summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--core/java/android/content/pm/ApplicationInfo.java8
-rw-r--r--core/java/android/content/pm/PackageParser.java1
-rw-r--r--packages/BackupRestoreConfirmation/Android.mk1
-rw-r--r--packages/DefaultContainerService/Android.mk2
-rw-r--r--packages/ExternalStorageProvider/Android.mk1
-rw-r--r--packages/FusedLocation/Android.mk1
-rw-r--r--packages/InputDevices/Android.mk1
-rw-r--r--packages/Keyguard/Android.mk2
-rw-r--r--packages/Keyguard/test/Android.mk3
-rw-r--r--packages/SettingsProvider/Android.mk1
-rw-r--r--packages/SharedStorageBackup/Android.mk1
-rw-r--r--packages/Shell/Android.mk1
-rw-r--r--packages/SystemUI/Android.mk1
-rw-r--r--packages/VpnDialogs/Android.mk2
-rw-r--r--services/java/com/android/server/accounts/AccountManagerService.java8
-rw-r--r--services/java/com/android/server/pm/PackageManagerService.java52
16 files changed, 66 insertions, 20 deletions
diff --git a/core/java/android/content/pm/ApplicationInfo.java b/core/java/android/content/pm/ApplicationInfo.java
index 02401dc5416b..225033169322 100644
--- a/core/java/android/content/pm/ApplicationInfo.java
+++ b/core/java/android/content/pm/ApplicationInfo.java
@@ -338,6 +338,14 @@ public class ApplicationInfo extends PackageItemInfo implements Parcelable {
public static final int FLAG_CANT_SAVE_STATE = 1<<28;
/**
+ * Value for {@link #flags}: set to {@code true} if the application
+ * is permitted to hold privileged permissions.
+ *
+ * {@hide}
+ */
+ public static final int FLAG_PRIVILEGED = 1<<29;
+
+ /**
* Flags associated with the application. Any combination of
* {@link #FLAG_SYSTEM}, {@link #FLAG_DEBUGGABLE}, {@link #FLAG_HAS_CODE},
* {@link #FLAG_PERSISTENT}, {@link #FLAG_FACTORY_TEST}, and
diff --git a/core/java/android/content/pm/PackageParser.java b/core/java/android/content/pm/PackageParser.java
index a3bcfcbb3efc..883516ea7e68 100644
--- a/core/java/android/content/pm/PackageParser.java
+++ b/core/java/android/content/pm/PackageParser.java
@@ -476,6 +476,7 @@ public class PackageParser {
public final static int PARSE_FORWARD_LOCK = 1<<4;
public final static int PARSE_ON_SDCARD = 1<<5;
public final static int PARSE_IS_SYSTEM_DIR = 1<<6;
+ public final static int PARSE_IS_PRIVILEGED = 1<<7;
public int getParseError() {
return mParseError;
diff --git a/packages/BackupRestoreConfirmation/Android.mk b/packages/BackupRestoreConfirmation/Android.mk
index e775b4457831..b84c07f359f4 100644
--- a/packages/BackupRestoreConfirmation/Android.mk
+++ b/packages/BackupRestoreConfirmation/Android.mk
@@ -23,6 +23,7 @@ LOCAL_SRC_FILES := $(call all-java-files-under, src)
LOCAL_PACKAGE_NAME := BackupRestoreConfirmation
LOCAL_CERTIFICATE := platform
+LOCAL_PRIVILEGED_MODULE := true
include $(BUILD_PACKAGE)
diff --git a/packages/DefaultContainerService/Android.mk b/packages/DefaultContainerService/Android.mk
index 56b800504db3..99611683c6f4 100644
--- a/packages/DefaultContainerService/Android.mk
+++ b/packages/DefaultContainerService/Android.mk
@@ -11,6 +11,8 @@ LOCAL_REQUIRED_MODULES := libdefcontainer_jni
LOCAL_CERTIFICATE := platform
+LOCAL_PRIVILEGED_MODULE := true
+
include $(BUILD_PACKAGE)
include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/packages/ExternalStorageProvider/Android.mk b/packages/ExternalStorageProvider/Android.mk
index 32752b8f33a9..db825ff49b4c 100644
--- a/packages/ExternalStorageProvider/Android.mk
+++ b/packages/ExternalStorageProvider/Android.mk
@@ -7,5 +7,6 @@ LOCAL_SRC_FILES := $(call all-subdir-java-files)
LOCAL_PACKAGE_NAME := ExternalStorageProvider
LOCAL_CERTIFICATE := platform
+LOCAL_PRIVILEGED_MODULE := true
include $(BUILD_PACKAGE)
diff --git a/packages/FusedLocation/Android.mk b/packages/FusedLocation/Android.mk
index 318782f4c1d2..7406eaf4e131 100644
--- a/packages/FusedLocation/Android.mk
+++ b/packages/FusedLocation/Android.mk
@@ -23,5 +23,6 @@ LOCAL_JAVA_LIBRARIES := com.android.location.provider
LOCAL_PACKAGE_NAME := FusedLocation
LOCAL_CERTIFICATE := platform
+LOCAL_PRIVILEGED_MODULE := true
include $(BUILD_PACKAGE)
diff --git a/packages/InputDevices/Android.mk b/packages/InputDevices/Android.mk
index 37f24288d945..095655c6514a 100644
--- a/packages/InputDevices/Android.mk
+++ b/packages/InputDevices/Android.mk
@@ -23,6 +23,7 @@ LOCAL_JAVA_LIBRARIES :=
LOCAL_PACKAGE_NAME := InputDevices
LOCAL_CERTIFICATE := platform
+LOCAL_PRIVILEGED_MODULE := true
include $(BUILD_PACKAGE)
diff --git a/packages/Keyguard/Android.mk b/packages/Keyguard/Android.mk
index bc86a4476c1f..f6f441d002fb 100644
--- a/packages/Keyguard/Android.mk
+++ b/packages/Keyguard/Android.mk
@@ -24,6 +24,8 @@ LOCAL_PACKAGE_NAME := Keyguard
LOCAL_CERTIFICATE := platform
+LOCAL_PRIVILEGED_MODULE := true
+
LOCAL_PROGUARD_FLAG_FILES := proguard.flags
include $(BUILD_PACKAGE)
diff --git a/packages/Keyguard/test/Android.mk b/packages/Keyguard/test/Android.mk
index d011df42c920..15059c6af7bb 100644
--- a/packages/Keyguard/test/Android.mk
+++ b/packages/Keyguard/test/Android.mk
@@ -20,8 +20,9 @@ LOCAL_SRC_FILES := $(call all-java-files-under, src)
LOCAL_PACKAGE_NAME := KeyguardTest
-# Remove this to verify permission checks are working correctly
+# Remove these to verify permission checks are working correctly
LOCAL_CERTIFICATE := platform
+LOCAL_PRIVILEGED_MODULE := true
# LOCAL_PROGUARD_FLAG_FILES := proguard.flags
diff --git a/packages/SettingsProvider/Android.mk b/packages/SettingsProvider/Android.mk
index a2ea55465239..da929ae6f1a0 100644
--- a/packages/SettingsProvider/Android.mk
+++ b/packages/SettingsProvider/Android.mk
@@ -9,6 +9,7 @@ LOCAL_JAVA_LIBRARIES := telephony-common
LOCAL_PACKAGE_NAME := SettingsProvider
LOCAL_CERTIFICATE := platform
+LOCAL_PRIVILEGED_MODULE := true
include $(BUILD_PACKAGE)
diff --git a/packages/SharedStorageBackup/Android.mk b/packages/SharedStorageBackup/Android.mk
index 1d4f4da70d0d..a213965f085b 100644
--- a/packages/SharedStorageBackup/Android.mk
+++ b/packages/SharedStorageBackup/Android.mk
@@ -25,6 +25,7 @@ LOCAL_PROGUARD_FLAG_FILES := proguard.flags
LOCAL_PACKAGE_NAME := SharedStorageBackup
LOCAL_CERTIFICATE := platform
+LOCAL_PRIVILEGED_MODULE := true
include $(BUILD_PACKAGE)
diff --git a/packages/Shell/Android.mk b/packages/Shell/Android.mk
index fc4c0f57475d..5bd48c63433c 100644
--- a/packages/Shell/Android.mk
+++ b/packages/Shell/Android.mk
@@ -9,5 +9,6 @@ LOCAL_STATIC_JAVA_LIBRARIES := android-support-v4
LOCAL_PACKAGE_NAME := Shell
LOCAL_CERTIFICATE := platform
+LOCAL_PRIVILEGED_MODULE := true
include $(BUILD_PACKAGE)
diff --git a/packages/SystemUI/Android.mk b/packages/SystemUI/Android.mk
index 015c0cc3d54a..fc70f7a4601a 100644
--- a/packages/SystemUI/Android.mk
+++ b/packages/SystemUI/Android.mk
@@ -10,6 +10,7 @@ LOCAL_JAVA_LIBRARIES := services telephony-common
LOCAL_PACKAGE_NAME := SystemUI
LOCAL_CERTIFICATE := platform
+LOCAL_PRIVILEGED_MODULE := true
LOCAL_PROGUARD_FLAG_FILES := proguard.flags
diff --git a/packages/VpnDialogs/Android.mk b/packages/VpnDialogs/Android.mk
index ac84125f8f4e..4c80a26d186c 100644
--- a/packages/VpnDialogs/Android.mk
+++ b/packages/VpnDialogs/Android.mk
@@ -22,6 +22,8 @@ LOCAL_MODULE_TAGS := optional
LOCAL_CERTIFICATE := platform
+LOCAL_PRIVILEGED_MODULE := true
+
LOCAL_SRC_FILES := $(call all-java-files-under, src)
LOCAL_PACKAGE_NAME := VpnDialogs
diff --git a/services/java/com/android/server/accounts/AccountManagerService.java b/services/java/com/android/server/accounts/AccountManagerService.java
index c5242f02d47e..2145b76b39e5 100644
--- a/services/java/com/android/server/accounts/AccountManagerService.java
+++ b/services/java/com/android/server/accounts/AccountManagerService.java
@@ -2540,7 +2540,7 @@ public class AccountManagerService
return userId;
}
- private boolean inSystemImage(int callingUid) {
+ private boolean isPrivileged(int callingUid) {
final int callingUserId = UserHandle.getUserId(callingUid);
final PackageManager userPackageManager;
@@ -2556,7 +2556,7 @@ public class AccountManagerService
try {
PackageInfo packageInfo = userPackageManager.getPackageInfo(name, 0 /* flags */);
if (packageInfo != null
- && (packageInfo.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM) != 0) {
+ && (packageInfo.applicationInfo.flags & ApplicationInfo.FLAG_PRIVILEGED) != 0) {
return true;
}
} catch (PackageManager.NameNotFoundException e) {
@@ -2567,7 +2567,7 @@ public class AccountManagerService
}
private boolean permissionIsGranted(Account account, String authTokenType, int callerUid) {
- final boolean inSystemImage = inSystemImage(callerUid);
+ final boolean isPrivileged = isPrivileged(callerUid);
final boolean fromAuthenticator = account != null
&& hasAuthenticatorUid(account.type, callerUid);
final boolean hasExplicitGrants = account != null
@@ -2578,7 +2578,7 @@ public class AccountManagerService
+ ": is authenticator? " + fromAuthenticator
+ ", has explicit permission? " + hasExplicitGrants);
}
- return fromAuthenticator || hasExplicitGrants || inSystemImage;
+ return fromAuthenticator || hasExplicitGrants || isPrivileged;
}
private boolean hasAuthenticatorUid(String accountType, int callingUid) {
diff --git a/services/java/com/android/server/pm/PackageManagerService.java b/services/java/com/android/server/pm/PackageManagerService.java
index 5e6e0553c3a1..9ea4262f0eae 100644
--- a/services/java/com/android/server/pm/PackageManagerService.java
+++ b/services/java/com/android/server/pm/PackageManagerService.java
@@ -71,7 +71,6 @@ import android.content.pm.IPackageManager;
import android.content.pm.IPackageMoveObserver;
import android.content.pm.IPackageStatsObserver;
import android.content.pm.InstrumentationInfo;
-import android.content.pm.KeySet;
import android.content.pm.PackageCleanItem;
import android.content.pm.PackageInfo;
import android.content.pm.PackageInfoLite;
@@ -114,15 +113,12 @@ import android.os.SystemProperties;
import android.os.UserHandle;
import android.os.Environment.UserEnvironment;
import android.os.UserManager;
-import android.provider.Settings.Secure;
import android.security.KeyStore;
import android.security.SystemKeyStore;
-import android.util.Base64;
import android.util.DisplayMetrics;
import android.util.EventLog;
import android.util.Log;
import android.util.LogPrinter;
-import android.util.LongSparseArray;
import android.util.Slog;
import android.util.SparseArray;
import android.util.Xml;
@@ -280,6 +276,9 @@ public class PackageManagerService extends IPackageManager.Stub {
// This is the object monitoring the system app dir.
final FileObserver mSystemInstallObserver;
+ // This is the object monitoring the privileged system app dir.
+ final FileObserver mPrivilegedInstallObserver;
+
// This is the object monitoring the system app dir.
final FileObserver mVendorInstallObserver;
@@ -295,6 +294,7 @@ public class PackageManagerService extends IPackageManager.Stub {
final File mFrameworkDir;
final File mSystemAppDir;
+ final File mPrivilegedAppDir;
final File mVendorAppDir;
final File mAppInstallDir;
final File mDalvikCacheDir;
@@ -1058,13 +1058,18 @@ public class PackageManagerService extends IPackageManager.Stub {
mNoDexOpt = "eng".equals(SystemProperties.get("ro.build.type"));
mMetrics = new DisplayMetrics();
mSettings = new Settings(context);
- mSettings.addSharedUserLPw("android.uid.system",
- Process.SYSTEM_UID, ApplicationInfo.FLAG_SYSTEM);
- mSettings.addSharedUserLPw("android.uid.phone", RADIO_UID, ApplicationInfo.FLAG_SYSTEM);
- mSettings.addSharedUserLPw("android.uid.log", LOG_UID, ApplicationInfo.FLAG_SYSTEM);
- mSettings.addSharedUserLPw("android.uid.nfc", NFC_UID, ApplicationInfo.FLAG_SYSTEM);
- mSettings.addSharedUserLPw("android.uid.bluetooth", BLUETOOTH_UID, ApplicationInfo.FLAG_SYSTEM);
- mSettings.addSharedUserLPw("android.uid.shell", SHELL_UID, ApplicationInfo.FLAG_SYSTEM);
+ mSettings.addSharedUserLPw("android.uid.system", Process.SYSTEM_UID,
+ ApplicationInfo.FLAG_SYSTEM|ApplicationInfo.FLAG_PRIVILEGED);
+ mSettings.addSharedUserLPw("android.uid.phone", RADIO_UID,
+ ApplicationInfo.FLAG_SYSTEM|ApplicationInfo.FLAG_PRIVILEGED);
+ mSettings.addSharedUserLPw("android.uid.log", LOG_UID,
+ ApplicationInfo.FLAG_SYSTEM|ApplicationInfo.FLAG_PRIVILEGED);
+ mSettings.addSharedUserLPw("android.uid.nfc", NFC_UID,
+ ApplicationInfo.FLAG_SYSTEM|ApplicationInfo.FLAG_PRIVILEGED);
+ mSettings.addSharedUserLPw("android.uid.bluetooth", BLUETOOTH_UID,
+ ApplicationInfo.FLAG_SYSTEM|ApplicationInfo.FLAG_PRIVILEGED);
+ mSettings.addSharedUserLPw("android.uid.shell", SHELL_UID,
+ ApplicationInfo.FLAG_SYSTEM|ApplicationInfo.FLAG_PRIVILEGED);
String separateProcesses = SystemProperties.get("debug.separate_processes");
if (separateProcesses != null && separateProcesses.length() > 0) {
@@ -1246,7 +1251,16 @@ public class PackageManagerService extends IPackageManager.Stub {
| PackageParser.PARSE_IS_SYSTEM_DIR,
scanMode | SCAN_NO_DEX, 0);
- // Collect all system packages.
+ // Collected privileged system packages.
+ mPrivilegedAppDir = new File(Environment.getRootDirectory(), "priv-app");
+ mPrivilegedInstallObserver = new AppDirObserver(
+ mPrivilegedAppDir.getPath(), OBSERVER_EVENTS, true);
+ mPrivilegedInstallObserver.startWatching();
+ scanDirLI(mPrivilegedAppDir, PackageParser.PARSE_IS_SYSTEM
+ | PackageParser.PARSE_IS_SYSTEM_DIR
+ | PackageParser.PARSE_IS_PRIVILEGED, scanMode, 0);
+
+ // Collect ordinary system packages.
mSystemAppDir = new File(Environment.getRootDirectory(), "app");
mSystemInstallObserver = new AppDirObserver(
mSystemAppDir.getPath(), OBSERVER_EVENTS, true);
@@ -3240,7 +3254,6 @@ public class PackageManagerService extends IPackageManager.Stub {
public List<ProviderInfo> queryContentProviders(String processName,
int uid, int flags) {
ArrayList<ProviderInfo> finalList = null;
-
// reader
synchronized (mPackages) {
final Iterator<PackageParser.Provider> i = mProvidersByComponent.values().iterator();
@@ -3316,7 +3329,8 @@ public class PackageManagerService extends IPackageManager.Stub {
}
if (DEBUG_PACKAGE_SCANNING) {
- Log.d(TAG, "Scanning app dir " + dir);
+ Log.d(TAG, "Scanning app dir " + dir + " scanMode=" + scanMode
+ + " flags=0x" + Integer.toHexString(flags));
}
int i;
@@ -3972,6 +3986,10 @@ public class PackageManagerService extends IPackageManager.Stub {
pkg.applicationInfo.flags |= ApplicationInfo.FLAG_SYSTEM;
}
+ if ((parseFlags&PackageParser.PARSE_IS_PRIVILEGED) != 0) {
+ pkg.applicationInfo.flags |= ApplicationInfo.FLAG_PRIVILEGED;
+ }
+
if (pkg.packageName.equals("android")) {
synchronized (mPackages) {
if (mAndroidApplication != null) {
@@ -5363,7 +5381,7 @@ public class PackageManagerService extends IPackageManager.Stub {
== PackageManager.SIGNATURE_MATCH);
if (!allowed && (bp.protectionLevel
& PermissionInfo.PROTECTION_FLAG_SYSTEM) != 0) {
- if (isSystemApp(pkg)) {
+ if (isPrivilegedApp(pkg)) {
// For updated system applications, a system permission
// is granted only if it had been defined by the original application.
if (isUpdatedSystemApp(pkg)) {
@@ -8566,6 +8584,10 @@ public class PackageManagerService extends IPackageManager.Stub {
return (pkg.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM) != 0;
}
+ private static boolean isPrivilegedApp(PackageParser.Package pkg) {
+ return (pkg.applicationInfo.flags & ApplicationInfo.FLAG_PRIVILEGED) != 0;
+ }
+
private static boolean isSystemApp(ApplicationInfo info) {
return (info.flags & ApplicationInfo.FLAG_SYSTEM) != 0;
}
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-03 07:02:36 +0000