Only grant visibility to result reciever

This change modifies which package is made visible to the receiving end
of a startForResult call. Prior to this change it was the callingUid,
which, in the case of startActivityForResult was typically the same as
the recipient of the result (or the return of getCallingPackage()). It
didn't account for forwarded results or startIntentSenderForResult.
Instead, we now look up the uid of the resultTo ActivityRecord and grant
the recipient of the intent access to it.

Bug: 149810887
Test: atest AppEnumerationTests
Change-Id: I331db9e75ca70635da589d3620d8723668d26b60

services/core/java/com/android/server/wm/ActivityStarter.java

@@ -1563,10 +1563,16 @@ class ActivityStarter {
 
         mService.mUgmInternal.grantUriPermissionFromIntent(mCallingUid, mStartActivity.packageName,
                 mIntent, mStartActivity.getUriPermissionsLocked(), mStartActivity.mUserId);
-        mService.getPackageManagerInternalLocked().grantImplicitAccess(
-                mStartActivity.mUserId, mIntent,
-                UserHandle.getAppId(mStartActivity.info.applicationInfo.uid), mCallingUid,
-                true /*direct*/);
+        if (mStartActivity.resultTo != null && mStartActivity.resultTo.info != null) {
+            // we need to resolve resultTo to a uid as grantImplicitAccess deals explicitly in UIDs
+            final PackageManagerInternal pmInternal =
+                    mService.getPackageManagerInternalLocked();
+            final int resultToUid = pmInternal.getPackageUidInternal(
+                            mStartActivity.resultTo.info.packageName, 0, mStartActivity.mUserId);
+            pmInternal.grantImplicitAccess(mStartActivity.mUserId, mIntent,
+                    UserHandle.getAppId(mStartActivity.info.applicationInfo.uid) /*recipient*/,
+                    resultToUid /*visible*/, true /*direct*/);
+        }
         if (newTask) {
             EventLogTags.writeWmCreateTask(mStartActivity.mUserId,
                     mStartActivity.getTask().mTaskId);