From 71ddb0099b3f06d6ac3c865a103a02a595a52fa8 Mon Sep 17 00:00:00 2001 From: Nikita Ioffe Date: Mon, 14 Jun 2021 17:02:41 +0100 Subject: [PATCH] Allow holders of INSTALL_PACKAGE_UPDATES permission to update APEXes Test: atest CtsStagedInstallHostTestCases Bug: 190802380 Change-Id: I061a8d1dcec147b1479eb1ce62e2f60093880d7e --- .../com/android/server/pm/PackageInstallerService.java | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/services/core/java/com/android/server/pm/PackageInstallerService.java b/services/core/java/com/android/server/pm/PackageInstallerService.java index 0b63b7ddef851..871dd3dbf7f6f 100644 --- a/services/core/java/com/android/server/pm/PackageInstallerService.java +++ b/services/core/java/com/android/server/pm/PackageInstallerService.java @@ -626,7 +626,14 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements } boolean isApex = (params.installFlags & PackageManager.INSTALL_APEX) != 0; - if (params.isStaged || isApex) { + if (isApex) { + if (mContext.checkCallingOrSelfPermission(Manifest.permission.INSTALL_PACKAGE_UPDATES) + == PackageManager.PERMISSION_DENIED + && mContext.checkCallingOrSelfPermission(Manifest.permission.INSTALL_PACKAGES) + == PackageManager.PERMISSION_DENIED) { + throw new SecurityException("Not allowed to perform APEX updates"); + } + } else if (params.isStaged) { mContext.enforceCallingOrSelfPermission(Manifest.permission.INSTALL_PACKAGES, TAG); }