Start defining strongly-typed storage permissions.
We now have separate permissions that correspond to the various
MediaStore tables:
-- READ/WRITE_MEDIA_AUDIO
-- READ/WRITE_MEDIA_VIDEO
-- READ/WRITE_MEDIA_IMAGES
From a product point-of-view, Images and Videos will being treated as
a single permission group of "Visual" media in Q. We're also defining
two other special permissions:
-- ACCESS_MEDIA_LOCATION: indicating that the app can see any
geographic location related metadata associated with media, such
as being stored in the EXIF data. We're willing to grant this under
the unbrella of the larger "Visual" runtime permission group, but we
still want apps to request it for full disclosure of their intent.
-- WRITE_OBB: can be held by app stores that need to deliver OBB
files into app-specific sandboxes to keep legacy apps working.
Test: manual
Bug: 111801780, 110228267, 111789719, 111892833
Change-Id: If28247efdd7ac185ad3c6cbceda2e6346c26d032
diff --git a/services/core/java/com/android/server/pm/permission/DefaultPermissionGrantPolicy.java b/services/core/java/com/android/server/pm/permission/DefaultPermissionGrantPolicy.java
index 50e6f8d..843cd8a 100644
--- a/services/core/java/com/android/server/pm/permission/DefaultPermissionGrantPolicy.java
+++ b/services/core/java/com/android/server/pm/permission/DefaultPermissionGrantPolicy.java
@@ -45,6 +45,7 @@
import android.os.Handler;
import android.os.Looper;
import android.os.Message;
+import android.os.SystemProperties;
import android.os.UserHandle;
import android.os.storage.StorageManager;
import android.print.PrintManager;
@@ -169,12 +170,33 @@
SENSORS_PERMISSIONS.add(Manifest.permission.BODY_SENSORS);
}
+ @Deprecated
private static final Set<String> STORAGE_PERMISSIONS = new ArraySet<>();
static {
STORAGE_PERMISSIONS.add(Manifest.permission.READ_EXTERNAL_STORAGE);
STORAGE_PERMISSIONS.add(Manifest.permission.WRITE_EXTERNAL_STORAGE);
}
+ private static final Set<String> MEDIA_AURAL_PERMISSIONS = new ArraySet<>();
+ static {
+ // STOPSHIP(b/112545973): remove once feature enabled by default
+ if (SystemProperties.getBoolean(StorageManager.PROP_ISOLATED_STORAGE, false)) {
+ MEDIA_AURAL_PERMISSIONS.add(Manifest.permission.READ_MEDIA_AUDIO);
+ MEDIA_AURAL_PERMISSIONS.add(Manifest.permission.WRITE_MEDIA_AUDIO);
+ }
+ }
+
+ private static final Set<String> MEDIA_VISUAL_PERMISSIONS = new ArraySet<>();
+ static {
+ // STOPSHIP(b/112545973): remove once feature enabled by default
+ if (SystemProperties.getBoolean(StorageManager.PROP_ISOLATED_STORAGE, false)) {
+ MEDIA_VISUAL_PERMISSIONS.add(Manifest.permission.READ_MEDIA_IMAGES);
+ MEDIA_VISUAL_PERMISSIONS.add(Manifest.permission.WRITE_MEDIA_IMAGES);
+ MEDIA_VISUAL_PERMISSIONS.add(Manifest.permission.READ_MEDIA_VIDEO);
+ MEDIA_VISUAL_PERMISSIONS.add(Manifest.permission.WRITE_MEDIA_VIDEO);
+ }
+ }
+
private static final int MSG_READ_DEFAULT_PERMISSION_EXCEPTIONS = 1;
private static final String ACTION_TRACK = "com.android.fitness.TRACK";
@@ -404,6 +426,8 @@
MediaStore.AUTHORITY, userId);
if (mediaStorePackage != null) {
grantRuntimePermissions(mediaStorePackage, STORAGE_PERMISSIONS, true, userId);
+ grantRuntimePermissions(mediaStorePackage, MEDIA_AURAL_PERMISSIONS, true, userId);
+ grantRuntimePermissions(mediaStorePackage, MEDIA_VISUAL_PERMISSIONS, true, userId);
grantRuntimePermissions(mediaStorePackage, PHONE_PERMISSIONS, true, userId);
}
@@ -615,6 +639,7 @@
if (galleryPackage != null
&& doesPackageSupportRuntimePermissions(galleryPackage)) {
grantRuntimePermissions(galleryPackage, STORAGE_PERMISSIONS, userId);
+ grantRuntimePermissions(galleryPackage, MEDIA_VISUAL_PERMISSIONS, userId);
}
// Email
@@ -724,6 +749,7 @@
if (musicPackage != null
&& doesPackageSupportRuntimePermissions(musicPackage)) {
grantRuntimePermissions(musicPackage, STORAGE_PERMISSIONS, userId);
+ grantRuntimePermissions(musicPackage, MEDIA_AURAL_PERMISSIONS, userId);
}
// Home