From f61ae2de25a2dd09024bf5a8462b4408203c928b Mon Sep 17 00:00:00 2001
From: dcashman <dcashman@google.com>
Date: Mon, 8 Jun 2015 10:53:20 -0700
Subject: [PATCH] Add SYSTEM_DIR check to upgrade-key-set verification.

Bug: 21697139
Change-Id: I7e6ce3d7f231e0ca5da1f501c80342a04f6c2a1e
---
 .../android/server/pm/PackageManagerService.java    | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index e370afc6844a5..d2377a8367603 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -6166,9 +6166,16 @@ public class PackageManagerService extends IPackageManager.Stub {
                 }
             } else {
                 if (!checkUpgradeKeySetLP(pkgSetting, pkg)) {
-                    throw new PackageManagerException(INSTALL_FAILED_UPDATE_INCOMPATIBLE, "Package "
-                            + pkg.packageName + " upgrade keys do not match the "
-                            + "previously installed version");
+                    if ((parseFlags & PackageParser.PARSE_IS_SYSTEM_DIR) == 0) {
+                        throw new PackageManagerException(INSTALL_FAILED_UPDATE_INCOMPATIBLE,
+                                "Package " + pkg.packageName + " upgrade keys do not match the "
+                                + "previously installed version");
+                    } else {
+                        pkgSetting.signatures.mSignatures = pkg.mSignatures;
+                        String msg = "System package " + pkg.packageName
+                            + " signature changed; retaining data.";
+                        reportSettingsProblem(Log.WARN, msg);
+                    }
                 } else {
                     // We just determined the app is signed correctly, so bring
                     // over the latest parsed certs.