diff options
Diffstat (limited to 'services/appfunctions/java')
3 files changed, 4 insertions, 31 deletions
diff --git a/services/appfunctions/java/com/android/server/appfunctions/CallerValidator.java b/services/appfunctions/java/com/android/server/appfunctions/CallerValidator.java index 61917676e88d..98ef974b9443 100644 --- a/services/appfunctions/java/com/android/server/appfunctions/CallerValidator.java +++ b/services/appfunctions/java/com/android/server/appfunctions/CallerValidator.java @@ -60,9 +60,7 @@ public interface CallerValidator { * Validates that the caller can execute the specified app function. * * <p>The caller can execute if the app function's package name is the same as the caller's - * package or the caller has either {@link Manifest.permission#EXECUTE_APP_FUNCTIONS_TRUSTED} or - * {@link Manifest.permission#EXECUTE_APP_FUNCTIONS} granted. In some cases, app functions can - * still opt-out of caller having {@link Manifest.permission#EXECUTE_APP_FUNCTIONS}. + * package or the caller has the {@link Manifest.permission#EXECUTE_APP_FUNCTIONS} granted. * * @param callingUid The calling uid. * @param callingPid The calling pid. diff --git a/services/appfunctions/java/com/android/server/appfunctions/CallerValidatorImpl.java b/services/appfunctions/java/com/android/server/appfunctions/CallerValidatorImpl.java index 69481c32baf0..fe163d77c4fc 100644 --- a/services/appfunctions/java/com/android/server/appfunctions/CallerValidatorImpl.java +++ b/services/appfunctions/java/com/android/server/appfunctions/CallerValidatorImpl.java @@ -18,7 +18,6 @@ package com.android.server.appfunctions; import static android.app.appfunctions.AppFunctionStaticMetadataHelper.APP_FUNCTION_STATIC_METADATA_DB; import static android.app.appfunctions.AppFunctionStaticMetadataHelper.APP_FUNCTION_STATIC_NAMESPACE; -import static android.app.appfunctions.AppFunctionStaticMetadataHelper.STATIC_PROPERTY_RESTRICT_CALLERS_WITH_EXECUTE_APP_FUNCTIONS; import static android.app.appfunctions.AppFunctionStaticMetadataHelper.getDocumentIdForAppFunction; import static com.android.server.appfunctions.AppFunctionExecutors.THREAD_POOL_EXECUTOR; @@ -84,12 +83,7 @@ class CallerValidatorImpl implements CallerValidator { } @Override - @RequiresPermission( - anyOf = { - Manifest.permission.EXECUTE_APP_FUNCTIONS_TRUSTED, - Manifest.permission.EXECUTE_APP_FUNCTIONS - }, - conditional = true) + @RequiresPermission(Manifest.permission.EXECUTE_APP_FUNCTIONS) public AndroidFuture<Boolean> verifyCallerCanExecuteAppFunction( int callingUid, int callingPid, @@ -101,17 +95,6 @@ class CallerValidatorImpl implements CallerValidator { return AndroidFuture.completedFuture(true); } - boolean hasTrustedExecutionPermission = - mContext.checkPermission( - Manifest.permission.EXECUTE_APP_FUNCTIONS_TRUSTED, - callingPid, - callingUid) - == PackageManager.PERMISSION_GRANTED; - - if (hasTrustedExecutionPermission) { - return AndroidFuture.completedFuture(true); - } - boolean hasExecutionPermission = mContext.checkPermission( Manifest.permission.EXECUTE_APP_FUNCTIONS, callingPid, callingUid) @@ -138,7 +121,8 @@ class CallerValidatorImpl implements CallerValidator { .build()) .thenApply( batchResult -> getGenericDocumentFromBatchResult(batchResult, documentId)) - .thenApply(document -> !getRestrictCallersWithExecuteAppFunctionsProperty(document)) + // At this point, already checked the app has the permission. + .thenApply(document -> true) .whenComplete( (result, throwable) -> { futureAppSearchSession.close(); @@ -160,12 +144,6 @@ class CallerValidatorImpl implements CallerValidator { + failedResult.getErrorMessage()); } - private static boolean getRestrictCallersWithExecuteAppFunctionsProperty( - GenericDocument genericDocument) { - return genericDocument.getPropertyBoolean( - STATIC_PROPERTY_RESTRICT_CALLERS_WITH_EXECUTE_APP_FUNCTIONS); - } - @Override public boolean verifyEnterprisePolicyIsAllowed( @NonNull UserHandle callingUser, @NonNull UserHandle targetUser) { diff --git a/services/appfunctions/java/com/android/server/appfunctions/MetadataSyncAdapter.java b/services/appfunctions/java/com/android/server/appfunctions/MetadataSyncAdapter.java index cc73288cdbfa..9d13e37b2503 100644 --- a/services/appfunctions/java/com/android/server/appfunctions/MetadataSyncAdapter.java +++ b/services/appfunctions/java/com/android/server/appfunctions/MetadataSyncAdapter.java @@ -78,7 +78,6 @@ public class MetadataSyncAdapter { // Hidden constants in {@link SetSchemaRequest} that restricts runtime metadata visibility // by permissions. public static final int EXECUTE_APP_FUNCTIONS = 9; - public static final int EXECUTE_APP_FUNCTIONS_TRUSTED = 10; public MetadataSyncAdapter( @NonNull PackageManager packageManager, @NonNull AppSearchManager appSearchManager) { @@ -281,8 +280,6 @@ public class MetadataSyncAdapter { new PackageIdentifier(packageName, packageCert)); setSchemaRequestBuilder.addRequiredPermissionsForSchemaTypeVisibility( runtimeMetadataSchema.getSchemaType(), Set.of(EXECUTE_APP_FUNCTIONS)); - setSchemaRequestBuilder.addRequiredPermissionsForSchemaTypeVisibility( - runtimeMetadataSchema.getSchemaType(), Set.of(EXECUTE_APP_FUNCTIONS_TRUSTED)); } return setSchemaRequestBuilder.build(); } |