Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Check that only allowed installers can perform a non-staged APEX update" into sc-dev am: 42b407a0fb

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/14843821

Change-Id: Ibe5168444aaf54a04b1d6cf0a1686b3305ed3344
This commit is contained in:
Nikita Ioffe
2021-06-08 09:49:32 +00:00
committed by Automerger Merge Worker
parent 31825c4f59 42b407a0fb
commit 2e5d70018e
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
services/core/java/com/android/server/pm/PackageInstallerService.java
View File

@@ -653,13 +653,20 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements
}
if (params.isStaged && !isCalledBySystemOrShell(callingUid)) {
if (mBypassNextStagedInstallerCheck) {
mBypassNextStagedInstallerCheck = false;
} else if (!isStagedInstallerAllowed(requestedInstallerPackageName)) {
if (!mBypassNextStagedInstallerCheck
&& !isStagedInstallerAllowed(requestedInstallerPackageName)) {
throw new SecurityException("Installer not allowed to commit staged install");
}
}
if (isApex && !isCalledBySystemOrShell(callingUid)) {
if (!mBypassNextStagedInstallerCheck
&& !isStagedInstallerAllowed(requestedInstallerPackageName)) {
throw new SecurityException(
"Installer not allowed to commit non-staged APEX install");
}
}
mBypassNextStagedInstallerCheck = false;
if (!params.isMultiPackage) {
// Only system components can circumvent runtime permissions when installing.
if ((params.installFlags & PackageManager.INSTALL_GRANT_RUNTIME_PERMISSIONS) != 0