Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable low target sdk install block by default

Browse Source 
Update the feature flags to enable the install
block by default. This will ensure that non-GMS
devices without feature flagging have this
enforcement as well.

Bug: 237321649
Test: atest PackageManagerTests
Change-Id: I4f6815906455175cfedf126df4ac694ba6f4684c
This commit is contained in:
Nick Kovacs
2023-03-03 20:37:46 +00:00
parent 3eb0a87531
commit ace5fd1120
2 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
services/core/java/com/android/server/pm/InstallPackageHelper.java
View File

@@ -1134,22 +1134,22 @@ final class InstallPackageHelper {
// behavior.
if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_PACKAGE_MANAGER_SERVICE,
"MinInstallableTargetSdk__install_block_enabled",
false)) {
true)) {
int minInstallableTargetSdk =
DeviceConfig.getInt(DeviceConfig.NAMESPACE_PACKAGE_MANAGER_SERVICE,
"MinInstallableTargetSdk__min_installable_target_sdk",
0);
PackageManagerService.MIN_INSTALLABLE_TARGET_SDK);
// Determine if enforcement is in strict mode
boolean strictMode = false;
if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_PACKAGE_MANAGER_SERVICE,
"MinInstallableTargetSdk__install_block_strict_mode_enabled",
false)) {
true)) {
if (parsedPackage.getTargetSdkVersion()
< DeviceConfig.getInt(DeviceConfig.NAMESPACE_PACKAGE_MANAGER_SERVICE,
"MinInstallableTargetSdk__strict_mode_target_sdk",
0)) {
PackageManagerService.MIN_INSTALLABLE_TARGET_SDK)) {
strictMode = true;
}
}

8
services/core/java/com/android/server/pm/PackageManagerService.java
View File

@@ -557,6 +557,14 @@ public class PackageManagerService implements PackageSender, TestUtilityService
// How many required verifiers can be on the system.
private static final int REQUIRED_VERIFIERS_MAX_COUNT = 2;
/**
* Specifies the minimum target SDK version an apk must specify in order to be installed
* on the system. This improves security and privacy by blocking low
* target sdk apps as malware can target older sdk versions to avoid
* the enforcement of new API behavior.
*/
public static final int MIN_INSTALLABLE_TARGET_SDK = Build.VERSION_CODES.M;
// Compilation reasons.
// TODO(b/260124949): Clean this up with the legacy dexopt code.
public static final int REASON_FIRST_BOOT = 0;