From 63cfbfcc09d0b13783919bb4f1355a55bb6aeeaf Mon Sep 17 00:00:00 2001 From: Rhed Jao Date: Thu, 1 Jul 2021 18:01:50 +0800 Subject: [PATCH] Enforce package visibility to the api shouldHideFromSuggestions App can query which applications are installed on the device via api LauncherApps#shouldHideFromSuggestions. This cl enforces package visibility filter to the api fix the security issue. Bug: 191147534 Test: atest AppEnumerationTests Change-Id: I40589f42b14c8a3e9372647d89a35203acaacd14 --- .../com/android/server/pm/LauncherAppsService.java | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/services/core/java/com/android/server/pm/LauncherAppsService.java b/services/core/java/com/android/server/pm/LauncherAppsService.java index 5b2c80903ce5e..d88e7394e853e 100644 --- a/services/core/java/com/android/server/pm/LauncherAppsService.java +++ b/services/core/java/com/android/server/pm/LauncherAppsService.java @@ -407,11 +407,16 @@ public class LauncherAppsService extends SystemService { @Override public boolean shouldHideFromSuggestions(String packageName, UserHandle user) { - if (!canAccessProfile(user.getIdentifier(), "cannot get shouldHideFromSuggestions")) { + final int userId = user.getIdentifier(); + if (!canAccessProfile(userId, "cannot get shouldHideFromSuggestions")) { return false; } - final int flags = mPackageManagerInternal.getDistractingPackageRestrictions(packageName, - user.getIdentifier()); + if (mPackageManagerInternal.filterAppAccess( + packageName, Binder.getCallingUid(), userId)) { + return false; + } + final int flags = mPackageManagerInternal.getDistractingPackageRestrictions( + packageName, userId); return (flags & PackageManager.RESTRICTION_HIDE_FROM_SUGGESTIONS) != 0; }