From 940c1aa56aea4a05739a44abc62cac11025fa330 Mon Sep 17 00:00:00 2001
From: Nick Kovacs <nrkovacs@google.com>
Date: Wed, 18 Jan 2023 01:15:00 +0000
Subject: [PATCH] Add strict mode feature flag for low target sdk

Use the new MinInstallableTargetSdk__install_block_strict_mode_enabled
feature flag to no longer give exemptions to install blocks when
strict mode is enabled for:

1) All installs from adb
2) Any install where the installer package name is null
   (not installed from a store)

Bug: 237321649
Test: adb shell device_config put package_manager_service MinInstallableTargetSdk__install_block_strict_mode_enabled true
Test: adb shell device_config put package_manager_service MinInstallableTargetSdk__strict_mode_target_sdk 23
Test: adb install ~/install_target_sdk_22.apk (install blocked)
Test: adb install --bypass-low-target-sdk-block ~/install_target_sdk_22.apk  (install successful)
Test: adb shell device_config put package_manager_service MinInstallableTargetSdk__install_block_strict_mode_enabled false
Test: adb install ~/install_target_sdk_22.apk (install successful)
Change-Id: Ie6d44b5f16bf7dd35d3c75f51a9c94fd4ef9dcb6
---
 .../android/server/pm/InstallPackageHelper.java | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/services/core/java/com/android/server/pm/InstallPackageHelper.java b/services/core/java/com/android/server/pm/InstallPackageHelper.java
index db3aae555854c..a4c9baa2f2c14 100644
--- a/services/core/java/com/android/server/pm/InstallPackageHelper.java
+++ b/services/core/java/com/android/server/pm/InstallPackageHelper.java
@@ -1083,19 +1083,32 @@ final class InstallPackageHelper {
                             "MinInstallableTargetSdk__min_installable_target_sdk",
                             0);
 
+            // Determine if enforcement is in strict mode
+            boolean strictMode = false;
+            if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_PACKAGE_MANAGER_SERVICE,
+                    "MinInstallableTargetSdk__install_block_strict_mode_enabled",
+                    false)) {
+                if (parsedPackage.getTargetSdkVersion()
+                        < DeviceConfig.getInt(DeviceConfig.NAMESPACE_PACKAGE_MANAGER_SERVICE,
+                        "MinInstallableTargetSdk__strict_mode_target_sdk",
+                        0)) {
+                    strictMode = true;
+                }
+            }
+
             // Skip enforcement when the bypass flag is set
             boolean bypassLowTargetSdkBlock =
                     ((installFlags & PackageManager.INSTALL_BYPASS_LOW_TARGET_SDK_BLOCK) != 0);
 
             // Skip enforcement for tests that were installed from adb
-            if (!bypassLowTargetSdkBlock
+            if (!strictMode && !bypassLowTargetSdkBlock
                     && ((installFlags & PackageManager.INSTALL_FROM_ADB) != 0)) {
                 bypassLowTargetSdkBlock = true;
             }
 
             // Skip enforcement if the installer package name is not set
             // (e.g. "pm install" from shell)
-            if (!bypassLowTargetSdkBlock) {
+            if (!strictMode && !bypassLowTargetSdkBlock) {
                 if (request.getInstallerPackageName() == null) {
                     bypassLowTargetSdkBlock = true;
                 } else {