Merge "Don't allow shell to spoof initiating package name." into rvc-dev am: 717f3d8401 am: e471179dab

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/12047567 Change-Id: I873773aba44fece4a1bfbd0186e887b80e1a9b35
2020-07-01 18:40:51 +00:00
parent e15666d78c e471179dab
commit 7681bc53ea
1 changed files with 3 additions and 1 deletions
--- a/services/core/java/com/android/server/pm/PackageInstallerService.java
+++ b/services/core/java/com/android/server/pm/PackageInstallerService.java
@@ -522,7 +522,9 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements

        if ((callingUid == Process.SHELL_UID) || (callingUid == Process.ROOT_UID)) {
            params.installFlags |= PackageManager.INSTALL_FROM_ADB;
-
+            // adb installs can override the installingPackageName, but not the
+            // initiatingPackageName
+            installerPackageName = null;
        } else {
            if (callingUid != Process.SYSTEM_UID) {
                // The supplied installerPackageName must always belong to the calling app.