From 7e2b8e66cf13623132fc7874b90cba54275179cb Mon Sep 17 00:00:00 2001
From: Todd Kennedy <toddke@google.com>
Date: Mon, 25 Nov 2019 15:36:12 -0800
Subject: [PATCH] Require INSTALL_PACKAGES if FRP is enabled

Bug: 141262900
Test: atest android.packageinstaller.install.cts.SessionTest
Change-Id: I1cf5b5355e2bc5287430e7b7ad49dd2a854c71ee
---
 .../com/android/server/pm/PackageInstallerSession.java    | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/services/core/java/com/android/server/pm/PackageInstallerSession.java b/services/core/java/com/android/server/pm/PackageInstallerSession.java
index a09657be83d4e..d63e7041ea528 100644
--- a/services/core/java/com/android/server/pm/PackageInstallerSession.java
+++ b/services/core/java/com/android/server/pm/PackageInstallerSession.java
@@ -959,9 +959,13 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub {
             assertPreparedAndNotDestroyedLocked("commit");
             assertNoWriteFileTransfersOpenLocked();
 
-            if (forTransfer) {
+            final boolean enforceInstallPackages = forTransfer
+                    || (android.provider.Settings.Secure.getInt(mContext.getContentResolver(),
+                                android.provider.Settings.Secure.SECURE_FRP_MODE, 0) == 1);
+            if (enforceInstallPackages) {
                 mContext.enforceCallingOrSelfPermission(Manifest.permission.INSTALL_PACKAGES, null);
-
+            }
+            if (forTransfer) {
                 if (mInstallerUid == mOriginalInstallerUid) {
                     throw new IllegalArgumentException("Session has not been transferred");
                 }