diff --git a/services/core/java/com/android/server/pm/PackageInstallerService.java b/services/core/java/com/android/server/pm/PackageInstallerService.java index e8bf82fb80b47..1641d61af4372 100644 --- a/services/core/java/com/android/server/pm/PackageInstallerService.java +++ b/services/core/java/com/android/server/pm/PackageInstallerService.java @@ -104,6 +104,7 @@ import com.android.server.SystemConfig; import com.android.server.SystemService; import com.android.server.SystemServiceManager; import com.android.server.pm.parsing.PackageParser2; +import com.android.server.pm.pkg.PackageStateInternal; import com.android.server.pm.utils.RequestThrottle; import libcore.io.IoUtils; @@ -1308,6 +1309,13 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements } } + private boolean isValidForInstallConstraints(PackageStateInternal ps, + String installerPackageName) { + return TextUtils.equals(ps.getInstallSource().mInstallerPackageName, installerPackageName) + || TextUtils.equals(ps.getInstallSource().mUpdateOwnerPackageName, + installerPackageName); + } + private CompletableFuture checkInstallConstraintsInternal( String installerPackageName, List packageNames, InstallConstraints constraints, long timeoutMillis) { @@ -1324,8 +1332,7 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements if (!PackageManagerServiceUtils.isSystemOrRootOrShell(callingUid)) { for (var packageName : packageNames) { var ps = snapshot.getPackageStateInternal(packageName); - if (ps == null || !TextUtils.equals( - ps.getInstallSource().mInstallerPackageName, installerPackageName)) { + if (ps == null || !isValidForInstallConstraints(ps, installerPackageName)) { throw new SecurityException("Caller has no access to package " + packageName); } }