Merge "Only grant visibility of protected broadcasts to system" into rvc-dev

core/java/android/content/IntentFilter.java

@@ -17,6 +17,7 @@
 package android.content;
 
 import android.annotation.IntDef;
+import android.annotation.Nullable;
 import android.annotation.SystemApi;
 import android.compat.annotation.UnsupportedAppUsage;
 import android.net.Uri;
@@ -40,6 +41,7 @@ import java.io.IOException;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Set;
@@ -766,16 +768,30 @@ public class IntentFilter implements Parcelable {
      * @return True if the action is listed in the filter.
      */
     public final boolean matchAction(String action) {
-        return matchAction(action, false);
+        return matchAction(action, false /*wildcardSupported*/, null /*ignoreActions*/);
     }
 
     /**
      * Variant of {@link #matchAction(String)} that allows a wildcard for the provided action.
      * @param wildcardSupported if true, will allow action to use wildcards
+     * @param ignoreActions if not null, the set of actions to should not be considered valid while
+     *                      calculating the match
      */
-    private boolean matchAction(String action, boolean wildcardSupported) {
+    private boolean matchAction(String action, boolean wildcardSupported,
-        if (wildcardSupported && !mActions.isEmpty() && WILDCARD.equals(action)) {
+            @Nullable Collection<String> ignoreActions) {
-            return true;
+        if (wildcardSupported && WILDCARD.equals(action)) {
+            if (ignoreActions == null) {
+                return !mActions.isEmpty();
+            }
+            for (int i = mActions.size() - 1; i >= 0; i--) {
+                if (!ignoreActions.contains(mActions.get(i))) {
+                    return true;
+                }
+            }
+            return false;
+        }
+        if (ignoreActions != null && ignoreActions.contains(action)) {
+            return false;
         }
         return hasAction(action);
     }
@@ -1779,17 +1795,24 @@ public class IntentFilter implements Parcelable {
      */
     public final int match(String action, String type, String scheme,
             Uri data, Set<String> categories, String logTag) {
-        return match(action, type, scheme, data, categories, logTag, false /*supportWildcards*/);
+        return match(action, type, scheme, data, categories, logTag, false /*supportWildcards*/,
+                null /*ignoreActions*/);
     }
 
     /**
      * Variant of {@link #match(ContentResolver, Intent, boolean, String)} that supports wildcards
      * in the action, type, scheme, host and path.
-     * @hide if true, will allow supported parameters to use wildcards to match this filter
+     * @param supportWildcards if true, will allow supported parameters to use wildcards to match
+     *                         this filter
+     * @param ignoreActions a collection of actions that, if not null should be ignored and not used
+     *                      if provided as the matching action or the set of actions defined by this
+     *                      filter
+     * @hide
      */
     public final int match(String action, String type, String scheme,
-            Uri data, Set<String> categories, String logTag, boolean supportWildcards) {
+            Uri data, Set<String> categories, String logTag, boolean supportWildcards,
-        if (action != null && !matchAction(action, supportWildcards)) {
+            @Nullable Collection<String> ignoreActions) {
+        if (action != null && !matchAction(action, supportWildcards, ignoreActions)) {
             if (false) Log.v(
                 logTag, "No matching action " + action + " for " + this);
             return NO_MATCH_ACTION;

services/core/java/com/android/server/pm/AppsFilter.java

@@ -113,6 +113,7 @@ public class AppsFilter {
 
     private final OverlayReferenceMapper mOverlayReferenceMapper;
     private PackageParser.SigningDetails mSystemSigningDetails;
+    private Set<String> mProtectedBroadcasts = new ArraySet<>();
 
     AppsFilter(FeatureConfig featureConfig, String[] forceQueryableWhitelist,
             boolean systemAppsQueryable,
@@ -298,10 +299,10 @@ public class AppsFilter {
 
     /** Returns true if the querying package may query for the potential target package */
     private static boolean canQueryViaComponents(AndroidPackage querying,
-            AndroidPackage potentialTarget) {
+            AndroidPackage potentialTarget, Set<String> protectedBroadcasts) {
         if (!querying.getQueriesIntents().isEmpty()) {
             for (Intent intent : querying.getQueriesIntents()) {
-                if (matchesIntentFilters(intent, potentialTarget)) {
+                if (matchesIntentFilters(intent, potentialTarget, protectedBroadcasts)) {
                     return true;
                 }
             }
@@ -353,13 +354,14 @@ public class AppsFilter {
         return false;
     }
 
-    private static boolean matchesIntentFilters(Intent intent, AndroidPackage potentialTarget) {
+    private static boolean matchesIntentFilters(Intent intent, AndroidPackage potentialTarget,
+            Set<String> protectedBroadcasts) {
         for (int s = ArrayUtils.size(potentialTarget.getServices()) - 1; s >= 0; s--) {
             ParsedService service = potentialTarget.getServices().get(s);
             if (!service.isExported()) {
                 continue;
             }
-            if (matchesAnyFilter(intent, service)) {
+            if (matchesAnyFilter(intent, service, null /*protectedBroadcasts*/)) {
                 return true;
             }
         }
@@ -368,7 +370,8 @@ public class AppsFilter {
             if (!activity.isExported()) {
                 continue;
             }
-            if (matchesAnyFilter(intent, activity)) {
+
+            if (matchesAnyFilter(intent, activity, null /*protectedBroadcasts*/)) {
                 return true;
             }
         }
@@ -377,25 +380,32 @@ public class AppsFilter {
             if (!receiver.isExported()) {
                 continue;
             }
-            if (matchesAnyFilter(intent, receiver)) {
+            if (matchesAnyFilter(intent, receiver, protectedBroadcasts)) {
                 return true;
             }
         }
         return false;
     }
 
-    private static boolean matchesAnyFilter(Intent intent, ParsedComponent component) {
+    private static boolean matchesAnyFilter(Intent intent, ParsedComponent component,
+            Set<String> protectedBroadcasts) {
         List<ParsedIntentInfo> intents = component.getIntents();
         for (int i = ArrayUtils.size(intents) - 1; i >= 0; i--) {
             IntentFilter intentFilter = intents.get(i);
-            if (intentFilter.match(intent.getAction(), intent.getType(), intent.getScheme(),
+            if (matchesIntentFilter(intent, intentFilter, protectedBroadcasts)) {
-                    intent.getData(), intent.getCategories(), "AppsFilter", true) > 0) {
                 return true;
             }
         }
         return false;
     }
 
+    private static boolean matchesIntentFilter(Intent intent, IntentFilter intentFilter,
+            @Nullable Set<String> protectedBroadcasts) {
+        return intentFilter.match(intent.getAction(), intent.getType(), intent.getScheme(),
+                intent.getData(), intent.getCategories(), "AppsFilter", true, protectedBroadcasts)
+                > 0;
+    }
+
     /**
      * Grants access based on an interaction between a calling and target package, granting
      * visibility of the caller from the target.
@@ -434,6 +444,12 @@ public class AppsFilter {
                 }
             }
         }
+
+        if (!newPkgSetting.pkg.getProtectedBroadcasts().isEmpty()) {
+            mProtectedBroadcasts.addAll(newPkgSetting.pkg.getProtectedBroadcasts());
+            recomputeComponentVisibility(existingSettings, newPkgSetting.pkg.getPackageName());
+        }
+
         Trace.traceBegin(TRACE_TAG_PACKAGE_MANAGER, "filter.addPackage");
         try {
             final AndroidPackage newPkg = newPkgSetting.pkg;
@@ -464,7 +480,7 @@ public class AppsFilter {
                 final AndroidPackage existingPkg = existingSetting.pkg;
                 // let's evaluate the ability of already added packages to see this new package
                 if (!newIsForceQueryable) {
-                    if (canQueryViaComponents(existingPkg, newPkg)) {
+                    if (canQueryViaComponents(existingPkg, newPkg, mProtectedBroadcasts)) {
                         mQueriesViaComponent.add(existingSetting.appId, newPkgSetting.appId);
                     }
                     if (canQueryViaPackage(existingPkg, newPkg)
@@ -474,7 +490,7 @@ public class AppsFilter {
                 }
                 // now we'll evaluate our new package's ability to see existing packages
                 if (!mForceQueryable.contains(existingSetting.appId)) {
-                    if (canQueryViaComponents(newPkg, existingPkg)) {
+                    if (canQueryViaComponents(newPkg, existingPkg, mProtectedBroadcasts)) {
                         mQueriesViaComponent.add(newPkgSetting.appId, existingSetting.appId);
                     }
                     if (canQueryViaPackage(newPkg, existingPkg)
@@ -511,10 +527,47 @@ public class AppsFilter {
                 && pkgSetting.signatures.mSigningDetails.signaturesMatchExactly(sysSigningDetails);
     }
 
-    private static void sort(int[] uids, int nextUidIndex) {
+    private ArraySet<String> collectProtectedBroadcasts(
-        Arrays.sort(uids, 0, nextUidIndex);
+            ArrayMap<String, PackageSetting> existingSettings, @Nullable String excludePackage) {
+        ArraySet<String> ret = new ArraySet<>();
+        for (int i = existingSettings.size() - 1; i >= 0; i--) {
+            PackageSetting setting = existingSettings.valueAt(i);
+            if (setting.pkg == null || setting.pkg.getPackageName().equals(excludePackage)) {
+                continue;
+            }
+            final List<String> protectedBroadcasts = setting.pkg.getProtectedBroadcasts();
+            if (!protectedBroadcasts.isEmpty()) {
+                ret.addAll(protectedBroadcasts);
+            }
+        }
+        return ret;
     }
 
+    private void recomputeComponentVisibility(ArrayMap<String, PackageSetting> existingSettings,
+            @Nullable String excludePackage) {
+        mQueriesViaComponent.clear();
+        for (int i = existingSettings.size() - 1; i >= 0; i--) {
+            PackageSetting setting = existingSettings.valueAt(i);
+            if (setting.pkg == null
+                    || setting.pkg.getPackageName().equals(excludePackage)
+                    || mForceQueryable.contains(setting.appId)) {
+                continue;
+            }
+            for (int j = existingSettings.size() - 1; j >= 0; j--) {
+                if (i == j) {
+                    continue;
+                }
+                final PackageSetting otherSetting = existingSettings.valueAt(j);
+                if (otherSetting.pkg == null
+                        || otherSetting.pkg.getPackageName().equals(excludePackage)) {
+                    continue;
+                }
+                if (canQueryViaComponents(setting.pkg, otherSetting.pkg, mProtectedBroadcasts)) {
+                    mQueriesViaComponent.add(setting.appId, otherSetting.appId);
+                }
+            }
+        }
+    }
     /**
      * Fetches all app Ids that a given setting is currently visible to, per provided user. This
      * only includes UIDs >= {@link Process#FIRST_APPLICATION_UID} as all other UIDs can already see
@@ -608,6 +661,14 @@ public class AppsFilter {
             }
         }
 
+        if (!setting.pkg.getProtectedBroadcasts().isEmpty()) {
+            final String removingPackageName = setting.pkg.getPackageName();
+            mProtectedBroadcasts.clear();
+            mProtectedBroadcasts.addAll(
+                    collectProtectedBroadcasts(existingSettings, removingPackageName));
+            recomputeComponentVisibility(existingSettings, removingPackageName);
+        }
+
         mOverlayReferenceMapper.removePkg(setting.name);
         mFeatureConfig.updatePackageState(setting, true /*removed*/);
     }

services/tests/servicestests/src/com/android/server/pm/AppsFilterTest.java

@@ -117,6 +117,16 @@ public class AppsFilterTest {
     }
 
     private static ParsingPackage pkg(String packageName, IntentFilter... filters) {
+        ParsedActivity activity = createActivity(packageName, filters);
+        return pkg(packageName).addActivity(activity);
+    }
+
+    private static ParsingPackage pkgWithReceiver(String packageName, IntentFilter... filters) {
+        ParsedActivity receiver = createActivity(packageName, filters);
+        return pkg(packageName).addReceiver(receiver);
+    }
+
+    private static ParsedActivity createActivity(String packageName, IntentFilter[] filters) {
         ParsedActivity activity = new ParsedActivity();
         activity.setPackageName(packageName);
         for (IntentFilter filter : filters) {
@@ -136,9 +146,7 @@ public class AppsFilterTest {
             activity.addIntent(info);
             activity.setExported(true);
         }
-
+        return activity;
-        return pkg(packageName)
-                .addActivity(activity);
     }
 
     private static ParsingPackage pkgWithInstrumentation(
@@ -176,9 +184,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testQueriesAction_FilterMatches() {
+    public void testQueriesAction_FilterMatches() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter,
@@ -190,9 +199,46 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testQueriesProvider_FilterMatches() {
+    public void testQueriesProtectedAction_FilterDoesNotMatch() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        final Signature frameworkSignature = Mockito.mock(Signature.class);
+        final PackageParser.SigningDetails frameworkSigningDetails =
+                new PackageParser.SigningDetails(new Signature[]{frameworkSignature}, 1);
+        final ParsingPackage android = pkg("android");
+        android.addProtectedBroadcast("TEST_ACTION");
+        simulateAddPackage(appsFilter, android, 1000,
+                b -> b.setSigningDetails(frameworkSigningDetails));
+        appsFilter.onSystemReady();
+
+        final int activityUid = DUMMY_TARGET_UID;
+        PackageSetting targetActivity = simulateAddPackage(appsFilter,
+                pkg("com.target.activity", new IntentFilter("TEST_ACTION")), activityUid);
+        final int receiverUid = DUMMY_TARGET_UID + 1;
+        PackageSetting targetReceiver = simulateAddPackage(appsFilter,
+                pkgWithReceiver("com.target.receiver", new IntentFilter("TEST_ACTION")),
+                receiverUid);
+        final int callingUid = DUMMY_CALLING_UID;
+        PackageSetting calling = simulateAddPackage(appsFilter,
+                pkg("com.calling.action", new Intent("TEST_ACTION")), callingUid);
+        final int wildcardUid = DUMMY_CALLING_UID + 1;
+        PackageSetting callingWildCard = simulateAddPackage(appsFilter,
+                pkg("com.calling.wildcard", new Intent("*")), wildcardUid);
+
+        assertFalse(appsFilter.shouldFilterApplication(callingUid, calling, targetActivity, 0));
+        assertTrue(appsFilter.shouldFilterApplication(callingUid, calling, targetReceiver, 0));
+
+        assertFalse(appsFilter.shouldFilterApplication(
+                wildcardUid, callingWildCard, targetActivity, 0));
+        assertTrue(appsFilter.shouldFilterApplication(
+                wildcardUid, callingWildCard, targetReceiver, 0));
+    }
+
+    @Test
+    public void testQueriesProvider_FilterMatches() throws Exception {
+        final AppsFilter appsFilter =
+                new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter,
@@ -205,9 +251,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testQueriesDifferentProvider_Filters() {
+    public void testQueriesDifferentProvider_Filters() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter,
@@ -220,9 +267,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testQueriesProviderWithSemiColon_FilterMatches() {
+    public void testQueriesProviderWithSemiColon_FilterMatches() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter,
@@ -236,9 +284,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testQueriesAction_NoMatchingAction_Filters() {
+    public void testQueriesAction_NoMatchingAction_Filters() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter,
@@ -250,9 +299,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testQueriesAction_NoMatchingActionFilterLowSdk_DoesntFilter() {
+    public void testQueriesAction_NoMatchingActionFilterLowSdk_DoesntFilter() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter,
@@ -269,9 +319,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testNoQueries_Filters() {
+    public void testNoQueries_Filters() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter,
@@ -283,9 +334,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testForceQueryable_DoesntFilter() {
+    public void testForceQueryable_DoesntFilter() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter,
@@ -297,9 +349,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testForceQueryableByDevice_SystemCaller_DoesntFilter() {
+    public void testForceQueryableByDevice_SystemCaller_DoesntFilter() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{"com.some.package"}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter,
@@ -340,9 +393,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testForceQueryableByDevice_NonSystemCaller_Filters() {
+    public void testForceQueryableByDevice_NonSystemCaller_Filters() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{"com.some.package"}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter,
@@ -355,10 +409,11 @@ public class AppsFilterTest {
 
 
     @Test
-    public void testSystemQueryable_DoesntFilter() {
+    public void testSystemQueryable_DoesntFilter() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{},
                         true /* system force queryable */, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter,
@@ -371,9 +426,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testQueriesPackage_DoesntFilter() {
+    public void testQueriesPackage_DoesntFilter() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter,
@@ -385,11 +441,12 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testNoQueries_FeatureOff_DoesntFilter() {
+    public void testNoQueries_FeatureOff_DoesntFilter() throws Exception {
         when(mFeatureConfigMock.packageIsEnabled(any(AndroidPackage.class)))
                 .thenReturn(false);
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(
@@ -401,9 +458,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testSystemUid_DoesntFilter() {
+    public void testSystemUid_DoesntFilter() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter,
@@ -415,9 +473,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testNonSystemUid_NoCallingSetting_Filters() {
+    public void testNonSystemUid_NoCallingSetting_Filters() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter,
@@ -427,9 +486,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testNoTargetPackage_filters() {
+    public void testNoTargetPackage_filters() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = new PackageSettingBuilder()
@@ -445,7 +505,7 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testActsOnTargetOfOverlay() {
+    public void testActsOnTargetOfOverlay() throws Exception {
         final String actorName = "overlay://test/actorName";
 
         ParsingPackage target = pkg("com.some.package.target")
@@ -481,6 +541,7 @@ public class AppsFilterTest {
                         return Collections.emptyMap();
                     }
                 });
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting targetSetting = simulateAddPackage(appsFilter, target, DUMMY_TARGET_UID);
@@ -507,7 +568,7 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testActsOnTargetOfOverlayThroughSharedUser() {
+    public void testActsOnTargetOfOverlayThroughSharedUser() throws Exception {
         final String actorName = "overlay://test/actorName";
 
         ParsingPackage target = pkg("com.some.package.target")
@@ -545,6 +606,7 @@ public class AppsFilterTest {
                         return Collections.emptyMap();
                     }
                 });
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting targetSetting = simulateAddPackage(appsFilter, target, DUMMY_TARGET_UID);
@@ -566,9 +628,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testInitiatingApp_DoesntFilter() {
+    public void testInitiatingApp_DoesntFilter() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter, pkg("com.some.package"),
@@ -580,9 +643,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testUninstalledInitiatingApp_Filters() {
+    public void testUninstalledInitiatingApp_Filters() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter, pkg("com.some.package"),
@@ -594,9 +658,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testOriginatingApp_Filters() {
+    public void testOriginatingApp_Filters() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter, pkg("com.some.package"),
@@ -608,9 +673,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testInstallingApp_DoesntFilter() {
+    public void testInstallingApp_DoesntFilter() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         PackageSetting target = simulateAddPackage(appsFilter, pkg("com.some.package"),
@@ -622,9 +688,10 @@ public class AppsFilterTest {
     }
 
     @Test
-    public void testInstrumentation_DoesntFilter() {
+    public void testInstrumentation_DoesntFilter() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
 
@@ -644,6 +711,7 @@ public class AppsFilterTest {
     public void testWhoCanSee() throws Exception {
         final AppsFilter appsFilter =
                 new AppsFilter(mFeatureConfigMock, new String[]{}, false, null);
+        simulateAddBasicAndroid(appsFilter);
         appsFilter.onSystemReady();
 
         final int systemAppId = Process.FIRST_APPLICATION_UID - 1;
@@ -700,6 +768,15 @@ public class AppsFilterTest {
         PackageSettingBuilder withBuilder(PackageSettingBuilder builder);
     }
 
+    private void simulateAddBasicAndroid(AppsFilter appsFilter) throws Exception {
+        final Signature frameworkSignature = Mockito.mock(Signature.class);
+        final PackageParser.SigningDetails frameworkSigningDetails =
+                new PackageParser.SigningDetails(new Signature[]{frameworkSignature}, 1);
+        final ParsingPackage android = pkg("android");
+        simulateAddPackage(appsFilter, android, 1000,
+                b -> b.setSigningDetails(frameworkSigningDetails));
+    }
+
     private PackageSetting simulateAddPackage(AppsFilter filter,
             ParsingPackage newPkgBuilder, int appId) {
         return simulateAddPackage(filter, newPkgBuilder, appId, null);