From 1dafc3859ae45671d666aa591bdb74a1e45518b3 Mon Sep 17 00:00:00 2001 From: Jackal Guo Date: Thu, 28 Jan 2021 16:57:35 +0800 Subject: [PATCH] Enfore cross user permission to getPackagesForUid Apps could use getPackagesForUid with given UID to query if there is a installed and get its package name across user. Expect for package visibility filtering, we also need to ensure across-user calls come with appropriate permission. Bug: 167654926 Test: atest ApplicationVisibilityTest Change-Id: I1172177298cd084430c612f50e4b921b92d4a1c3 --- .../core/java/com/android/server/pm/PackageManagerService.java | 2 ++ 1 file changed, 2 insertions(+) diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index 68b06989b24e8..d69f3d403ef8d 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -3845,6 +3845,8 @@ public class PackageManagerService extends IPackageManager.Stub final boolean isCallerInstantApp = getInstantAppPackageName(callingUid) != null; final int userId = UserHandle.getUserId(uid); final int appId = UserHandle.getAppId(uid); + enforceCrossUserPermission(callingUid, userId, + /* requireFullPermission */ false, /* checkShell */ false, "getPackagesForUid"); return getPackagesForUidInternalBody(callingUid, userId, appId, isCallerInstantApp); }