foss.mk

@@ -1 +1,4 @@
 -include vendor/foss/apps.mk
+
+PRODUCT_COPY_FILES += \
+    vendor/foss/privapp-permissions-foss.xml:$(TARGET_COPY_OUT_PRODUCT)/etc/permissions/privapp-permissions-foss.xml

gen-privapp-perms.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+set -e
+
+PRIVILEGED_APPS=(
+  "com.google.android.gms"
+  "com.android.vending"
+)
+
+if ! which aapt; then
+    echo "No aapt binary found; run \`mm aapt\` first"
+    exit 1
+fi
+
+# Always execute in the script's directory
+pushd "$(dirname "$(realpath "$0")")"
+
+AOSP_ROOT="../../"
+APKS=( )
+for app in "${PRIVILEGED_APPS[@]}"
+    do APKS+=( bin/"$app"-*.apk )
+done
+
+# ↓ env required by privapp_permissions.py ↓
+# the path contains system/framework/framework-res.apk
+export ANDROID_PRODUCT_OUT="$AOSP_ROOT/out/target/product/peter_gsi_arm64"
+export ANDROID_HOST_OUT=""
+
+if [ ! -f "$ANDROID_PRODUCT_OUT/system/framework/framework-res.apk" ]; then
+    echo "No framework-res.apk found; run \`m framework-res\` first"
+    exit 1
+fi
+
+# remove the old xml, it will interfere with the privapp_permissions.py
+rm -f "$ANDROID_PRODUCT_OUT/system/product/etc/permissions/privapp-permissions-foss.xml"
+
+python3 "$AOSP_ROOT/development/tools/privapp_permissions/privapp_permissions.py" \
+    "${APKS[@]}" \
+    --partitions system/product \
+    --writetodisk \
+    --productfile privapp-permissions-foss.xml

privapp-permissions-foss.xml

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- for the partition: /system/product -->
+<permissions>
+    <privapp-permissions package="com.android.vending">
+        <permission name="android.permission.DELETE_PACKAGES"/>
+        <permission name="android.permission.INSTALL_PACKAGES"/>
+        <permission name="android.permission.INTERACT_ACROSS_USERS"/>
+    </privapp-permissions>
+
+    <privapp-permissions package="com.google.android.gms">
+        <permission name="android.permission.CHANGE_DEVICE_IDLE_TEMP_WHITELIST"/>
+        <permission name="android.permission.INSTALL_LOCATION_PROVIDER"/>
+        <permission name="android.permission.INTERACT_ACROSS_USERS"/>
+        <permission name="android.permission.LOCATION_HARDWARE"/>
+        <permission name="android.permission.MANAGE_USB"/>
+        <permission name="android.permission.MODIFY_PHONE_STATE"/>
+        <permission name="android.permission.NETWORK_SCAN"/>
+        <permission name="android.permission.PROVIDE_DEFAULT_ENABLED_CREDENTIAL_SERVICE"/>
+        <permission name="android.permission.PROVIDE_REMOTE_CREDENTIALS"/>
+        <permission name="android.permission.START_ACTIVITIES_FROM_BACKGROUND"/>
+        <permission name="android.permission.UPDATE_APP_OPS_STATS"/>
+        <permission name="android.permission.UPDATE_DEVICE_STATS"/>
+        <permission name="android.permission.WATCH_APPOPS"/>
+    </privapp-permissions>
+
+</permissions>