Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Don't allow shell to spoof initiating package name." into rvc-dev

Browse Source
This commit is contained in:
Alan Stokes
2020-07-01 18:11:54 +00:00
committed by Android (Google) Code Review
parent bb6c1e09ad e12cfda75f
commit 717f3d8401
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
services/core/java/com/android/server/pm/PackageInstallerService.java
View File

@@ -522,7 +522,9 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements
if ((callingUid == Process.SHELL_UID) || (callingUid == Process.ROOT_UID)) { if ((callingUid == Process.SHELL_UID) || (callingUid == Process.ROOT_UID)) {
params.installFlags |= PackageManager.INSTALL_FROM_ADB; params.installFlags |= PackageManager.INSTALL_FROM_ADB;
// adb installs can override the installingPackageName, but not the
// initiatingPackageName
installerPackageName = null;
} else { } else {
if (callingUid != Process.SYSTEM_UID) { if (callingUid != Process.SYSTEM_UID) {
// The supplied installerPackageName must always belong to the calling app. // The supplied installerPackageName must always belong to the calling app.