Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "DO NOT MERGE: Verify INSTALL_PACKAGES permissions when adding installer package" into oc-dev

Browse Source
This commit is contained in:
Winson Chiu
2020-06-03 18:34:30 +00:00
committed by Android (Google) Code Review
parent c34919e166 fc8bfed553
commit c842acc15a
1 changed files with 19 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
services/core/java/com/android/server/pm/PackageManagerService.java
View File

@@ -15317,20 +15317,26 @@ public class PackageManagerService extends IPackageManager.Stub
// Verify: if target already has an installer package, it must // Verify: if target already has an installer package, it must
// be signed with the same cert as the caller. // be signed with the same cert as the caller.
if (targetPackageSetting.installerPackageName != null) { String targetInstallerPackageName =
PackageSetting setting = mSettings.mPackages.get( targetPackageSetting.installerPackageName;
targetPackageSetting.installerPackageName); PackageSetting targetInstallerPkgSetting = targetInstallerPackageName == null ? null :
// If the currently set package isn't valid, then it's always mSettings.mPackages.get(targetInstallerPackageName);
// okay to change it.
if (setting != null) { if (targetInstallerPkgSetting != null) {
if (compareSignatures(callerSignature, if (compareSignatures(callerSignature,
setting.signatures.mSignatures) targetInstallerPkgSetting.signatures.mSignatures)
!= PackageManager.SIGNATURE_MATCH) { != PackageManager.SIGNATURE_MATCH) {
throw new SecurityException( throw new SecurityException(
"Caller does not have same cert as old installer package " "Caller does not have same cert as old installer package "
+ targetPackageSetting.installerPackageName); + targetInstallerPackageName);
}
} }
} else if (mContext.checkCallingOrSelfPermission(Manifest.permission.INSTALL_PACKAGES)
!= PackageManager.PERMISSION_GRANTED) {
// This is probably an attempt to exploit vulnerability b/150857253 of taking
// privileged installer permissions when the installer has been uninstalled or
// was never set.
EventLog.writeEvent(0x534e4554, "150857253", callingUid, "");
return;
} }
// Okay! // Okay!