From fa42461aa1077fc4c594e51515c14c31e29121f7 Mon Sep 17 00:00:00 2001
From: Nikita Ioffe <ioffe@google.com>
Date: Fri, 4 Jun 2021 19:22:30 +0100
Subject: [PATCH] Check that only allowed installers can perform a non-staged
 APEX update

Test: atest CtsStagedInstallHostTestCases
Test: atest GtsStagedInstallHostTestCases
Bug: 187864524
Bug: 189274479
Change-Id: Iab8bcc3892577582e9a50964ef87b89f575e5983
---
 .../android/server/pm/PackageInstallerService.java  | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/services/core/java/com/android/server/pm/PackageInstallerService.java b/services/core/java/com/android/server/pm/PackageInstallerService.java
index 1f0a8caa0ccfa..0b63b7ddef851 100644
--- a/services/core/java/com/android/server/pm/PackageInstallerService.java
+++ b/services/core/java/com/android/server/pm/PackageInstallerService.java
@@ -653,13 +653,20 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements
         }
 
         if (params.isStaged && !isCalledBySystemOrShell(callingUid)) {
-            if (mBypassNextStagedInstallerCheck) {
-                mBypassNextStagedInstallerCheck = false;
-            } else if (!isStagedInstallerAllowed(requestedInstallerPackageName)) {
+            if (!mBypassNextStagedInstallerCheck
+                    && !isStagedInstallerAllowed(requestedInstallerPackageName)) {
                 throw new SecurityException("Installer not allowed to commit staged install");
             }
         }
+        if (isApex && !isCalledBySystemOrShell(callingUid)) {
+            if (!mBypassNextStagedInstallerCheck
+                    && !isStagedInstallerAllowed(requestedInstallerPackageName)) {
+                throw new SecurityException(
+                        "Installer not allowed to commit non-staged APEX install");
+            }
+        }
 
+        mBypassNextStagedInstallerCheck = false;
         if (!params.isMultiPackage) {
             // Only system components can circumvent runtime permissions when installing.
             if ((params.installFlags & PackageManager.INSTALL_GRANT_RUNTIME_PERMISSIONS) != 0