From d4a3fc30d6eb322957d784520faed846f3a285b3 Mon Sep 17 00:00:00 2001
From: Alex Buynytskyy <alexbuy@google.com>
Date: Thu, 11 Aug 2022 10:49:42 -0700
Subject: [PATCH] Allow multiple verdicts from the same verifier.

Bug: 241826200
Fixes: 241826200
Test: atest PackageVerificationStateTest PackageInstallerTest
Change-Id: I3dd590305413e14823d8e49befdb08dd64e93f8d
---
 .../server/pm/PackageVerificationState.java   |  9 +++++---
 .../pm/PackageVerificationStateTest.java      | 21 +++++++++++++++++++
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/services/core/java/com/android/server/pm/PackageVerificationState.java b/services/core/java/com/android/server/pm/PackageVerificationState.java
index a574fc9225a8c..8acdb0e475226 100644
--- a/services/core/java/com/android/server/pm/PackageVerificationState.java
+++ b/services/core/java/com/android/server/pm/PackageVerificationState.java
@@ -31,6 +31,7 @@ class PackageVerificationState {
     private final SparseBooleanArray mSufficientVerifierUids;
 
     private final SparseBooleanArray mRequiredVerifierUids;
+    private final SparseBooleanArray mUnrespondedRequiredVerifierUids;
 
     private boolean mSufficientVerificationComplete;
 
@@ -52,6 +53,7 @@ class PackageVerificationState {
         mVerifyingSession = verifyingSession;
         mSufficientVerifierUids = new SparseBooleanArray();
         mRequiredVerifierUids = new SparseBooleanArray();
+        mUnrespondedRequiredVerifierUids = new SparseBooleanArray();
         mRequiredVerificationComplete = false;
         mRequiredVerificationPassed = true;
         mExtendedTimeout = false;
@@ -64,6 +66,7 @@ class PackageVerificationState {
     /** Add the user ID of the required package verifier. */
     void addRequiredVerifierUid(int uid) {
         mRequiredVerifierUids.put(uid, true);
+        mUnrespondedRequiredVerifierUids.put(uid, true);
     }
 
     /** Returns true if the uid a required verifier. */
@@ -103,8 +106,8 @@ class PackageVerificationState {
                     mRequiredVerificationPassed = false;
             }
 
-            mRequiredVerifierUids.delete(uid);
-            if (mRequiredVerifierUids.size() == 0) {
+            mUnrespondedRequiredVerifierUids.delete(uid);
+            if (mUnrespondedRequiredVerifierUids.size() == 0) {
                 mRequiredVerificationComplete = true;
             }
             return true;
@@ -129,7 +132,7 @@ class PackageVerificationState {
      * Mark the session as passed required verification.
      */
     void passRequiredVerification() {
-        if (mRequiredVerifierUids.size() > 0) {
+        if (mUnrespondedRequiredVerifierUids.size() > 0) {
             throw new RuntimeException("Required verifiers still present.");
         }
         mRequiredVerificationPassed = true;
diff --git a/services/tests/servicestests/src/com/android/server/pm/PackageVerificationStateTest.java b/services/tests/servicestests/src/com/android/server/pm/PackageVerificationStateTest.java
index a62569fc81c3f..8715afda5cee3 100644
--- a/services/tests/servicestests/src/com/android/server/pm/PackageVerificationStateTest.java
+++ b/services/tests/servicestests/src/com/android/server/pm/PackageVerificationStateTest.java
@@ -329,6 +329,27 @@ public class PackageVerificationStateTest extends AndroidTestCase {
                 state.isInstallAllowed());
     }
 
+    public void testAreAllVerificationsComplete_timeoutSuccessWithSufficient() {
+        PackageVerificationState state = new PackageVerificationState(null);
+
+        state.addRequiredVerifierUid(REQUIRED_UID_1);
+        state.addSufficientVerifier(SUFFICIENT_UID_1);
+
+        assertFalse(state.areAllVerificationsComplete());
+        assertFalse(state.isVerificationComplete());
+        assertFalse(state.isInstallAllowed());
+
+        // Required verifier responded, but still waiting for sufficient.
+        state.setVerifierResponse(REQUIRED_UID_1, PackageManager.VERIFICATION_ALLOW);
+        assertFalse(state.isVerificationComplete());
+
+        // Timeout, verification complete and installation allowed.
+        state.setVerifierResponse(REQUIRED_UID_1,
+                PackageManager.VERIFICATION_ALLOW_WITHOUT_SUFFICIENT);
+        assertTrue(state.isVerificationComplete());
+        assertTrue(state.isInstallAllowed());
+    }
+
     public void testAreAllVerificationsComplete_onlyVerificationPasses() {
         PackageVerificationState state = new PackageVerificationState(null);
         state.addRequiredVerifierUid(REQUIRED_UID_1);