From 21b131029746f2118036acc6f33ca8548218e671 Mon Sep 17 00:00:00 2001
From: Suprabh Shukla <suprabh@google.com>
Date: Wed, 10 Oct 2018 14:30:08 -0700
Subject: [PATCH] Trust session id only if started with ACTION_CONFIRM_INSTALL

InstallStart was reading sessionInfo whenever the starting intent had
the extra EXTRA_SESSION_ID. This could happen even if an external app
inserted a valid session id into its own REQUEST_INSTALL_PACKAGE intent.
This allows apps to potentially spoof the calling package.

Test: Existing tests pass:
atest GtsPackageInstallTestCases GtsNoPermissionTestCases \
GtsNoPermissionTestCases25

Bug: 112031362
Change-Id: Icdab1deeaf6b0afe7a61709cd87305336c467e33
---
 .../src/com/android/packageinstaller/InstallStart.java   | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java b/packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java
index 8fed367f37737..f2de9ecd8f5d6 100644
--- a/packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java
+++ b/packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java
@@ -54,9 +54,14 @@ public class InstallStart extends Activity {
         Intent intent = getIntent();
         String callingPackage = getCallingPackage();
 
+        final boolean isSessionInstall =
+                PackageInstaller.ACTION_CONFIRM_INSTALL.equals(intent.getAction());
+
         // If the activity was started via a PackageInstaller session, we retrieve the calling
         // package from that session
-        int sessionId = intent.getIntExtra(PackageInstaller.EXTRA_SESSION_ID, -1);
+        final int sessionId = (isSessionInstall
+                ? intent.getIntExtra(PackageInstaller.EXTRA_SESSION_ID, -1)
+                : -1);
         if (callingPackage == null && sessionId != -1) {
             PackageInstaller packageInstaller = getPackageManager().getPackageInstaller();
             PackageInstaller.SessionInfo sessionInfo = packageInstaller.getSessionInfo(sessionId);
@@ -99,7 +104,7 @@ public class InstallStart extends Activity {
         nextActivity.putExtra(PackageInstallerActivity.EXTRA_ORIGINAL_SOURCE_INFO, sourceInfo);
         nextActivity.putExtra(Intent.EXTRA_ORIGINATING_UID, originatingUid);
 
-        if (PackageInstaller.ACTION_CONFIRM_INSTALL.equals(intent.getAction())) {
+        if (isSessionInstall) {
             nextActivity.setClass(this, PackageInstallerActivity.class);
         } else {
             Uri packageUri = intent.getData();