From 4fbbd8b0a0a2c8267cf3231dd445654ecf172537 Mon Sep 17 00:00:00 2001
From: Nikhil Kumar <nykkumar@google.com>
Date: Fri, 14 Apr 2023 12:23:19 +0100
Subject: [PATCH] Use current user to verify the app getting installed on all
 users

Bug: 264896950
Test: tested manually by installing a malicious app on all users
'adb install <block_app>.apk'

Change-Id: Ie802bfbcbb9c2ac4693744d3315acff56f1cff2a
---
 .../core/java/com/android/server/pm/VerifyingSession.java    | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/services/core/java/com/android/server/pm/VerifyingSession.java b/services/core/java/com/android/server/pm/VerifyingSession.java
index 5015985dd747d..7198de2f743ef 100644
--- a/services/core/java/com/android/server/pm/VerifyingSession.java
+++ b/services/core/java/com/android/server/pm/VerifyingSession.java
@@ -353,11 +353,10 @@ final class VerifyingSession {
             PackageInfoLite pkgLite,
             PackageVerificationState verificationState) {
 
-        // TODO: http://b/22976637
-        // Apps installed for "all" users use the device owner to verify the app
+        // Apps installed for "all" users use the current user to verify the app
         UserHandle verifierUser = getUser();
         if (verifierUser == UserHandle.ALL) {
-            verifierUser = UserHandle.SYSTEM;
+            verifierUser = UserHandle.of(mPm.mUserManager.getCurrentUserId());
         }
         final int verifierUserId = verifierUser.getIdentifier();