From 222a6b43a54599f31049682c1e3320a28eadc344 Mon Sep 17 00:00:00 2001
From: Songchun Fan <schfan@google.com>
Date: Tue, 29 Jun 2021 14:28:39 -0700
Subject: [PATCH] [pm] restrict PackageInstaller getMySessions() results based
 on calling UIDs

BUG: 188765544
Test: atest android.content.pm.cts.InstallSessionTransferTest
Change-Id: I51d65c315db91d4d79c38bed487180ea81661ccf
Merged-In: I51d65c315db91d4d79c38bed487180ea81661ccf
---
 .../java/com/android/server/pm/PackageInstallerService.java    | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/services/core/java/com/android/server/pm/PackageInstallerService.java b/services/core/java/com/android/server/pm/PackageInstallerService.java
index d2ed08f669446..d7b244980cfce 100644
--- a/services/core/java/com/android/server/pm/PackageInstallerService.java
+++ b/services/core/java/com/android/server/pm/PackageInstallerService.java
@@ -989,7 +989,8 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements
                 SessionInfo info =
                         session.generateInfoForCaller(false /*withIcon*/, Process.SYSTEM_UID);
                 if (Objects.equals(info.getInstallerPackageName(), installerPackageName)
-                        && session.userId == userId && !session.hasParentSessionId()) {
+                        && session.userId == userId && !session.hasParentSessionId()
+                        && isCallingUidOwner(session)) {
                     result.add(info);
                 }
             }