From 42882cc86c7af7ec874e3dde0c6fb8280eba627d Mon Sep 17 00:00:00 2001
From: Adam Bookatz <bookatz@google.com>
Date: Wed, 8 Mar 2023 11:06:17 -0800
Subject: QUERY_USERS is a privileged permission

Unlike MANAGE_USERS, the weaker QUERY_USERS was not marked as a
privileged permission, making it (ironically) harder to get. To
encourage apps for which the weaker permission suffices to use that
weaker permission instead, we change it to privileged.

Bug: 272303195
Test: builds and boots
Test: atest IntentResolverUnitTests (invokes a test app that uses this
permission)

Change-Id: I289023f3007fe1a06c3ed517c397e5b57068b468
---
 core/res/AndroidManifest.xml              | 2 +-
 data/etc/privapp-permissions-platform.xml | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index 85d17650289a..09f89001494b 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -3159,7 +3159,7 @@
     <!-- @SystemApi @hide Allows an application to call APIs that allow it to query users on the
          device. -->
     <permission android:name="android.permission.QUERY_USERS"
-                android:protectionLevel="signature|role" />
+                android:protectionLevel="signature|privileged|role" />
 
     <!-- Allows an application to access data blobs across users. -->
     <permission android:name="android.permission.ACCESS_BLOBS_ACROSS_USERS"
diff --git a/data/etc/privapp-permissions-platform.xml b/data/etc/privapp-permissions-platform.xml
index f3318f400e21..e61f5e39ef16 100644
--- a/data/etc/privapp-permissions-platform.xml
+++ b/data/etc/privapp-permissions-platform.xml
@@ -275,6 +275,7 @@ applications that come with the platform
         <!-- Permission required to test onPermissionsChangedListener -->
         <permission name="android.permission.OBSERVE_GRANT_REVOKE_PERMISSIONS"/>
         <permission name="android.permission.INTERACT_ACROSS_USERS"/>
+        <permission name="android.permission.QUERY_USERS"/>
         <permission name="android.permission.LOCAL_MAC_ADDRESS"/>
         <permission name="android.permission.MANAGE_ACCESSIBILITY"/>
         <permission name="android.permission.MANAGE_DEVICE_ADMINS"/>
-- 
cgit v1.2.3-59-g8ed1b