From d9a3cf013c6b3bebf2eb8e832bdda4585ceeb2e4 Mon Sep 17 00:00:00 2001
From: Jerry Chang <chenghsiuchang@google.com>
Date: Tue, 21 Apr 2020 23:25:16 +0800
Subject: [PATCH] Limit bypass staged installer API to system and shell only

Bug: 148664742
Test: manually check access the api inproperly throws
Change-Id: I568b9df87d30c8da6dd85f0310bf7af1d60b4ea3
---
 .../java/com/android/server/pm/PackageInstallerService.java    | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/services/core/java/com/android/server/pm/PackageInstallerService.java b/services/core/java/com/android/server/pm/PackageInstallerService.java
index 4cfd1ab73c9ea..3367cd556b2b8 100644
--- a/services/core/java/com/android/server/pm/PackageInstallerService.java
+++ b/services/core/java/com/android/server/pm/PackageInstallerService.java
@@ -979,6 +979,9 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements
 
     @Override
     public void bypassNextStagedInstallerCheck(boolean value) {
+        if (!isCalledBySystemOrShell(Binder.getCallingUid())) {
+            throw new SecurityException("Caller not allowed to bypass staged installer check");
+        }
         mBypassNextStagedInstallerCheck = value;
     }