From 03bca97d0eadf3494b99721693921eff64b3a52b Mon Sep 17 00:00:00 2001
From: chris42 <chris42@users.noreply.github.com>
Date: Thu, 12 Aug 2021 19:44:46 +0200
Subject: [PATCH] add default permission policy

Co-authored-by: nift4 <nift4@protonmail.com>
Change-Id: I28714580eadf9bf1c3bf2b7529c6917278a35151
---
 .../permissions-com.android.vending.xml       | 20 ++++++++++++
 .../permissions-com.google.android.gms.xml    | 31 +++++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 system/etc/permissions/permissions-com.android.vending.xml
 create mode 100644 system/etc/permissions/permissions-com.google.android.gms.xml

diff --git a/system/etc/permissions/permissions-com.android.vending.xml b/system/etc/permissions/permissions-com.android.vending.xml
new file mode 100644
index 0000000..41a8341
--- /dev/null
+++ b/system/etc/permissions/permissions-com.android.vending.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2019 chris42 (based on work of ale5k and nanolx)
+     Copyright (C) 2021 nift4
+     SPDX-License-Identifer: GPL-3.0-or-later
+     This file contains permissions to be granted by default.
+     Default permissions are granted to special platform components and to apps that are approved to get default grants.
+     The special components are apps that are expected to work out-of-the-box as they provide core use cases.
+     Fixed permissions cannot be controlled by the user and need a special approval.
+     Typically these are to ensure either legally mandated functions or the app is considered a part of the OS.
+     Granting these permissions could prevent issues on some ROMs or on non-clean installations.
+-->
+
+<exceptions>
+    <exception package="com.android.vending">
+        <!-- Signature spoofing -->
+        <permission name="android.permission.FAKE_PACKAGE_SIGNATURE" fixed="false"/>
+        <!-- for the real Play Store, as this permission is buggy -->
+        <permission name="android.permission.RECIEVE_SMS" fixed="false"/> 
+    </exception>
+</exceptions>
diff --git a/system/etc/permissions/permissions-com.google.android.gms.xml b/system/etc/permissions/permissions-com.google.android.gms.xml
new file mode 100644
index 0000000..27951b9
--- /dev/null
+++ b/system/etc/permissions/permissions-com.google.android.gms.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2019 chris42 (based on work of ale5k and nanolx)
+     SPDX-License-Identifer: GPL-3.0-or-later
+     This file contains permissions to be granted by default.
+     Default permissions are granted to special platform components and to apps that are approved to get default grants.
+     The special components are apps that are expected to work out-of-the-box as they provide core use cases.
+     Fixed permissions cannot be controlled by the user and need a special approval.
+     Typically these are to ensure either legally mandated functions or the app is considered a part of the OS.
+     Granting these permissions could prevent issues on some ROMs or on non-clean installations.
+-->
+
+<exceptions>
+    <exception package="com.google.android.gms">
+        <!-- Phone -->
+        <permission name="android.permission.READ_PHONE_STATE" fixed="false"/>
+        <permission name="android.permission.RECEIVE_SMS" fixed="false" />
+        <!-- Account -->
+        <permission name="android.permission.READ_CONTACTS" fixed="false"/>
+        <permission name="android.permission.WRITE_CONTACTS" fixed="false"/>
+        <permission name="android.permission.GET_ACCOUNTS" fixed="false"/>
+        <!-- Location -->
+        <permission name="android.permission.ACCESS_FINE_LOCATION" fixed="false"/>
+        <permission name="android.permission.ACCESS_COARSE_LOCATION" fixed="false"/>
+        <permission name="org.microg.permission.FORCE_COARSE_LOCATION" fixed="false"/>
+        <!-- Storage -->
+        <permission name="android.permission.READ_EXTERNAL_STORAGE" fixed="false"/>
+        <permission name="android.permission.WRITE_EXTERNAL_STORAGE" fixed="false"/>
+        <!-- Signature Spoofing -->
+        <permission name="android.permission.FAKE_PACKAGE_SIGNATURE" fixed="false"/>
+    </exception>
+</exceptions>