacting to a VP feedback for how we would handle SMS/CallLog restriction as we pivoted from role based approach to roles for things the user would understand plus whitelist for everything else. This would also help us roll out softly the storage permisison as there is too much churm coming from developer feedback. Exempt-From-Owner-Approval: trivial change due to APi adjustment Test: atest CtsAppSecurityHostTestCases:android.appsecurity.cts.PermissionsHostTest Test: atest CtsPermissionTestCases Test: atest CtsPermission2TestCases Test: atest RoleManagerTestCases bug:124769181 Change-Id: Ic48e3c728387ecf02f89d517ba1fe785ab9c75fd
* Document delayed permission backup mechanismPhilip P. Moltmann2019-03-081-1/+5
| | | | | | Test: n/a Fixes: 127545019 Change-Id: I62494048e2eeda733fabfddc53898b88827d92ef
* Use RoleControllerService for role related APIs.Hai Zhang2019-03-071-61/+0
| | | | | | | | | Move isApplicationQualifiedForRole() and isRoleVisible() from PermissionControllerService to RoleControllerService. Bug: 127691087 Test: manual Change-Id: Ic9277f9e737e59dceafffabbf1e19526db609e78
* Merge "Add PermissionControllerService.isRoleVisible() for app info shortcut."TreeHugger Robot2019-03-041-1/+29
|\
| * Add PermissionControllerService.isRoleVisible() for app info shortcut.Hai Zhang2019-02-281-1/+29
| | | | | | | | | | | | | | | | | | | | | | The default app shortcut in app info inside Settings needs to know if a role is visible, and whether it is visible is controlled logic in PermissionController, hence add this API. Bug: 124452117 Bug: 124457823 Test: manual Change-Id: I6058dea3bbda8b06d2fb9bab35268397227dd37b
* | Nullability of PermissionControllerService#onBindPhilip P. Moltmann2019-03-011-1/+1
|/ | | | | | | | | Only set nullability if super-method specified nullability at the same place too. Test: Built Bug: 126701055 Change-Id: I08b9ac43ecb5f200d192a536449a880bc9a91f38
* Ask Perm Controller to set policy-fixed permsPhilip P. Moltmann2019-02-211-0/+56
| | | | | | | | | | | | This is much slower than the old way as we need to call into a different process. On the other hand this handles the following cases correctly: - foreground / background permissions - pre-M apps - split permissions Test: CtsDevicePolicyManagerTestCases:com.android.cts.devicepolicy.MixedManagedProfileOwnerTest#testPermissionGrant,testPermissionPolicy,testPermissionMixedPolicies,testPermissionAppUpdate,testPermissionGrantPreMApp Change-Id: I5cd139ad29e5b77b77b02e12c75eb774984a7759 Bug: 124128308
* Plumming of perm restore via permission controllerPhilip P. Moltmann2019-02-021-0/+54
| | | | | | | | | | | | | On Android backup restoration first restores and inital state. Then with the packages getting downloaded the leftover "delayed" backup gets restored bit by bit. This currently just created plumming mirroring the previously implemented behavior. Bug: 116738135 Test: Built Change-Id: I528b5f76dfca5bbdc9f69d6402b23b3d2ef11706
* Small fixes in PermissionControllerManager/ServicePhilip P. Moltmann2019-02-011-7/+7
| | | | | | | | | | - better names - broken javadoc - missing input paramter checks Bug: 116738135 Test: Built Change-Id: I6056b46776cf32937a113b99584d138ff423f039
* Flags instead of booleans for countPermissionAppsPhilip P. Moltmann2019-01-311-9/+15
| | | | | | Test: Checked that the api retunred the results Change-Id: I3f95bf9beee4a7edae5cbd9457ad4efefe83d1be Fixes: 123697839
* Add PermissionControllerManager.isApplicationQualifiedForRole().Hai Zhang2019-01-241-3/+37
| | | | | | | | | | Settings DefaultAppShortcutPreference needs this info to determine whether to show the shortcut to default apps on the app info page. Bug: 110557011 Bug: 123238935 Test: manual Change-Id: I3ffa62eb199ba9c761bf09a556443f685f6b6b50
* Move permission backup into permission controllerPhilip P. Moltmann2019-01-141-0/+36
| | | | | | | | | | | | | As runtime permissions are complex, all runtime permission code is consolidated into the permission controller app. Hence the package manager service's permission backup code is now calling into the PermissionControllerManager which is a interface to the permission controller app. Bug: 120907838 Test: Triggered a backup and checked the result via the debugger. Change-Id: I633162189b728921d902050eee125b4b40b618fd
* Add new method to count how many apps have used permissionsJoel Galenson2019-01-141-0/+39
| | | | | | Bug: 121256299 Test: Called API and looked at result. Change-Id: If055093a81598cf36a5d1b745ee5397974ee4106
* Allow apps to bulk revoke permissions with the correct semanticsPhilip P. Moltmann2019-01-061-0/+78
| | | | | | Test: atest --test-mapping frameworks/base/core/java/android/permission/:presubmit Fixes: 120269238 Change-Id: Ib9eb244f1c89c09eee1f39e3abb65c1189f7a6f4
* Rename RuntimePermissionPresenter to PermissionControllerPhilip P. Moltmann2019-01-031-0/+155
As this has already evolved from just presenting data. In the future any permission related calls to the permission controller will be added here. As the calls are protected by different permissions the binding will not require a permission anymore, but each individual call checks the permission. Bug: 120221960 Test: Looked at settings UI showing data from this interface Change-Id: I6b4a5c3b7ee17b145e11e2c1b6e11a8a232bffed
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-20 12:42:27 +0000