Add new manifest attr allowUpdateOwnership (4/n)

Setting this new attr to false indicates to the platform that this
package wants to opt-out of the update ownership enforcement. This
overrides the installers' use of setRequestUpdateOwnership.

Bug: 244413073
Test: atest PackageManagerServiceUnitTests:AndroidPackageTest
Test: atest CtsPackageInstallTestCases:UpdateOwnershipEnforcementTest
Change-Id: I4b3e851b87a25583a7c43b40a7fad07ad46c3761

core/api/current.txt

@@ -385,6 +385,7 @@ package android {
     field public static final int allowTaskReparenting = 16843268; // 0x1010204
     field public static final int allowUndo = 16843999; // 0x10104df
     field public static final int allowUntrustedActivityEmbedding = 16844393; // 0x1010669
+    field public static final int allowUpdateOwnership;
     field public static final int alpha = 16843551; // 0x101031f
     field public static final int alphabeticModifiers = 16844110; // 0x101054e
     field public static final int alphabeticShortcut = 16843235; // 0x10101e3

core/res/res/values/attrs_manifest.xml

@@ -1783,6 +1783,14 @@
     -->
     <attr name="attributionTags" format="string" />
 
+    <!-- Default value <code>true</code> allows an installer to enable update
+         ownership enforcement for this package via {@link
+         android.content.pm.PackageInstaller.SessionParams#setRequestUpdateOwnership}
+         during initial installation. This overrides the installer's use of {@link
+         android.content.pm.PackageInstaller.SessionParams#setRequestUpdateOwnership}.
+    -->
+    <attr name="allowUpdateOwnership" format="boolean" />
+
     <!-- The <code>manifest</code> tag is the root of an
          <code>AndroidManifest.xml</code> file,
          describing the contents of an Android package (.apk) file.  One
@@ -1820,6 +1828,7 @@
         <attr name="isSplitRequired" />
         <attr name="requiredSplitTypes" />
         <attr name="splitTypes" />
+        <attr name="allowUpdateOwnership" />
     </declare-styleable>
 
     <!-- The <code>application</code> tag describes application-level components

core/res/res/values/public-staging.xml

@@ -124,6 +124,7 @@
     <public name="allowSharedIsolatedProcess" />
     <public name="keyboardLocale" />
     <public name="keyboardLayoutType" />
+    <public name="allowUpdateOwnership" />
   </staging-public-group>
 
   <staging-public-group type="id" first-id="0x01cd0000">

services/core/java/com/android/server/pm/InstallPackageHelper.java

@@ -333,6 +333,10 @@ final class InstallPackageHelper {
             if (updateOwnerFromSysconfig != null) {
                 // For system app, we always use the update owner from sysconfig if presented.
                 installSource = installSource.setUpdateOwnerPackageName(updateOwnerFromSysconfig);
+            } else if (!parsedPackage.isAllowUpdateOwnership()) {
+                // If the app wants to opt-out of the update ownership enforcement via manifest,
+                // it overrides the installer's use of #setRequestUpdateOwnership.
+                installSource = installSource.setUpdateOwnerPackageName(null);
             } else if (!isApex) {
                 final boolean isUpdate = oldPkgSetting != null;
                 final String oldUpdateOwner =

services/core/java/com/android/server/pm/parsing/pkg/PackageImpl.java

@@ -1809,6 +1809,11 @@ public class PackageImpl implements ParsedPackage, AndroidPackageInternal,
         return getBoolean(Booleans.VISIBLE_TO_INSTANT_APPS);
     }
 
+    @Override
+    public boolean isAllowUpdateOwnership() {
+        return getBoolean2(Booleans2.ALLOW_UPDATE_OWNERSHIP);
+    }
+
     @Override
     public boolean isVmSafeMode() {
         return getBoolean(Booleans.VM_SAFE_MODE);
@@ -2512,6 +2517,11 @@ public class PackageImpl implements ParsedPackage, AndroidPackageInternal,
         return this;
     }
 
+    @Override
+    public PackageImpl setAllowUpdateOwnership(boolean value) {
+        return setBoolean2(Booleans2.ALLOW_UPDATE_OWNERSHIP, value);
+    }
+
     @Override
     public PackageImpl sortActivities() {
         Collections.sort(this.activities, ORDER_COMPARATOR);
@@ -3726,5 +3736,6 @@ public class PackageImpl implements ParsedPackage, AndroidPackageInternal,
 
         private static final long STUB = 1L;
         private static final long APEX = 1L << 1;
+        private static final long ALLOW_UPDATE_OWNERSHIP = 1L << 2;
     }
 }

services/core/java/com/android/server/pm/pkg/AndroidPackage.java

@@ -1483,4 +1483,10 @@ public interface AndroidPackage {
      * @hide
      */
     boolean isVisibleToInstantApps();
+
+    /**
+     * @see R.styleable#AndroidManifest_allowUpdateOwnership
+     * @hide
+     */
+    boolean isAllowUpdateOwnership();
 }

services/core/java/com/android/server/pm/pkg/parsing/ParsingPackage.java

@@ -387,6 +387,8 @@ public interface ParsingPackage {
 
     ParsingPackage setLocaleConfigRes(int localeConfigRes);
 
+    ParsingPackage setAllowUpdateOwnership(boolean value);
+
     /**
      * Sets the trusted host certificates of apps that are allowed to embed activities of this
      * application.

services/core/java/com/android/server/pm/pkg/parsing/ParsingPackageUtils.java

@@ -219,6 +219,7 @@ public class ParsingPackageUtils {
     public static final int PARSE_DEFAULT_INSTALL_LOCATION =
             PackageInfo.INSTALL_LOCATION_UNSPECIFIED;
     public static final int PARSE_DEFAULT_TARGET_SANDBOX = 1;
+    public static final boolean PARSE_DEFAULT_ALLOW_UPDATE_OWNERSHIP = true;
 
     /**
      * If set to true, we will only allow package files that exactly match the DTD. Otherwise, we
@@ -883,7 +884,9 @@ public class ParsingPackageUtils {
                 .setTargetSandboxVersion(anInteger(PARSE_DEFAULT_TARGET_SANDBOX,
                         R.styleable.AndroidManifest_targetSandboxVersion, sa))
                 /* Set the global "on SD card" flag */
-                .setExternalStorage((flags & PARSE_EXTERNAL_STORAGE) != 0);
+                .setExternalStorage((flags & PARSE_EXTERNAL_STORAGE) != 0)
+                .setAllowUpdateOwnership(bool(PARSE_DEFAULT_ALLOW_UPDATE_OWNERSHIP,
+                        R.styleable.AndroidManifest_allowUpdateOwnership, sa));
 
         boolean foundApp = false;
         final int depth = parser.getDepth();

services/tests/PackageManagerServiceTests/unit/src/com/android/server/pm/test/parsing/parcelling/AndroidPackageTest.kt

@@ -218,6 +218,7 @@ class AndroidPackageTest : ParcelableComponentTest(AndroidPackage::class, Packag
         AndroidPackage::isAllowClearUserDataOnFailedRestore,
         AndroidPackage::isAllowNativeHeapPointerTagging,
         AndroidPackage::isAllowTaskReparenting,
+        AndroidPackage::isAllowUpdateOwnership,
         AndroidPackage::isBackupInForeground,
         AndroidPackage::isHardwareAccelerated,
         AndroidPackage::isCantSaveState,