From 83e162615f022f897d451db914becd6825a69b88 Mon Sep 17 00:00:00 2001
From: Hongming Jin <hongmingjin@google.com>
Date: Fri, 18 May 2018 10:47:57 -0700
Subject: [PATCH] Enforce permission check before returning application info
 Test: atest CtsAppSecurityHostTestCases:ApplicationVisibilityTest Bug:
 77821568

Change-Id: I7554805c36c0c2552163dad7b07cfc5f552b624e
---
 api/test-current.txt                                       | 1 +
 core/java/android/content/pm/PackageManager.java           | 1 +
 .../java/com/android/server/pm/PackageManagerService.java  | 7 +++++++
 3 files changed, 9 insertions(+)

diff --git a/api/test-current.txt b/api/test-current.txt
index adb06c79eaf5c..e34614e966c45 100644
--- a/api/test-current.txt
+++ b/api/test-current.txt
@@ -249,6 +249,7 @@ package android.content.pm {
     method public abstract java.lang.String getDefaultBrowserPackageNameAsUser(int);
     method public abstract int getInstallReason(java.lang.String, android.os.UserHandle);
     method public abstract java.util.List<android.content.pm.PackageInfo> getInstalledPackagesAsUser(int, int);
+    method public abstract java.util.List<android.content.pm.ApplicationInfo> getInstalledApplicationsAsUser(int, int);
     method public abstract java.lang.String[] getNamesForUids(int[]);
     method public abstract java.lang.String getPermissionControllerPackageName();
     method public abstract java.lang.String getServicesSystemSharedLibraryPackageName();
diff --git a/core/java/android/content/pm/PackageManager.java b/core/java/android/content/pm/PackageManager.java
index 3f9798b7d6c98..b677b5e2c9478 100644
--- a/core/java/android/content/pm/PackageManager.java
+++ b/core/java/android/content/pm/PackageManager.java
@@ -3798,6 +3798,7 @@ public abstract class PackageManager {
      *         deleted with {@code DONT_DELETE_DATA} flag set).
      * @hide
      */
+    @TestApi
     public abstract List<ApplicationInfo> getInstalledApplicationsAsUser(
             @ApplicationInfoFlags int flags, @UserIdInt int userId);
 
diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 7b7bc41e4bbbf..605644eb4d391 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -7997,6 +7997,13 @@ public class PackageManagerService extends IPackageManager.Stub
         flags = updateFlagsForApplication(flags, userId, null);
         final boolean listUninstalled = (flags & MATCH_KNOWN_PACKAGES) != 0;
 
+        mPermissionManager.enforceCrossUserPermission(
+            callingUid,
+            userId,
+            false /* requireFullPermission */,
+            false /* checkShell */,
+            "get installed application info");
+
         // writer
         synchronized (mPackages) {
             ArrayList<ApplicationInfo> list;