Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Validate checkInstallConstraints() installer package name" into udc-dev

Browse Source
This commit is contained in:
Joanne Chung
2023-05-09 05:29:22 +00:00
committed by Android (Google) Code Review
parent 37b8ca636b f8489cf667
commit d359469b9b
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
services/core/java/com/android/server/pm/PackageInstallerService.java
View File

@@ -1316,6 +1316,11 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements
final var snapshot = mPm.snapshotComputer(); final var snapshot = mPm.snapshotComputer();
final int callingUid = Binder.getCallingUid(); final int callingUid = Binder.getCallingUid();
final var callingPackageName = snapshot.getNameForUid(callingUid);
if (!TextUtils.equals(callingPackageName, installerPackageName)) {
throw new SecurityException("The installerPackageName set by the caller doesn't match "
+ "the caller's own package name.");
}
if (!PackageManagerServiceUtils.isSystemOrRootOrShell(callingUid)) { if (!PackageManagerServiceUtils.isSystemOrRootOrShell(callingUid)) {
for (var packageName : packageNames) { for (var packageName : packageNames) {
var ps = snapshot.getPackageStateInternal(packageName); var ps = snapshot.getPackageStateInternal(packageName);