Adds caller check to getAllPackages()
This change enforces that only system, root or shell may call
getAllPackages(), a hidden API that shares all package names regardless
of user, instant app or package visibility rules.
Bug: 174661955
Test: 'adb shell pm compile -a -m speed' doesn't fail with
SecurityException
Change-Id: I86a03c46896f21cdbeeda2af150675fe77d61955
This commit is contained in:
@@ -8946,6 +8946,7 @@ public class PackageManagerService extends IPackageManager.Stub
|
||||
|
||||
@Override
|
||||
public List<String> getAllPackages() {
|
||||
enforceSystemOrRootOrShell("getAllPackages is limited to privileged callers");
|
||||
final int callingUid = Binder.getCallingUid();
|
||||
final int callingUserId = UserHandle.getUserId(callingUid);
|
||||
synchronized (mLock) {
|
||||
|
||||
Reference in New Issue
Block a user