Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Don't allow shell to spoof initiating package name." into rvc-dev am: 717f3d8401

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/12047567

Change-Id: I5318dc86181969d7a21d1a2265e953930dd8a4e2
This commit is contained in:
Alan Stokes
2020-07-01 18:28:46 +00:00
committed by Automerger Merge Worker
parent 553b71a5b2 717f3d8401
commit e471179dab
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
services/core/java/com/android/server/pm/PackageInstallerService.java
View File

@@ -522,7 +522,9 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements
if ((callingUid == Process.SHELL_UID) || (callingUid == Process.ROOT_UID)) { if ((callingUid == Process.SHELL_UID) || (callingUid == Process.ROOT_UID)) {
params.installFlags |= PackageManager.INSTALL_FROM_ADB; params.installFlags |= PackageManager.INSTALL_FROM_ADB;
// adb installs can override the installingPackageName, but not the
// initiatingPackageName
installerPackageName = null;
} else { } else {
if (callingUid != Process.SYSTEM_UID) { if (callingUid != Process.SYSTEM_UID) {
// The supplied installerPackageName must always belong to the calling app. // The supplied installerPackageName must always belong to the calling app.