From 41a0efb3ca31ee9c2c6a763e26765f7ecbdff126 Mon Sep 17 00:00:00 2001
From: Todd Kennedy <toddke@google.com>
Date: Tue, 28 Feb 2017 16:34:15 -0800
Subject: [PATCH] Expose isInstantApp() to more callers

Instead of just allowing the instant app itself, also allow anyone
with ACCESS_INSTANT_APP permission or apps that the instant app
has granted access.

Change-Id: I5a79ef9520db908ba9ab56af0157b1646d2d8cc1
Fixes: 34123112
Test: cts-tradefed run commandAndExit cts-dev -m CtsAppSecurityHostTestCases -t android.appsecurity.cts.EphemeralTest
---
 .../android/server/pm/PackageManagerService.java    | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 116c0a353643c..73ba299177748 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -7310,12 +7310,17 @@ public class PackageManagerService extends IPackageManager.Stub {
             return false;
         }
 
-        if (!isCallerSameApp(packageName)) {
-            return false;
-        }
         synchronized (mPackages) {
             final PackageSetting ps = mSettings.mPackages.get(packageName);
-            if (ps != null) {
+            final boolean returnAllowed =
+                    ps != null
+                    && (isCallerSameApp(packageName)
+                            || mContext.checkCallingOrSelfPermission(
+                                    android.Manifest.permission.ACCESS_INSTANT_APPS)
+                                            == PERMISSION_GRANTED
+                            || mInstantAppRegistry.isInstantAccessGranted(
+                                    userId, UserHandle.getAppId(Binder.getCallingUid()), ps.appId));
+            if (returnAllowed) {
                 return ps.getInstantApp(userId);
             }
         }