Runtime permission attribution improvements

When an app is proxying access to runtime permission protected
data it needs to check whether the calling app has a permission
to the data it is about to proxy which leaves a trace in app ops
that the requesting app perofmed a data access. However, then the
app doing the work needs to get the protected data itself from the
OS which access gets attributed only to itself. As a result there
are two data accesses in app ops where only the first one is a
proxy one that app A got access to Foo through app B - that is the
one we want to show in the permission tracking UIs - and one
for the data access - that is the one we would want to blame on
the calling app, and in fact, these two accesses should be one -
that app A accessed Foo though B. This limitation requires fragile
one off workarounds where both accesses use the same attribution
tag and sys UI has hardcoded rules to dedupe. Since this is not
documented we cannot expect that the ecosystem would reliably
do this workaround in apps that that the workaround in the OS
would be respected by every OEM.

This change adds a mechaism to resolve this issue. It allows for
an app to create an attribution context for another app and then
any private data access thorugh this context would result in a
single app op blame that A accessed Foo though B, i.e. we no longer
have double accounting. Also this can be nested through apps, e.g.
app A asks app B which asks app C for contacts. In this case app
B creates an attribution context for app A and calls into app C
which creates an attribution context for app B. When app C gets
contacts the entire attribution chain would get a porper, single
blame: that C accessed the data, that B got the data from C, and
that A got the data form B. Furthermore, this mechanism ensures
that apps cannot forget to check permissions for the caller
before proxying private data. In our example B and C don't need
to check the permisisons for A and B, respectively, since the
permisisons for the entire attribution chain are checked before
data delivery. Attribution chains are not forgeable preventing
a bad actor to create an arbitrary one - each attribution is
created by the app it refers to and points to a chain of
attributions created by their corresponding apps.

This change also fixes a bug where all content provider accesses
were double counted in app ops due to double noting. While at
this it also fixes that apps can now access their own last ops.
There was a bug where one could not pass null getting the attributed
ops from a historical package ops while this is a valid use case
since if there is no attribution everything is mapped to the null
tag. There were some app op APIs not being piped thorough the app
ops delegate and by extension through the app ops policy. Also
now that we have nice way to express the permission chain in a
call we no longer need the special casing in activity manager to
handle content provider accesses through the OS. Fixed a bug
where we don't properly handle the android.os.shell calls with
an invlaid tag which was failing while the shell can do any tag.

Finally, to ensure the mechanims is validated and works end-to-end
we are adding support for a voice recognizer to blame the client
app for the mic access. The recognition service can create a blaming
context when opening the mic and if the mic is open, which would
do all permission checks, we would not do so again. Since changes
to PermissionChercker for handling attribution sources were made
the CL also hooks up renounced permissoins in the request permission
flow and in the permission checks.

bug:158792096
bug:180647319

Test:atest CtsPermissionsTestCases
     atest CtsPermissions2TestCases
     atest CtsPermissions3TestCases
     atest CtsPermissions4TestCases
     atest CtsPermissions5TestCases
     atest CtsAppOpsTestCases
     atest CtsAppOps2TestCases

Change-Id: Ib04585515d3dc3956966005ae9d94955b2f3ee08

2 files changed, 46 insertions, 43 deletions

diff --git a/test-mock/src/android/test/mock/MockContentProvider.java b/test-mock/src/android/test/mock/MockContentProvider.java
index 5b9f67efd95d..7be42f4f36f5 100644
--- a/test-mock/src/android/test/mock/MockContentProvider.java
+++ b/test-mock/src/android/test/mock/MockContentProvider.java
@@ -18,6 +18,7 @@ package android.test.mock;
 
 import android.annotation.NonNull;
 import android.annotation.Nullable;
+import android.content.AttributionSource;
 import android.content.ContentProvider;
 import android.content.ContentProviderOperation;
 import android.content.ContentProviderResult;
@@ -60,21 +61,20 @@ public class MockContentProvider extends ContentProvider {
      */
     private class InversionIContentProvider implements IContentProvider {
         @Override
-        public ContentProviderResult[] applyBatch(String callingPackage,
-                @Nullable String featureId, String authority,
-                ArrayList<ContentProviderOperation> operations)
+        public ContentProviderResult[] applyBatch(@NonNull AttributionSource attributionSource,
+                String authority, ArrayList<ContentProviderOperation> operations)
                 throws RemoteException, OperationApplicationException {
             return MockContentProvider.this.applyBatch(authority, operations);
         }
 
         @Override
-        public int bulkInsert(String callingPackage, @Nullable String featureId, Uri url,
+        public int bulkInsert(@NonNull AttributionSource attributionSource, Uri url,
                 ContentValues[] initialValues) throws RemoteException {
             return MockContentProvider.this.bulkInsert(url, initialValues);
         }
 
         @Override
-        public int delete(String callingPackage, @Nullable String featureId, Uri url,
+        public int delete(@NonNull AttributionSource attributionSource, Uri url,
                 Bundle extras) throws RemoteException {
             return MockContentProvider.this.delete(url, extras);
         }
@@ -90,40 +90,40 @@ public class MockContentProvider extends ContentProvider {
         }
 
         @Override
-        public Uri insert(String callingPackage, @Nullable String featureId, Uri url,
+        public Uri insert(@NonNull AttributionSource attributionSource, Uri url,
                 ContentValues initialValues, Bundle extras) throws RemoteException {
             return MockContentProvider.this.insert(url, initialValues, extras);
         }
 
         @Override
-        public AssetFileDescriptor openAssetFile(String callingPackage,
-                @Nullable String featureId, Uri url, String mode, ICancellationSignal signal)
+        public AssetFileDescriptor openAssetFile(@NonNull AttributionSource attributionSource,
+                Uri url, String mode, ICancellationSignal signal)
                 throws RemoteException, FileNotFoundException {
             return MockContentProvider.this.openAssetFile(url, mode);
         }
 
         @Override
-        public ParcelFileDescriptor openFile(String callingPackage, @Nullable String featureId,
-                Uri url, String mode, ICancellationSignal signal, IBinder callerToken)
+        public ParcelFileDescriptor openFile(@NonNull AttributionSource attributionSource,
+                Uri url, String mode, ICancellationSignal signal)
                 throws RemoteException, FileNotFoundException {
             return MockContentProvider.this.openFile(url, mode);
         }
 
         @Override
-        public Cursor query(String callingPackage, @Nullable String featureId, Uri url,
+        public Cursor query(@NonNull AttributionSource attributionSource, Uri url,
                 @Nullable String[] projection, @Nullable Bundle queryArgs,
                 @Nullable ICancellationSignal cancellationSignal) throws RemoteException {
             return MockContentProvider.this.query(url, projection, queryArgs, null);
         }
 
         @Override
-        public int update(String callingPackage, @Nullable String featureId, Uri url,
+        public int update(@NonNull AttributionSource attributionSource, Uri url,
                 ContentValues values, Bundle extras) throws RemoteException {
             return MockContentProvider.this.update(url, values, extras);
         }
 
         @Override
-        public Bundle call(String callingPackage, @Nullable String featureId, String authority,
+        public Bundle call(@NonNull AttributionSource attributionSource, String authority,
                 String method, String request, Bundle args) throws RemoteException {
             return MockContentProvider.this.call(authority, method, request, args);
         }
@@ -139,9 +139,10 @@ public class MockContentProvider extends ContentProvider {
         }
 
         @Override
-        public AssetFileDescriptor openTypedAssetFile(String callingPackage,
-                @Nullable String featureId, Uri url, String mimeType, Bundle opts,
-                ICancellationSignal signal) throws RemoteException, FileNotFoundException {
+        public AssetFileDescriptor openTypedAssetFile(
+                @NonNull AttributionSource attributionSource, Uri url, String mimeType,
+                Bundle opts, ICancellationSignal signal)
+                throws RemoteException, FileNotFoundException {
             return MockContentProvider.this.openTypedAssetFile(url, mimeType, opts);
         }
 
@@ -151,37 +152,37 @@ public class MockContentProvider extends ContentProvider {
         }
 
         @Override
-        public Uri canonicalize(String callingPkg, @Nullable String featureId, Uri uri)
+        public Uri canonicalize(@NonNull AttributionSource attributionSource, Uri uri)
                 throws RemoteException {
             return MockContentProvider.this.canonicalize(uri);
         }
 
         @Override
-        public void canonicalizeAsync(String callingPkg, String featureId, Uri uri,
+        public void canonicalizeAsync(@NonNull AttributionSource attributionSource, Uri uri,
                 RemoteCallback callback) {
             MockContentProvider.this.canonicalizeAsync(uri, callback);
         }
 
         @Override
-        public Uri uncanonicalize(String callingPkg, @Nullable String featureId, Uri uri)
+        public Uri uncanonicalize(@NonNull AttributionSource attributionSource, Uri uri)
                 throws RemoteException {
             return MockContentProvider.this.uncanonicalize(uri);
         }
 
         @Override
-        public void uncanonicalizeAsync(String callingPkg, String featureId, Uri uri,
+        public void uncanonicalizeAsync(@NonNull AttributionSource attributionSource, Uri uri,
                 RemoteCallback callback) {
             MockContentProvider.this.uncanonicalizeAsync(uri, callback);
         }
 
         @Override
-        public boolean refresh(String callingPkg, @Nullable String featureId, Uri url,
+        public boolean refresh(@NonNull AttributionSource attributionSource, Uri url,
                 Bundle args, ICancellationSignal cancellationSignal) throws RemoteException {
             return MockContentProvider.this.refresh(url, args);
         }
 
         @Override
-        public int checkUriPermission(String callingPkg, @Nullable String featureId, Uri uri,
+        public int checkUriPermission(@NonNull AttributionSource attributionSource, Uri uri,
                 int uid, int modeFlags) {
             return MockContentProvider.this.checkUriPermission(uri, uid, modeFlags);
         }
diff --git a/test-mock/src/android/test/mock/MockIContentProvider.java b/test-mock/src/android/test/mock/MockIContentProvider.java
index 82a1cf7d1796..b81c70704d79 100644
--- a/test-mock/src/android/test/mock/MockIContentProvider.java
+++ b/test-mock/src/android/test/mock/MockIContentProvider.java
@@ -16,7 +16,9 @@
 
 package android.test.mock;
 
+import android.annotation.NonNull;
 import android.annotation.Nullable;
+import android.content.AttributionSource;
 import android.content.ContentProviderOperation;
 import android.content.ContentProviderResult;
 import android.content.ContentResolver;
@@ -46,14 +48,14 @@ import java.util.ArrayList;
  */
 public class MockIContentProvider implements IContentProvider {
     @Override
-    public int bulkInsert(String callingPackage, @Nullable String featureId, Uri url,
+    public int bulkInsert(@NonNull AttributionSource attributionSource, Uri url,
             ContentValues[] initialValues) {
         throw new UnsupportedOperationException("unimplemented mock method");
     }
 
     @Override
     @SuppressWarnings("unused")
-    public int delete(String callingPackage, @Nullable String featureId, Uri url,
+    public int delete(@NonNull AttributionSource attributionSource, Uri url,
             Bundle extras) throws RemoteException {
         throw new UnsupportedOperationException("unimplemented mock method");
     }
@@ -75,31 +77,31 @@ public class MockIContentProvider implements IContentProvider {
 
     @Override
     @SuppressWarnings("unused")
-    public Uri insert(String callingPackage, @Nullable String featureId, Uri url,
+    public Uri insert(@NonNull AttributionSource attributionSource, Uri url,
             ContentValues initialValues, Bundle extras) throws RemoteException {
         throw new UnsupportedOperationException("unimplemented mock method");
     }
 
     @Override
-    public ParcelFileDescriptor openFile(String callingPackage, @Nullable String featureId,
-            Uri url, String mode, ICancellationSignal signal, IBinder callerToken) {
+    public ParcelFileDescriptor openFile(@NonNull AttributionSource attributionSource,
+            Uri url, String mode, ICancellationSignal signal) {
         throw new UnsupportedOperationException("unimplemented mock method");
     }
 
     @Override
-    public AssetFileDescriptor openAssetFile(String callingPackage, @Nullable String featureId,
+    public AssetFileDescriptor openAssetFile(@NonNull AttributionSource attributionSource,
             Uri uri, String mode, ICancellationSignal signal) {
         throw new UnsupportedOperationException("unimplemented mock method");
     }
 
     @Override
-    public ContentProviderResult[] applyBatch(String callingPackage, @Nullable String featureId,
+    public ContentProviderResult[] applyBatch(@NonNull AttributionSource attributionSource,
             String authority, ArrayList<ContentProviderOperation> operations) {
         throw new UnsupportedOperationException("unimplemented mock method");
     }
 
     @Override
-    public Cursor query(String callingPackage, @Nullable String featureId, Uri url,
+    public Cursor query(@NonNull AttributionSource attributionSource, Uri url,
             @Nullable String[] projection, @Nullable Bundle queryArgs,
             @Nullable ICancellationSignal cancellationSignal) {
         throw new UnsupportedOperationException("unimplemented mock method");
@@ -111,13 +113,13 @@ public class MockIContentProvider implements IContentProvider {
     }
 
     @Override
-    public int update(String callingPackage, @Nullable String featureId, Uri url,
+    public int update(@NonNull AttributionSource attributionSource, Uri url,
             ContentValues values, Bundle extras) throws RemoteException {
         throw new UnsupportedOperationException("unimplemented mock method");
     }
 
     @Override
-    public Bundle call(String callingPackage, @Nullable String featureId, String authority,
+    public Bundle call(@NonNull AttributionSource attributionSource, String authority,
             String method, String request, Bundle args) throws RemoteException {
         throw new UnsupportedOperationException("unimplemented mock method");
     }
@@ -133,9 +135,9 @@ public class MockIContentProvider implements IContentProvider {
     }
 
     @Override
-    public AssetFileDescriptor openTypedAssetFile(String callingPackage,
-            @Nullable String featureId, Uri url, String mimeType, Bundle opts,
-            ICancellationSignal signal) throws RemoteException, FileNotFoundException {
+    public AssetFileDescriptor openTypedAssetFile(@NonNull AttributionSource attributionSource,
+            Uri url, String mimeType, Bundle opts, ICancellationSignal signal)
+            throws RemoteException, FileNotFoundException {
         throw new UnsupportedOperationException("unimplemented mock method");
     }
 
@@ -145,48 +147,48 @@ public class MockIContentProvider implements IContentProvider {
     }
 
     @Override
-    public Uri canonicalize(String callingPkg, @Nullable String featureId, Uri uri) {
+    public Uri canonicalize(@NonNull AttributionSource attributionSource, Uri uri) {
         throw new UnsupportedOperationException("unimplemented mock method");
     }
 
     @Override
     @SuppressWarnings("deprecation")
-    public void canonicalizeAsync(String callingPkg, String featureId, Uri uri,
+    public void canonicalizeAsync(@NonNull AttributionSource attributionSource, Uri uri,
             RemoteCallback remoteCallback) {
         AsyncTask.SERIAL_EXECUTOR.execute(() -> {
             final Bundle bundle = new Bundle();
             bundle.putParcelable(ContentResolver.REMOTE_CALLBACK_RESULT,
-                    canonicalize(callingPkg, featureId, uri));
+                    canonicalize(attributionSource, uri));
             remoteCallback.sendResult(bundle);
         });
     }
 
     @Override
-    public Uri uncanonicalize(String callingPkg, @Nullable String featureId, Uri uri) {
+    public Uri uncanonicalize(@NonNull AttributionSource attributionSource, Uri uri) {
         throw new UnsupportedOperationException("unimplemented mock method");
     }
 
     @Override
     @SuppressWarnings("deprecation")
-    public void uncanonicalizeAsync(String callingPkg, String featureId, Uri uri,
+    public void uncanonicalizeAsync(@NonNull AttributionSource attributionSource, Uri uri,
             RemoteCallback remoteCallback) {
         AsyncTask.SERIAL_EXECUTOR.execute(() -> {
             final Bundle bundle = new Bundle();
             bundle.putParcelable(ContentResolver.REMOTE_CALLBACK_RESULT,
-                    uncanonicalize(callingPkg, featureId, uri));
+                    uncanonicalize(attributionSource, uri));
             remoteCallback.sendResult(bundle);
         });
     }
 
     @Override
-    public boolean refresh(String callingPkg, @Nullable String featureId, Uri url, Bundle args,
+    public boolean refresh(@NonNull AttributionSource attributionSource, Uri url, Bundle args,
             ICancellationSignal cancellationSignal) throws RemoteException {
         throw new UnsupportedOperationException("unimplemented mock method");
     }
 
     /** {@hide} */
     @Override
-    public int checkUriPermission(String callingPkg, @Nullable String featureId, Uri uri, int uid,
+    public int checkUriPermission(@NonNull AttributionSource attributionSource, Uri uri, int uid,
             int modeFlags) {
         throw new UnsupportedOperationException("unimplemented mock method call");
     }