CVE-2024-40661 AI-generated analysis
platform/packages/modules/Permission, PermissionController (admin runtime permission grant path, PermissionControllerServiceImpl / AdminRestrictedPermissionsUtils)
AdminRestrictedPermissionsUtils.mayAdminGrantPermission now takes the permission group name and no longer returns true early when either the permission itself or any platform permission in its group is an admin-restricted sensor permission. This stops an admin without sensor-grant authority from granting into a sensor permission group through a permission that is not itself on the restricted list.
Root cause
In PermissionControllerServiceImpl (the grant-state handler around line 563), the PERMISSION_GRANT_STATE_GRANTED branch allowed the grant only if AdminRestrictedPermissionsUtils.mayAdminGrantPermission(perm.getName(), canAdminGrantSensorsPermissions, isManagedProfile, dpm) returned true. That method returned true early for any permission whose exact name was not in ADMIN_RESTRICTED_SENSORS_PERMISSIONS (location, camera, record audio, activity recognition, body sensors, plus the S and T additions), and it ignored the permission group. The grant then runs through the AppPermissionGroup (perm.setPolicyFixed(true) and group.grantRuntimePermissions(...)). So a permission in a restricted sensor group (for example android.permission-group.MICROPHONE) that was not itself on the list passed the check even when canAdminGrantSensorsPermissions was false.
How the fix works
- PermissionController/src/.../permission/utils/v31/AdminRestrictedPermissionsUtils.java:mayAdminGrantPermission: the signature gains a String permissionGroup parameter. A new boolean, isAdminRestrictedSensorPermissionGroup, is computed as permissionGroup != null && PermissionMapping.getPlatformPermissionNamesOfGroup(permissionGroup).stream().anyMatch(ADMIN_RESTRICTED_SENSORS_PERMISSIONS::contains). The early 'return true' now applies only if the permission is not in ADMIN_RESTRICTED_SENSORS_PERMISSIONS and the group is not a restricted sensor group. Otherwise the method continues to the remaining check, which the diff does not show. The new test shows that result depends on canAdminGrantSensorsPermissions. The pre-S 'return true' and the managed-profile READ_SMS case still run first.
- PermissionController/src/.../permission/service/PermissionControllerServiceImpl.java (GRANTED branch of the grant-state switch): the call site now passes group.getName() as the new second argument, so the check covers the AppPermissionGroup that performs the grant.
- PermissionController/tests/mocking/Android.bp: adds platform-test-annotations to the test module's dependency list, which @AsbSecurityTest needs.
- PermissionController/tests/mocking/.../AdminRestrictedPermissionsUtilsTest.kt: new parameterized test (cveBugId 308138085). An unknown permission with an unknown or null group is allowed. RECORD_AUDIO in an unknown group is denied. An unknown permission in the MICROPHONE group is denied. RECORD_AUDIO in MICROPHONE is denied when canAdminGrantSensorsPermissions=false and allowed when it is true.
Completeness
- The fix covers the PERMISSION_GRANT_STATE_GRANTED branch of the grant-state handler, the only branch that grants. The DENIED and DEFAULT branches are unchanged and do not grant.
- Group membership comes from PermissionMapping.getPlatformPermissionNamesOfGroup, so only platform-defined permission groups are checked. A null group name is tolerated and falls back to the per-permission check.
- The pre-S early 'return true' and the managed-profile READ_SMS path are unchanged.
- The material does not show whether mayAdminGrantPermission has other callers that still pass only a permission name. The signature change would make any such caller fail to compile.
- Per-major facts report 7/8 lines of the patched region present at android-security-14.0.0_r29 and at the latest 15, 16 and 17 tags. The material does not show which line differs.
Behavior changes
- Admins that may not grant sensor permissions (canAdminGrantSensorsPermissions=false) are now also refused when the target permission belongs to a platform permission group that contains a restricted sensor permission. In that case the code takes the else branch and calls perm.setPolicyFixed(false) instead of granting and setting policy-fixed.
- The public static method AdminRestrictedPermissionsUtils.mayAdminGrantPermission has a new signature (added permissionGroup argument).
- AdminRestrictedPermissionsUtils now depends on PermissionMapping.
- The test build gains a platform-test-annotations dependency.
Per major
- Android 14: same fix: commit ffd81f212b55 (RESTRICT AUTOMERGE, cherry-picked through 682c92ee1e47 and 7b959874bb34) in android-security-14.0.0_r12; 7/8 lines of the patched region present at android-security-14.0.0_r29.
- Android 15: not affected per the bulletin; 7/8 lines of the patched region present at android-security-15.0.0_r17, which suggests the fixed code is present.
- Android 16: not affected per the bulletin; 7/8 lines of the patched region present at android-security-16.0.0_r8.
- Android 17: not affected per the bulletin; 7/8 lines of the patched region present at android-security-17.0.0_r1.
Unknowns
- Which line of the 8-line patched region differs at the latest security tags.
- Whether mayAdminGrantPermission has callers other than the PermissionControllerServiceImpl site shown.
- The rest of mayAdminGrantPermission after the early return is not in the diff.
- How AppPermissionGroup.grantRuntimePermissions handles a grant of one permission in a sensor group; its internals are not in the material.
- Whether the fix is also delivered through a Permission module update; the material shows only the platform security tag.