Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

DO NOT MERGE: Verify INSTALL_PACKAGES permissions when adding installer package am: fc8bfed553

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/11384837

Change-Id: I42a87fe06a2634d5fd40119ef46d71a99e147f50
This commit is contained in:
Winson
2020-06-03 18:49:15 +00:00
committed by Automerger Merge Worker
parent 804d42f1ef fc8bfed553
commit 0ce3ba0c26
1 changed files with 19 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
services/core/java/com/android/server/pm/PackageManagerService.java
View File

@@ -15382,20 +15382,26 @@ public class PackageManagerService extends IPackageManager.Stub
// Verify: if target already has an installer package, it must // Verify: if target already has an installer package, it must
// be signed with the same cert as the caller. // be signed with the same cert as the caller.
if (targetPackageSetting.installerPackageName != null) { String targetInstallerPackageName =
PackageSetting setting = mSettings.mPackages.get( targetPackageSetting.installerPackageName;
targetPackageSetting.installerPackageName); PackageSetting targetInstallerPkgSetting = targetInstallerPackageName == null ? null :
// If the currently set package isn't valid, then it's always mSettings.mPackages.get(targetInstallerPackageName);
// okay to change it.
if (setting != null) { if (targetInstallerPkgSetting != null) {
if (compareSignatures(callerSignature, if (compareSignatures(callerSignature,
setting.signatures.mSignatures) targetInstallerPkgSetting.signatures.mSignatures)
!= PackageManager.SIGNATURE_MATCH) { != PackageManager.SIGNATURE_MATCH) {
throw new SecurityException( throw new SecurityException(
"Caller does not have same cert as old installer package " "Caller does not have same cert as old installer package "
+ targetPackageSetting.installerPackageName); + targetInstallerPackageName);
}
} }
} else if (mContext.checkCallingOrSelfPermission(Manifest.permission.INSTALL_PACKAGES)
!= PackageManager.PERMISSION_GRANTED) {
// This is probably an attempt to exploit vulnerability b/150857253 of taking
// privileged installer permissions when the installer has been uninstalled or
// was never set.
EventLog.writeEvent(0x534e4554, "150857253", callingUid, "");
return;
} }
// Okay! // Okay!