Merge "Installer package can call performDexOptMode" into tm-dev am: 2b7ad933d7

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/17934472

Change-Id: I046e5ac1fa4f6347ea50e3d27258ae33adfd5e5a
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

services/core/java/com/android/server/pm/DexOptHelper.java

@@ -442,10 +442,13 @@ final class DexOptHelper {
         }
     }
 
-    public boolean performDexOptMode(String packageName,
+    public boolean performDexOptMode(@NonNull Computer snapshot, String packageName,
             boolean checkProfiles, String targetCompilerFilter, boolean force,
             boolean bootComplete, String splitName) {
-        PackageManagerServiceUtils.enforceSystemOrRootOrShell("performDexOptMode");
+        if (!PackageManagerServiceUtils.isSystemOrRootOrShell()
+                && !isCallerInstallerForPackage(snapshot, packageName)) {
+            throw new SecurityException("performDexOptMode");
+        }
 
         int flags = (checkProfiles ? DexoptOptions.DEXOPT_CHECK_FOR_PROFILES_UPDATES : 0)
                 | (force ? DexoptOptions.DEXOPT_FORCE : 0)
@@ -454,6 +457,22 @@ final class DexOptHelper {
                 targetCompilerFilter, splitName, flags));
     }
 
+    private boolean isCallerInstallerForPackage(@NonNull Computer snapshot, String packageName) {
+        final PackageStateInternal packageState = snapshot.getPackageStateInternal(packageName);
+        if (packageState == null) {
+            return false;
+        }
+        final InstallSource installSource = packageState.getInstallSource();
+
+        final PackageStateInternal installerPackageState =
+                snapshot.getPackageStateInternal(installSource.installerPackageName);
+        if (installerPackageState == null) {
+            return false;
+        }
+        final AndroidPackage installerPkg = installerPackageState.getPkg();
+        return installerPkg.getUid() == Binder.getCallingUid();
+    }
+
     public boolean performDexOptSecondary(String packageName, String compilerFilter,
             boolean force) {
         int flags = DexoptOptions.DEXOPT_ONLY_SECONDARY_DEX

services/core/java/com/android/server/pm/IPackageManagerBase.java

@@ -972,8 +972,9 @@ public abstract class IPackageManagerBase extends IPackageManager.Stub {
     public final boolean performDexOptMode(String packageName,
             boolean checkProfiles, String targetCompilerFilter, boolean force,
             boolean bootComplete, String splitName) {
-        return mDexOptHelper.performDexOptMode(packageName, checkProfiles, targetCompilerFilter,
+        final Computer snapshot = snapshot();
-                force, bootComplete, splitName);
+        return mDexOptHelper.performDexOptMode(snapshot, packageName, checkProfiles,
+                targetCompilerFilter, force, bootComplete, splitName);
     }
 
     /**

services/core/java/com/android/server/pm/PackageManagerServiceUtils.java

@@ -1245,12 +1245,19 @@ public class PackageManagerServiceUtils {
      * @throws SecurityException if the caller is not system or shell
      */
     public static void enforceSystemOrRootOrShell(String message) {
-        final int uid = Binder.getCallingUid();
+        if (!isSystemOrRootOrShell()) {
-        if (uid != Process.SYSTEM_UID && uid != Process.ROOT_UID && uid != Process.SHELL_UID) {
             throw new SecurityException(message);
         }
     }
 
+    /**
+     * Check if the Binder caller is system UID, root's UID, or shell's UID.
+     */
+    public static boolean isSystemOrRootOrShell() {
+        final int uid = Binder.getCallingUid();
+        return uid == Process.SYSTEM_UID || uid == Process.ROOT_UID || uid == Process.SHELL_UID;
+    }
+
     /**
      * Check if the Binder caller is system UID or root's UID.
      */