[RESTRICT AUTOMERGE] Revert "Revert "Revert "[pm] remove old stage dirs on low storage"""

This reverts commit 3e28df68fa.

Reason for revert:   Reverting CVE-2021-39624 on qt-dev

Change-Id: I26c0abd06e2a49e05f45d153c4247f7c0a269897

services/core/java/com/android/server/pm/PackageInstallerService.java

@@ -129,9 +129,6 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements
     private static final long MAX_ACTIVE_SESSIONS = 1024;
     /** Upper bound on number of historical sessions for a UID */
     private static final long MAX_HISTORICAL_SESSIONS = 1048576;
-    /** Destroy sessions older than this on storage free request */
-    private static final long MAX_SESSION_AGE_ON_LOW_STORAGE_MILLIS = 8 * DateUtils.HOUR_IN_MILLIS;
-
 
     private final Context mContext;
     private final PackageManagerService mPm;
@@ -278,28 +275,18 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements
 
     @GuardedBy("mSessions")
     private void reconcileStagesLocked(String volumeUuid) {
-        final ArraySet<File> unclaimedStages = getStagingDirsOnVolume(volumeUuid);
+        final File stagingDir = getTmpSessionDir(volumeUuid);
+        final ArraySet<File> unclaimedStages = newArraySet(
+                stagingDir.listFiles(sStageFilter));
+
         // Ignore stages claimed by active sessions
         for (int i = 0; i < mSessions.size(); i++) {
             final PackageInstallerSession session = mSessions.valueAt(i);
             unclaimedStages.remove(session.stageDir);
         }
-        removeStagingDirs(unclaimedStages);
-    }
 
-    private ArraySet<File> getStagingDirsOnVolume(String volumeUuid) {
-        final File stagingDir = getTmpSessionDir(volumeUuid);
-        final ArraySet<File> stagingDirs = newArraySet(stagingDir.listFiles(sStageFilter));
-        // We also need to clean up orphaned staging directory for staged sessions
-        final File stagedSessionStagingDir = Environment.getDataStagingDirectory(volumeUuid);
-        stagingDirs.addAll(newArraySet(stagedSessionStagingDir.listFiles()));
-        return stagingDirs;
-    }
-
-
-    private void removeStagingDirs(ArraySet<File> stagingDirsToRemove) {
         // Clean up orphaned staging directories
-        for (File stage : stagingDirsToRemove) {
+        for (File stage : unclaimedStages) {
             Slog.w(TAG, "Deleting orphan stage " + stage);
             synchronized (mPm.mInstallLock) {
                 mPm.removeCodePathLI(stage);
@@ -313,33 +300,6 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements
         }
     }
 
-    /**
-     * Called to free up some storage space from obsolete installation files
-     */
-    public void freeStageDirs(String volumeUuid) {
-        final ArraySet<File> unclaimedStagingDirsOnVolume = getStagingDirsOnVolume(volumeUuid);
-        final long currentTimeMillis = System.currentTimeMillis();
-        synchronized (mSessions) {
-            for (int i = 0; i < mSessions.size(); i++) {
-                final PackageInstallerSession session = mSessions.valueAt(i);
-                if (!unclaimedStagingDirsOnVolume.contains(session.stageDir)) {
-                    // Only handles sessions stored on the target volume
-                    continue;
-                }
-                final long age = currentTimeMillis - session.createdMillis;
-                if (age >= MAX_SESSION_AGE_ON_LOW_STORAGE_MILLIS) {
-                    // Aggressively close old sessions because we are running low on storage
-                    // Their staging dirs will be removed too
-                    session.abandon();
-                } else {
-                    // Session is new enough, so it deserves to be kept even on low storage
-                    unclaimedStagingDirsOnVolume.remove(session.stageDir);
-                }
-            }
-        }
-        removeStagingDirs(unclaimedStagingDirsOnVolume);
-    }
-
     public static boolean isStageName(String name) {
         final boolean isFile = name.startsWith("vmdl") && name.endsWith(".tmp");
         final boolean isContainer = name.startsWith("smdl") && name.endsWith(".tmp");

services/core/java/com/android/server/pm/PackageInstallerSession.java

@@ -2097,7 +2097,8 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub {
                             + mParentSessionId +  " and may not be abandoned directly.");
         }
         synchronized (mLock) {
-            assertCallerIsOwnerOrRootOrSystemLocked();
+            assertCallerIsOwnerOrRootLocked();
+
             if (isStagedAndInTerminalState()) {
                 // We keep the session in the database if it's in a finalized state. It will be
                 // removed by PackageInstallerService when the last update time is old enough.
@@ -2124,20 +2125,6 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub {
         dispatchSessionFinished(INSTALL_FAILED_ABORTED, "Session was abandoned", null);
     }
 
-    /**
-     * Check if the caller is the owner of this session. Otherwise throw a
-     * {@link SecurityException}.
-     */
-    @GuardedBy("mLock")
-    private void assertCallerIsOwnerOrRootOrSystemLocked() {
-        final int callingUid = Binder.getCallingUid();
-        if (callingUid != Process.ROOT_UID && callingUid != mInstallerUid
-                && callingUid != Process.SYSTEM_UID) {
-            throw new SecurityException("Session does not belong to uid " + callingUid);
-        }
-    }
-
-
     @Override
     public boolean isMultiPackage() {
         return params.isMultiPackage;

services/core/java/com/android/server/pm/PackageManagerService.java

@@ -4875,9 +4875,6 @@ public class PackageManagerService extends IPackageManager.Stub
                             InstantAppRegistry.DEFAULT_UNINSTALLED_INSTANT_APP_MIN_CACHE_PERIOD))) {
                 return;
             }
-            // 12. Clear temp install session files
-            mInstallerService.freeStageDirs(volumeUuid);
-
         } else {
             try {
                 mInstaller.freeCache(volumeUuid, bytes, 0, 0);