From f8c0b315240c5949fbbe755af1c2a2e4006e7210 Mon Sep 17 00:00:00 2001
From: Yan Zhu <yanzhuyan@google.com>
Date: Wed, 11 Dec 2019 09:14:44 -0800
Subject: [PATCH] DO NOT MERGE - Enable blacklist for headless system user

- Get all packages for system user
- Reuse split system user's logic to blacklist packages when headless system
user is enabled
- Add new method in UserManager to get headless sytem user mode (same as
in master)

Bug: 145626101
Test: edit device's sysconfig file, use tag: system-user-blacklisted-app to blacklist app
make services && adb sync system && adb reboot
cts test

Change-Id: I98d1bc33e7dd59ffa3ac6426f95af708671138da
(cherry picked from commit 9c4cf4945d57d45e429bc7d33bf6ffa68eb0838c)
---
 core/java/android/os/UserManager.java         | 10 ++++
 .../server/pm/PackageManagerService.java      | 47 +++++++++++--------
 2 files changed, 38 insertions(+), 19 deletions(-)

diff --git a/core/java/android/os/UserManager.java b/core/java/android/os/UserManager.java
index 45842926ff1dc..da41478e91a66 100644
--- a/core/java/android/os/UserManager.java
+++ b/core/java/android/os/UserManager.java
@@ -1274,6 +1274,16 @@ public class UserManager {
         return RoSystemProperties.FW_SYSTEM_USER_SPLIT;
     }
 
+    /**
+     * @hide
+     * @return Whether the device is running in a headless system user mode. It means the headless
+     * user (system user) runs system services and system UI, but is not associated with any real
+     * person. Secondary users can be created to be associated with real person.
+     */
+    public static boolean isHeadlessSystemUserMode() {
+        return RoSystemProperties.MULTIUSER_HEADLESS_SYSTEM_USER;
+    }
+
     /**
      * @return Whether guest user is always ephemeral
      * @hide
diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index ca66776239dbc..fc43dc3a2016e 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -2321,32 +2321,41 @@ public class PackageManagerService extends IPackageManager.Stub
     }
 
     private void enableSystemUserPackages() {
-        if (!UserManager.isSplitSystemUser()) {
+        boolean isHeadlessSystemUserMode = UserManager.isHeadlessSystemUserMode();
+        if (!isHeadlessSystemUserMode && !UserManager.isSplitSystemUser()) {
             return;
         }
-        // For system user, enable apps based on the following conditions:
-        // - app is whitelisted or belong to one of these groups:
-        //   -- system app which has no launcher icons
-        //   -- system app which has INTERACT_ACROSS_USERS permission
-        //   -- system IME app
-        // - app is not in the blacklist
-        AppsQueryHelper queryHelper = new AppsQueryHelper(this);
+
         Set<String> enableApps = new ArraySet<>();
-        enableApps.addAll(queryHelper.queryApps(AppsQueryHelper.GET_NON_LAUNCHABLE_APPS
-                | AppsQueryHelper.GET_APPS_WITH_INTERACT_ACROSS_USERS_PERM
-                | AppsQueryHelper.GET_IMES, /* systemAppsOnly */ true, UserHandle.SYSTEM));
-        ArraySet<String> wlApps = SystemConfig.getInstance().getSystemUserWhitelistedApps();
-        enableApps.addAll(wlApps);
-        enableApps.addAll(queryHelper.queryApps(AppsQueryHelper.GET_REQUIRED_FOR_SYSTEM_USER,
-                /* systemAppsOnly */ false, UserHandle.SYSTEM));
-        ArraySet<String> blApps = SystemConfig.getInstance().getSystemUserBlacklistedApps();
-        enableApps.removeAll(blApps);
-        Log.i(TAG, "Applications installed for system user: " + enableApps);
+        AppsQueryHelper queryHelper = new AppsQueryHelper(this);
         List<String> allAps = queryHelper.queryApps(0, /* systemAppsOnly */ false,
                 UserHandle.SYSTEM);
+
+        if (isHeadlessSystemUserMode) {
+            enableApps.addAll(allAps);
+        } else {
+            // For split system user, select apps based on the following conditions:
+            //   -- system app which has no launcher icons
+            //   -- system app which has INTERACT_ACROSS_USERS permission
+            //   -- system IME app
+            enableApps.addAll(queryHelper.queryApps(AppsQueryHelper.GET_NON_LAUNCHABLE_APPS
+                    | AppsQueryHelper.GET_APPS_WITH_INTERACT_ACROSS_USERS_PERM
+                    | AppsQueryHelper.GET_IMES, /* systemAppsOnly */ true, UserHandle.SYSTEM));
+            enableApps.addAll(queryHelper.queryApps(AppsQueryHelper.GET_REQUIRED_FOR_SYSTEM_USER,
+                    /* systemAppsOnly */ false, UserHandle.SYSTEM));
+
+            // Apply whitelist for split system user
+            ArraySet<String> wlApps = SystemConfig.getInstance().getSystemUserWhitelistedApps();
+            enableApps.addAll(wlApps);
+        }
+        // Apply blacklist for split system user/headless system user
+        ArraySet<String> blApps = SystemConfig.getInstance().getSystemUserBlacklistedApps();
+        enableApps.removeAll(blApps);
+        Log.i(TAG, "Blacklisted packages: " + blApps);
+
         final int allAppsSize = allAps.size();
         synchronized (mPackages) {
-            for (int i = 0; i < allAppsSize; i++) {
+            for  (int i = 0; i < allAppsSize; i++) {
                 String pName = allAps.get(i);
                 PackageSetting pkgSetting = mSettings.mPackages.get(pName);
                 // Should not happen, but we shouldn't be failing if it does