From c7df7d7dcb1059dd3ca8a30616076e5cd1fc1405 Mon Sep 17 00:00:00 2001
From: Todd Kennedy <toddke@google.com>
Date: Fri, 28 Jul 2017 07:31:51 -0700
Subject: [PATCH] Allow the launcher to get all instant apps

Change-Id: Ie0381d01fe8cd5293a0a3671c1bdf497ca5c5783
Fixes: 63814920
Test: Manual
Test: Make and install a launcher that calls the protected APIs
Test: Run launcher, see that it gets a security exception
Test: Make the launcher the default, see that it gets a security exception
Test: Install the launcher as a system app
Test: Run the launcher, see that it gets a security exception
Test: Make the launcher the default, see that the API works
---
 .../android/server/pm/PackageManagerService.java    | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 98b6949a85e31..3ac73845640d2 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -8282,8 +8282,10 @@ public class PackageManagerService extends IPackageManager.Stub
         if (HIDE_EPHEMERAL_APIS || isEphemeralDisabled()) {
             return null;
         }
-        mContext.enforceCallingOrSelfPermission(Manifest.permission.ACCESS_INSTANT_APPS,
-                "getEphemeralApplications");
+        if (!canViewInstantApps(Binder.getCallingUid(), userId)) {
+            mContext.enforceCallingOrSelfPermission(Manifest.permission.ACCESS_INSTANT_APPS,
+                    "getEphemeralApplications");
+        }
         enforceCrossUserPermission(Binder.getCallingUid(), userId,
                 true /* requireFullPermission */, false /* checkShell */,
                 "getEphemeralApplications");
@@ -8368,9 +8370,10 @@ public class PackageManagerService extends IPackageManager.Stub
             return null;
         }
 
-        mContext.enforceCallingOrSelfPermission(Manifest.permission.ACCESS_INSTANT_APPS,
-                "getInstantAppIcon");
-
+        if (!canViewInstantApps(Binder.getCallingUid(), userId)) {
+            mContext.enforceCallingOrSelfPermission(Manifest.permission.ACCESS_INSTANT_APPS,
+                    "getInstantAppIcon");
+        }
         enforceCrossUserPermission(Binder.getCallingUid(), userId,
                 true /* requireFullPermission */, false /* checkShell */,
                 "getInstantAppIcon");