From b5afc874838857bac783555bd665ac3bdd7966f9 Mon Sep 17 00:00:00 2001
From: Todd Kennedy <toddke@google.com>
Date: Fri, 20 Sep 2019 13:45:15 -0700
Subject: [PATCH] Only allow INSTALL_ALLOW_TEST from shell or root

Bug: 141169173
Test: Manual. App can't be installed as test-only
Change-Id: Ib6dcca7901aa549d620448c0165c22270a3042be
---
 .../core/java/com/android/server/pm/PackageInstallerService.java | 1 +
 1 file changed, 1 insertion(+)

diff --git a/services/core/java/com/android/server/pm/PackageInstallerService.java b/services/core/java/com/android/server/pm/PackageInstallerService.java
index e75f545eafaa5..0329e2c5ed45b 100644
--- a/services/core/java/com/android/server/pm/PackageInstallerService.java
+++ b/services/core/java/com/android/server/pm/PackageInstallerService.java
@@ -491,6 +491,7 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements
 
             params.installFlags &= ~PackageManager.INSTALL_FROM_ADB;
             params.installFlags &= ~PackageManager.INSTALL_ALL_USERS;
+            params.installFlags &= ~PackageManager.INSTALL_ALLOW_TEST;
             params.installFlags |= PackageManager.INSTALL_REPLACE_EXISTING;
             if ((params.installFlags & PackageManager.INSTALL_VIRTUAL_PRELOAD) != 0
                     && !mPm.isCallerVerifier(callingUid)) {