Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

DO NOT MERGE: Verify INSTALL_PACKAGES permissions when adding installer package

Browse Source 
Without this check, any package can set the installer package of
another package whose installer has been removed or was never set.
This provides access to other privileged actions and is undesired.

Bug: 150857253

Test: manual verify with proof of concept in linked bug
Test: atest android.appsecurity.cts.PackageSetInstallerTest

Change-Id: I2159c357911ff39ffd819054b42f96ae86bc98bc
This commit is contained in:
Winson
2020-04-23 10:45:55 -07:00
committed by Winson Chiu
parent 0d01b03776
commit fc8bfed553
1 changed files with 19 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
services/core/java/com/android/server/pm/PackageManagerService.java
View File

@@ -15317,20 +15317,26 @@ public class PackageManagerService extends IPackageManager.Stub
// Verify: if target already has an installer package, it must // Verify: if target already has an installer package, it must
// be signed with the same cert as the caller. // be signed with the same cert as the caller.
if (targetPackageSetting.installerPackageName != null) { String targetInstallerPackageName =
PackageSetting setting = mSettings.mPackages.get( targetPackageSetting.installerPackageName;
targetPackageSetting.installerPackageName); PackageSetting targetInstallerPkgSetting = targetInstallerPackageName == null ? null :
// If the currently set package isn't valid, then it's always mSettings.mPackages.get(targetInstallerPackageName);
// okay to change it.
if (setting != null) { if (targetInstallerPkgSetting != null) {
if (compareSignatures(callerSignature, if (compareSignatures(callerSignature,
setting.signatures.mSignatures) targetInstallerPkgSetting.signatures.mSignatures)
!= PackageManager.SIGNATURE_MATCH) { != PackageManager.SIGNATURE_MATCH) {
throw new SecurityException( throw new SecurityException(
"Caller does not have same cert as old installer package " "Caller does not have same cert as old installer package "
+ targetPackageSetting.installerPackageName); + targetInstallerPackageName);
}
} }
} else if (mContext.checkCallingOrSelfPermission(Manifest.permission.INSTALL_PACKAGES)
!= PackageManager.PERMISSION_GRANTED) {
// This is probably an attempt to exploit vulnerability b/150857253 of taking
// privileged installer permissions when the installer has been uninstalled or
// was never set.
EventLog.writeEvent(0x534e4554, "150857253", callingUid, "");
return;
} }
// Okay! // Okay!