1 files changed, 25 insertions, 3 deletions

diff --git a/src/com/android/packageinstaller/permission/model/AppPermissionGroup.java b/src/com/android/packageinstaller/permission/model/AppPermissionGroup.java
index 9706f823..baf4c5e6 100644
--- a/src/com/android/packageinstaller/permission/model/AppPermissionGroup.java
+++ b/src/com/android/packageinstaller/permission/model/AppPermissionGroup.java
@@ -57,6 +57,9 @@ public final class AppPermissionGroup implements Comparable<AppPermissionGroup>
     private final int mIconResId;
 
     private final boolean mAppSupportsRuntimePermissions;
+    private final boolean mIsEphemeralApp;
+    private boolean mContainsEphemeralPermission;
+    private boolean mContainsPreRuntimePermission;
 
     public static AppPermissionGroup create(Context context, PackageInfo packageInfo,
             String permissionName) {
@@ -67,7 +70,8 @@ public final class AppPermissionGroup implements Comparable<AppPermissionGroup>
             return null;
         }
 
-        if (permissionInfo.protectionLevel != PermissionInfo.PROTECTION_DANGEROUS
+        if ((permissionInfo.protectionLevel & PermissionInfo.PROTECTION_MASK_BASE)
+                != PermissionInfo.PROTECTION_DANGEROUS
                 || (permissionInfo.flags & PermissionInfo.FLAG_INSTALLED) == 0
                 || (permissionInfo.flags & PermissionInfo.FLAG_REMOVED) != 0) {
             return null;
@@ -133,7 +137,8 @@ public final class AppPermissionGroup implements Comparable<AppPermissionGroup>
             }
 
             // Collect only runtime permissions.
-            if (requestedPermissionInfo.protectionLevel != PermissionInfo.PROTECTION_DANGEROUS) {
+            if ((requestedPermissionInfo.protectionLevel & PermissionInfo.PROTECTION_MASK_BASE)
+                    != PermissionInfo.PROTECTION_DANGEROUS) {
                 continue;
             }
 
@@ -158,7 +163,7 @@ public final class AppPermissionGroup implements Comparable<AppPermissionGroup>
                     requestedPermission, packageInfo.packageName, userHandle);
 
             Permission permission = new Permission(requestedPermission, granted,
-                    appOp, appOpAllowed, flags);
+                    appOp, appOpAllowed, flags, requestedPermissionInfo.protectionLevel);
             group.addPermission(permission);
         }
 
@@ -191,6 +196,7 @@ public final class AppPermissionGroup implements Comparable<AppPermissionGroup>
         mPackageInfo = packageInfo;
         mAppSupportsRuntimePermissions = packageInfo.applicationInfo
                 .targetSdkVersion > Build.VERSION_CODES.LOLLIPOP_MR1;
+        mIsEphemeralApp = packageInfo.applicationInfo.isInstantApp();
         mAppOps = context.getSystemService(AppOpsManager.class);
         mActivityManager = context.getSystemService(ActivityManager.class);
         mDeclaringPackage = declaringPackage;
@@ -210,6 +216,11 @@ public final class AppPermissionGroup implements Comparable<AppPermissionGroup>
         return mAppSupportsRuntimePermissions;
     }
 
+    public boolean isGrantingAllowed() {
+        return (!mIsEphemeralApp || mContainsEphemeralPermission)
+                && (mAppSupportsRuntimePermissions || mContainsPreRuntimePermission);
+    }
+
     public boolean isReviewRequired() {
         if (mAppSupportsRuntimePermissions) {
             return false;
@@ -328,6 +339,11 @@ public final class AppPermissionGroup implements Comparable<AppPermissionGroup>
                 continue;
             }
 
+            if (!permission.isGrantingAllowed(mIsEphemeralApp, mAppSupportsRuntimePermissions)) {
+                // Skip unallowed permissions.
+                continue;
+            }
+
             if (mAppSupportsRuntimePermissions) {
                 // Do not touch permissions fixed by the system.
                 if (permission.isSystemFixed()) {
@@ -638,5 +654,11 @@ public final class AppPermissionGroup implements Comparable<AppPermissionGroup>
 
     private void addPermission(Permission permission) {
         mPermissions.put(permission.getName(), permission);
+        if (permission.isEphemeral()) {
+            mContainsEphemeralPermission = true;
+        }
+        if (!permission.isRuntimeOnly()) {
+            mContainsPreRuntimePermission = true;
+        }
     }
 }