diff options
| -rw-r--r-- | core/java/android/app/AppOpsManager.java | 23 | ||||
| -rw-r--r-- | services/core/java/com/android/server/appop/AppOpsService.java | 8 |
2 files changed, 20 insertions, 11 deletions
diff --git a/core/java/android/app/AppOpsManager.java b/core/java/android/app/AppOpsManager.java index c7c654a0b071..3b1943bf86f6 100644 --- a/core/java/android/app/AppOpsManager.java +++ b/core/java/android/app/AppOpsManager.java @@ -2537,8 +2537,8 @@ public class AppOpsManager { * restriction} for a certain app-op. */ private static RestrictionBypass[] sOpAllowSystemRestrictionBypass = new RestrictionBypass[] { - null, //COARSE_LOCATION - null, //FINE_LOCATION + new RestrictionBypass(true, false, false), //COARSE_LOCATION + new RestrictionBypass(true, false, false), //FINE_LOCATION null, //GPS null, //VIBRATE null, //READ_CONTACTS @@ -2547,7 +2547,7 @@ public class AppOpsManager { null, //WRITE_CALL_LOG null, //READ_CALENDAR null, //WRITE_CALENDAR - new RestrictionBypass(true, false), //WIFI_SCAN + new RestrictionBypass(false, true, false), //WIFI_SCAN null, //POST_NOTIFICATION null, //NEIGHBORING_CELLS null, //CALL_PHONE @@ -2561,10 +2561,10 @@ public class AppOpsManager { null, //READ_ICC_SMS null, //WRITE_ICC_SMS null, //WRITE_SETTINGS - new RestrictionBypass(true, false), //SYSTEM_ALERT_WINDOW + new RestrictionBypass(false, true, false), //SYSTEM_ALERT_WINDOW null, //ACCESS_NOTIFICATIONS null, //CAMERA - new RestrictionBypass(false, true), //RECORD_AUDIO + new RestrictionBypass(false, false, true), //RECORD_AUDIO null, //PLAY_AUDIO null, //READ_CLIPBOARD null, //WRITE_CLIPBOARD @@ -2582,7 +2582,7 @@ public class AppOpsManager { null, //MONITOR_HIGH_POWER_LOCATION null, //GET_USAGE_STATS null, //MUTE_MICROPHONE - new RestrictionBypass(true, false), //TOAST_WINDOW + new RestrictionBypass(false, true, false), //TOAST_WINDOW null, //PROJECT_MEDIA null, //ACTIVATE_VPN null, //WALLPAPER @@ -2614,7 +2614,7 @@ public class AppOpsManager { null, // ACCEPT_HANDOVER null, // MANAGE_IPSEC_HANDOVERS null, // START_FOREGROUND - new RestrictionBypass(true, false), // BLUETOOTH_SCAN + new RestrictionBypass(false, true, false), // BLUETOOTH_SCAN null, // USE_BIOMETRIC null, // ACTIVITY_RECOGNITION null, // SMS_FINANCIAL_TRANSACTIONS @@ -3331,6 +3331,9 @@ public class AppOpsManager { * @hide */ public static class RestrictionBypass { + /** Does the app need to be system uid to bypass the restriction */ + public boolean isSystemUid; + /** Does the app need to be privileged to bypass the restriction */ public boolean isPrivileged; @@ -3340,12 +3343,14 @@ public class AppOpsManager { */ public boolean isRecordAudioRestrictionExcept; - public RestrictionBypass(boolean isPrivileged, boolean isRecordAudioRestrictionExcept) { + public RestrictionBypass(boolean isSystemUid, boolean isPrivileged, + boolean isRecordAudioRestrictionExcept) { + this.isSystemUid = isSystemUid; this.isPrivileged = isPrivileged; this.isRecordAudioRestrictionExcept = isRecordAudioRestrictionExcept; } - public static RestrictionBypass UNRESTRICTED = new RestrictionBypass(true, true); + public static RestrictionBypass UNRESTRICTED = new RestrictionBypass(false, true, true); } /** diff --git a/services/core/java/com/android/server/appop/AppOpsService.java b/services/core/java/com/android/server/appop/AppOpsService.java index 3e97b913a158..36afb3677438 100644 --- a/services/core/java/com/android/server/appop/AppOpsService.java +++ b/services/core/java/com/android/server/appop/AppOpsService.java @@ -4545,8 +4545,9 @@ public class AppOpsService extends IAppOpsService.Stub { * @return The restriction matching the package */ private RestrictionBypass getBypassforPackage(@NonNull AndroidPackage pkg) { - return new RestrictionBypass(pkg.isPrivileged(), mContext.checkPermission( - android.Manifest.permission.EXEMPT_FROM_AUDIO_RECORD_RESTRICTIONS, -1, pkg.getUid()) + return new RestrictionBypass(pkg.getUid() == Process.SYSTEM_UID, pkg.isPrivileged(), + mContext.checkPermission(android.Manifest.permission + .EXEMPT_FROM_AUDIO_RECORD_RESTRICTIONS, -1, pkg.getUid()) == PackageManager.PERMISSION_GRANTED); } @@ -4853,6 +4854,9 @@ public class AppOpsService extends IAppOpsService.Stub { if (opBypass != null) { // If we are the system, bypass user restrictions for certain codes synchronized (this) { + if (opBypass.isSystemUid && appBypass != null && appBypass.isSystemUid) { + return false; + } if (opBypass.isPrivileged && appBypass != null && appBypass.isPrivileged) { return false; } |