From f4a6ba88b3f5d44da53209b7c18ad714125bff5d Mon Sep 17 00:00:00 2001
From: Calin Juravle <calin@google.com>
Date: Thu, 6 May 2021 15:25:32 -0700
Subject: [PATCH] Enforce system/root/shell for dexopt operation.

Dexopt acquires system level locks (e.g. installd locks) so it should
not be called by artbitrary apps via `adb shell` commands.

Test: manual
Bug: 180652564
Change-Id: I385d5346df7721d95edf40c45d06b969870e4bda
---
 .../core/java/com/android/server/pm/PackageManagerService.java  | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 48fee0b392a0d..ed09acd563801 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -9962,6 +9962,8 @@ public class PackageManagerService extends IPackageManager.Stub
     public boolean performDexOptMode(String packageName,
             boolean checkProfiles, String targetCompilerFilter, boolean force,
             boolean bootComplete, String splitName) {
+        enforceSystemOrRootOrShell("performDexOptMode");
+
         int flags = (checkProfiles ? DexoptOptions.DEXOPT_CHECK_FOR_PROFILES_UPDATES : 0) |
                 (force ? DexoptOptions.DEXOPT_FORCE : 0) |
                 (bootComplete ? DexoptOptions.DEXOPT_BOOT_COMPLETE : 0);