From 44a4529285f514c7cdbe0777004e853503399c35 Mon Sep 17 00:00:00 2001
From: Jackal Guo <jackalguo@google.com>
Date: Thu, 10 Jun 2021 15:33:59 +0800
Subject: [PATCH] Enforce the permission and the owner rights earlier

Move the check to the early section of the method to secure the
validity.

Bug: 188219307
Test: atest PackageManagerServiceHibernationTests
Test: atest -p services/core/java/com/android/server/am
Test: atest -p services/core/java/com/android/server/pm
Test: manually using the PoC in the buganizer to ensure the symptom
      no longer exists.
Change-Id: I49c456da65cb2befbf5c435e5febcdd9434be684
---
 .../com/android/server/pm/PackageManagerService.java   | 10 ++++++++--
 services/core/java/com/android/server/pm/Settings.java |  9 +--------
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index c812fc8b70813..67d10afe4100d 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -23984,6 +23984,13 @@ public class PackageManagerService extends IPackageManager.Stub
         final int permission = mContext.checkCallingOrSelfPermission(
                 android.Manifest.permission.CHANGE_COMPONENT_ENABLED_STATE);
         final boolean allowedByPermission = (permission == PackageManager.PERMISSION_GRANTED);
+        if (!allowedByPermission
+                && !ArrayUtils.contains(getPackagesForUid(callingUid), packageName)) {
+            throw new SecurityException(
+                    "Permission Denial: attempt to change stopped state from pid="
+                            + Binder.getCallingPid()
+                            + ", uid=" + callingUid + ", package=" + packageName);
+        }
         enforceCrossUserPermission(callingUid, userId, true /* requireFullPermission */,
                 true /* checkShell */, "stop package");
         boolean shouldUnhibernate = false;
@@ -23994,8 +24001,7 @@ public class PackageManagerService extends IPackageManager.Stub
                 shouldUnhibernate = true;
             }
             if (!shouldFilterApplicationLocked(ps, callingUid, userId)
-                    && mSettings.setPackageStoppedStateLPw(this, packageName, stopped,
-                            allowedByPermission, callingUid, userId)) {
+                    && mSettings.setPackageStoppedStateLPw(this, packageName, stopped, userId)) {
                 scheduleWritePackageRestrictionsLocked(userId);
             }
         }
diff --git a/services/core/java/com/android/server/pm/Settings.java b/services/core/java/com/android/server/pm/Settings.java
index 4bc87a273084e..41a4fe1b4db03 100644
--- a/services/core/java/com/android/server/pm/Settings.java
+++ b/services/core/java/com/android/server/pm/Settings.java
@@ -4185,18 +4185,11 @@ public final class Settings implements Watchable, Snappable {
     }
 
     boolean setPackageStoppedStateLPw(PackageManagerService pm, String packageName,
-            boolean stopped, boolean allowedByPermission, int uid, int userId) {
-        int appId = UserHandle.getAppId(uid);
+            boolean stopped, int userId) {
         final PackageSetting pkgSetting = mPackages.get(packageName);
         if (pkgSetting == null) {
             throw new IllegalArgumentException("Unknown package: " + packageName);
         }
-        if (!allowedByPermission && (appId != pkgSetting.appId)) {
-            throw new SecurityException(
-                    "Permission Denial: attempt to change stopped state from pid="
-                    + Binder.getCallingPid()
-                    + ", uid=" + uid + ", package uid=" + pkgSetting.appId);
-        }
         if (DEBUG_STOPPED) {
             if (stopped) {
                 RuntimeException e = new RuntimeException("here");