Filter components, prevent app start in safe mode.

When device is in safe mode, we're trying to keep third-party code
from running to give us a stable platform.  The ideal approach would
be to treat these apps as temporarily "uninstalled" when in safe mode,
but not all system internals are ready for this.

Instead, go back to previous behavior where we simply filtered
non-system components.  This isn't perfect, since there are still
cracks through which components can leak out (GET_ACTIVITIES, etc).

So as a last-ditch sanity effort, refuse to fork any third-party apps
while running in safe mode.

Bug: 27165374
Change-Id: I044ede02e923c499159faf59b12e79b97fe77fba

services/core/java/com/android/server/pm/PackageManagerService.java

@@ -2896,6 +2896,10 @@ public class PackageManagerService extends IPackageManager.Stub {
                 throw new SecurityException("Package " + packageName + " was not found!");
             }
 
+            if (mSafeMode && !ps.isSystem()) {
+                throw new SecurityException("Package " + packageName + " not a system app!");
+            }
+
             if (ps.frozen) {
                 throw new SecurityException("Package " + packageName + " is currently frozen!");
             }
@@ -3275,12 +3279,6 @@ public class PackageManagerService extends IPackageManager.Stub {
                 flags |= PackageManager.MATCH_ENCRYPTION_AWARE;
             }
         }
-
-        // Safe mode means we should ignore any third-party apps
-        if (mSafeMode) {
-            flags |= PackageManager.MATCH_SYSTEM_ONLY;
-        }
-
         return flags;
     }
 
@@ -3340,6 +3338,12 @@ public class PackageManagerService extends IPackageManager.Stub {
             Log.w(TAG, "Caller hasn't been triaged for missing apps; they asked about " + cookie
                     + " with flags 0x" + Integer.toHexString(flags), new Throwable());
         }
+
+        // Safe mode means we shouldn't match any third-party components
+        if (mSafeMode) {
+            flags |= PackageManager.MATCH_SYSTEM_ONLY;
+        }
+
         return updateFlags(flags, userId);
     }