Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Unset INSTALL_DISABLE_VERIFICATION flag if install is not from system

Browse Source 
Bug: 138650665
Test: pushed manual privapp that attempts an install
  with INSTALL_DISABLE_VERIFICATION flag.
  Checked that PackageVerifier was called.
Change-Id: I041d2e5f6d2609bfe9475f24eefb936f0c8e2a32
Merged-In: I041d2e5f6d2609bfe9475f24eefb936f0c8e2a32
This commit is contained in:
Nikita Ioffe
2019-07-30 17:10:27 +01:00
parent 8ba52400f5
commit bf8e2576f3
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
services/core/java/com/android/server/pm/PackageInstallerService.java
View File

@@ -505,6 +505,11 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements
params.installFlags &= ~PackageManager.INSTALL_REQUEST_DOWNGRADE; params.installFlags &= ~PackageManager.INSTALL_REQUEST_DOWNGRADE;
} }
if (callingUid != Process.SYSTEM_UID) {
// Only system_server can use INSTALL_DISABLE_VERIFICATION.
params.installFlags &= ~PackageManager.INSTALL_DISABLE_VERIFICATION;
}
boolean isApex = (params.installFlags & PackageManager.INSTALL_APEX) != 0; boolean isApex = (params.installFlags & PackageManager.INSTALL_APEX) != 0;
if (params.isStaged || isApex) { if (params.isStaged || isApex) {
mContext.enforceCallingOrSelfPermission(Manifest.permission.INSTALL_PACKAGES, TAG); mContext.enforceCallingOrSelfPermission(Manifest.permission.INSTALL_PACKAGES, TAG);