From 6e441b98a27a2a09a95e29db9c9990ccd22ddd37 Mon Sep 17 00:00:00 2001 From: Rhed Jao Date: Mon, 25 Oct 2021 10:59:27 +0800 Subject: [PATCH] Fix package usage of instant app can be updated by unprivileged app IPackageManager#notifyPackageUse used #isInstantApp api to determine whether the target package is instant app or not. But #isInstantApp return true only if called by itself or by somebody who can view instant apps or by somebody has has been granted with access. It results in the api fails to check instant app then allowing an unprivileged app to update the package usage of an instant app. This CL uses #isInstantAppInternal with the system uid to pass the checks and fix the issue. Bug: 201534884 Test: Manual, follow the steps in the bug Change-Id: I4ad68be5145a165e8d8c93b6d26ccf0e8bc084c3 --- .../core/java/com/android/server/pm/PackageManagerService.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index 3eaa26e77bfc7..f817b3d3a4baf 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -4875,7 +4875,7 @@ public class PackageManagerService extends IPackageManager.Stub return; } } else { - if (isInstantApp(packageName, callingUserId)) { + if (isInstantAppInternal(packageName, callingUserId, Process.SYSTEM_UID)) { return; } }