Merge "Work on issue #21589105: Scope WRITE_SETTINGS and SYSTEM_ALERT_WINDOW..." into mnc-dev

8 files changed, 29 insertions, 2 deletions

diff --git a/api/current.txt b/api/current.txt
index a4e1dec..0f7abee 100644
--- a/api/current.txt
+++ b/api/current.txt
@@ -9468,6 +9468,7 @@ package android.content.pm {
     field public static final int PROTECTION_DANGEROUS = 1; // 0x1
     field public static final int PROTECTION_FLAG_APPOP = 64; // 0x40
     field public static final int PROTECTION_FLAG_DEVELOPMENT = 32; // 0x20
+    field public static final int PROTECTION_FLAG_PRE23 = 128; // 0x80
     field public static final int PROTECTION_FLAG_SYSTEM = 16; // 0x10
     field public static final int PROTECTION_MASK_BASE = 15; // 0xf
     field public static final int PROTECTION_MASK_FLAGS = 240; // 0xf0
diff --git a/api/system-current.txt b/api/system-current.txt
index f1da5f2..1989da0 100644
--- a/api/system-current.txt
+++ b/api/system-current.txt
@@ -9808,6 +9808,7 @@ package android.content.pm {
     field public static final int PROTECTION_DANGEROUS = 1; // 0x1
     field public static final int PROTECTION_FLAG_APPOP = 64; // 0x40
     field public static final int PROTECTION_FLAG_DEVELOPMENT = 32; // 0x20
+    field public static final int PROTECTION_FLAG_PRE23 = 128; // 0x80
     field public static final int PROTECTION_FLAG_SYSTEM = 16; // 0x10
     field public static final int PROTECTION_MASK_BASE = 15; // 0xf
     field public static final int PROTECTION_MASK_FLAGS = 240; // 0xf0
diff --git a/core/java/android/content/pm/PermissionInfo.java b/core/java/android/content/pm/PermissionInfo.java
index 04dbff2..0a1f148 100644
--- a/core/java/android/content/pm/PermissionInfo.java
+++ b/core/java/android/content/pm/PermissionInfo.java
@@ -76,6 +76,13 @@ public class PermissionInfo extends PackageItemInfo implements Parcelable {
     public static final int PROTECTION_FLAG_APPOP = 0x40;
 
     /**
+     * Additional flag for {@link #protectionLevel}, corresponding
+     * to the <code>pre23</code> value of
+     * {@link android.R.attr#protectionLevel}.
+     */
+    public static final int PROTECTION_FLAG_PRE23 = 0x80;
+
+    /**
      * Mask for {@link #protectionLevel}: the basic protection type.
      */
     public static final int PROTECTION_MASK_BASE = 0xf;
@@ -171,6 +178,9 @@ public class PermissionInfo extends PackageItemInfo implements Parcelable {
         if ((level&PermissionInfo.PROTECTION_FLAG_APPOP) != 0) {
             protLevel += "|appop";
         }
+        if ((level&PermissionInfo.PROTECTION_FLAG_PRE23) != 0) {
+            protLevel += "|pre23";
+        }
         return protLevel;
     }
 
diff --git a/core/java/android/widget/AppSecurityPermissions.java b/core/java/android/widget/AppSecurityPermissions.java
index bb4a948..c54b28d 100644
--- a/core/java/android/widget/AppSecurityPermissions.java
+++ b/core/java/android/widget/AppSecurityPermissions.java
@@ -553,7 +553,8 @@ public class AppSecurityPermissions {
             int existingReqFlags) {
         final int base = pInfo.protectionLevel & PermissionInfo.PROTECTION_MASK_BASE;
         final boolean isNormal = (base == PermissionInfo.PROTECTION_NORMAL);
-        final boolean isDangerous = (base == PermissionInfo.PROTECTION_DANGEROUS);
+        final boolean isDangerous = (base == PermissionInfo.PROTECTION_DANGEROUS)
+                || ((pInfo.protectionLevel&PermissionInfo.PROTECTION_FLAG_PRE23) != 0);
         final boolean isRequired =
                 ((newReqFlags&PackageInfo.REQUESTED_PERMISSION_REQUIRED) != 0);
         final boolean isDevelopment =
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index 7f61a04..4c1626a 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -1404,7 +1404,7 @@
     <permission android:name="android.permission.SYSTEM_ALERT_WINDOW"
         android:label="@string/permlab_systemAlertWindow"
         android:description="@string/permdesc_systemAlertWindow"
-        android:protectionLevel="signature|system|appop" />
+        android:protectionLevel="signature|system|appop|pre23" />
 
     <!-- ================================== -->
     <!-- Permissions affecting the system wallpaper -->
diff --git a/core/res/res/values/attrs_manifest.xml b/core/res/res/values/attrs_manifest.xml
index 3cb4d7c..70f9db9 100644
--- a/core/res/res/values/attrs_manifest.xml
+++ b/core/res/res/values/attrs_manifest.xml
@@ -215,6 +215,11 @@
         <!-- Additional flag from base permission type: this permission is closely
              associated with an app op for controlling access. -->
         <flag name="appop" value="0x40" />
+        <!-- Additional flag from base permission type: this permission can be automatically
+             granted to apps that target API levels below
+             {@link android.os.Build.VERSION_CODES#MNC} (before runtime permissions
+             were introduced). -->
+        <flag name="pre23" value="0x80" />
     </attr>
 
     <!-- Flags indicating more context for a permission group. -->
diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index cd5e75a..352e953 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -8382,6 +8382,14 @@ public class PackageManagerService extends IPackageManager.Stub {
             }
         }
         if (!allowed && (bp.protectionLevel
+                & PermissionInfo.PROTECTION_FLAG_PRE23) != 0
+                && pkg.applicationInfo.targetSdkVersion < Build.VERSION_CODES.MNC) {
+            // If this was a previously normal/dangerous permission that got moved
+            // to a system permission as part of the runtime permission redesign, then
+            // we still want to blindly grant it to old apps.
+            allowed = true;
+        }
+        if (!allowed && (bp.protectionLevel
                 & PermissionInfo.PROTECTION_FLAG_DEVELOPMENT) != 0) {
             // For development permissions, a development permission
             // is granted only if it was already granted.
diff --git a/tests/ActivityTests/AndroidManifest.xml b/tests/ActivityTests/AndroidManifest.xml
index dae7cc5..73cb432 100644
--- a/tests/ActivityTests/AndroidManifest.xml
+++ b/tests/ActivityTests/AndroidManifest.xml
@@ -24,6 +24,7 @@
     <uses-permission android:name="android.permission.INTERACT_ACROSS_USERS_FULL" />
     <uses-permission android:name="android.permission.MANAGE_USERS" />
     <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
+    <uses-sdk android:targetSdkVersion="22" />
     <application android:label="ActivityTest">
         <activity android:name="ActivityTestMain">
             <intent-filter>