From e5e6e52f0fd7d212af785940f176967bda9a76fa Mon Sep 17 00:00:00 2001
From: Patrick Baumann <patb@google.com>
Date: Tue, 12 Jul 2022 17:07:11 +0000
Subject: [PATCH] Permission protect receipt of QUERY_PACKAGE_RESTART

This change adds a signature permission to the system manifest intended
to guard receipt of the QUERY_PACKAGE_RESTART ordered broadcast so that
arbitrary apps cannot receive or inject bad data into the response.

Bug: 230755401
Test: manual - settings force stop works
Change-Id: Idffc0c1af702da9cb06747c800266efc48592b02
---
 core/res/AndroidManifest.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index c2fcd1d0612af..76a4a3fd6cdbd 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -6532,6 +6532,12 @@
     <permission android:name="android.permission.MAKE_UID_VISIBLE"
                 android:protectionLevel="signature" />
 
+    <!-- Limits the system as the only handler of the QUERY_PACKAGE_RESTART broadcast
+         @hide -->
+    <permission android:name="android.permission.HANDLE_QUERY_PACKAGE_RESTART"
+                android:protectionLevel="signature" />
+    <uses-permission android:name="android.permission.HANDLE_QUERY_PACKAGE_RESTART" />
+
     <!-- Attribution for Geofencing service. -->
     <attribution android:tag="GeofencingService" android:label="@string/geofencing_service"/>
     <!-- Attribution for Country Detector. -->