Merge "Enforce permission check before returning application info Test: atest CtsAppSecurityHostTestCases:ApplicationVisibilityTest Bug: 77821568" into pi-dev

am: dbc6052022

Change-Id: I137f5df296a05d7ec128427d8aafd5ae66b519f7

api/test-current.txt

@@ -249,6 +249,7 @@ package android.content.pm {
     method public abstract java.lang.String getDefaultBrowserPackageNameAsUser(int);
     method public abstract int getInstallReason(java.lang.String, android.os.UserHandle);
     method public abstract java.util.List<android.content.pm.PackageInfo> getInstalledPackagesAsUser(int, int);
+    method public abstract java.util.List<android.content.pm.ApplicationInfo> getInstalledApplicationsAsUser(int, int);
     method public abstract java.lang.String[] getNamesForUids(int[]);
     method public abstract java.lang.String getPermissionControllerPackageName();
     method public abstract java.lang.String getServicesSystemSharedLibraryPackageName();

core/java/android/content/pm/PackageManager.java

@@ -3798,6 +3798,7 @@ public abstract class PackageManager {
      *         deleted with {@code DONT_DELETE_DATA} flag set).
      * @hide
      */
+    @TestApi
     public abstract List<ApplicationInfo> getInstalledApplicationsAsUser(
             @ApplicationInfoFlags int flags, @UserIdInt int userId);
 

services/core/java/com/android/server/pm/PackageManagerService.java

@@ -7997,6 +7997,13 @@ public class PackageManagerService extends IPackageManager.Stub
         flags = updateFlagsForApplication(flags, userId, null);
         final boolean listUninstalled = (flags & MATCH_KNOWN_PACKAGES) != 0;
 
+        mPermissionManager.enforceCrossUserPermission(
+            callingUid,
+            userId,
+            false /* requireFullPermission */,
+            false /* checkShell */,
+            "get installed application info");
+
         // writer
         synchronized (mPackages) {
             ArrayList<ApplicationInfo> list;