Merge "Don't allow shell to spoof initiating package name." into rvc-dev

2020-07-01 18:11:54 +00:00
parent bb6c1e09ad e12cfda75f
commit 717f3d8401
1 changed files with 3 additions and 1 deletions
--- a/services/core/java/com/android/server/pm/PackageInstallerService.java
+++ b/services/core/java/com/android/server/pm/PackageInstallerService.java
@@ -522,7 +522,9 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements

        if ((callingUid == Process.SHELL_UID) || (callingUid == Process.ROOT_UID)) {
            params.installFlags |= PackageManager.INSTALL_FROM_ADB;
-
+            // adb installs can override the installingPackageName, but not the
+            // initiatingPackageName
+            installerPackageName = null;
        } else {
            if (callingUid != Process.SYSTEM_UID) {
                // The supplied installerPackageName must always belong to the calling app.