Fix side channel leakage from the api of setInstallerPackageName

Enforce the package visibility filter on the argument of the
installer package name to fix the package information leakage
from the different exceptions thrown by the api.

Bug: 184851975
Test: atest AppEnumerationTests
Change-Id: I9fd36480fd0faaa954dc417992995dbbf5e68a2a
This commit is contained in:
Rhed Jao
2021-06-05 12:27:41 +08:00
parent d52baf860c
commit 5f6432b96a

View File

@@ -16915,6 +16915,7 @@ public class PackageManagerService extends IPackageManager.Stub
@Override
public void setInstallerPackageName(String targetPackage, String installerPackageName) {
final int callingUid = Binder.getCallingUid();
final int callingUserId = UserHandle.getUserId(callingUid);
if (getInstantAppPackageName(callingUid) != null) {
return;
}
@@ -16923,14 +16924,16 @@ public class PackageManagerService extends IPackageManager.Stub
PackageSetting targetPackageSetting = mSettings.getPackageLPr(targetPackage);
if (targetPackageSetting == null
|| shouldFilterApplicationLocked(
targetPackageSetting, callingUid, UserHandle.getUserId(callingUid))) {
targetPackageSetting, callingUid, callingUserId)) {
throw new IllegalArgumentException("Unknown target package: " + targetPackage);
}
PackageSetting installerPackageSetting;
if (installerPackageName != null) {
installerPackageSetting = mSettings.getPackageLPr(installerPackageName);
if (installerPackageSetting == null) {
if (installerPackageSetting == null
|| shouldFilterApplicationLocked(
installerPackageSetting, callingUid, callingUserId)) {
throw new IllegalArgumentException("Unknown installer package: "
+ installerPackageName);
}