Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 06ca1e08 authored by Chad Brubaker's avatar Chad Brubaker
Browse files

Allow Instant Apps access PackageInfo of exposed apps 

Instant Apps can only see apps that explicitly expose a component via
android:visibleToInstantApp.

Bug: 34087569
Test: cts-tradefed run commandAndExit cts-dev -m
CtsAppSecurityHostTestCases -t android.appsecurity.cts.EphemeralTest
Change-Id: Ibcba43597f545966abc883e90008369fb20d61ae
parent 2257285a

core/java/android/content/pm/PackageParser.java

+8 −0
Original line number Diff line number Diff line
@@ -4211,6 +4211,7 @@ public class PackageParser { 
                sa.getBoolean(R.styleable.AndroidManifestActivity_visibleToInstantApps, false);

        if (visibleToEphemeral) {

            a.info.flags |= ActivityInfo.FLAG_VISIBLE_TO_EPHEMERAL;

            owner.visibleToInstantApps = true;

        }



        sa.recycle();
@@ -4716,6 +4717,7 @@ public class PackageParser { 
                sa.getBoolean(R.styleable.AndroidManifestProvider_visibleToInstantApps, false);

        if (visibleToEphemeral) {

            p.info.flags |= ProviderInfo.FLAG_VISIBLE_TO_EPHEMERAL;

            owner.visibleToInstantApps = true;

        }



        sa.recycle();
@@ -5032,6 +5034,7 @@ public class PackageParser { 
                sa.getBoolean(R.styleable.AndroidManifestService_visibleToInstantApps, false);

        if (visibleToEphemeral) {

            s.info.flags |= ServiceInfo.FLAG_VISIBLE_TO_EPHEMERAL;

            owner.visibleToInstantApps = true;

        }



        sa.recycle();
@@ -5635,6 +5638,11 @@ public class PackageParser { 


        public byte[] restrictUpdateHash;



        /**

         * Set if the app or any of its components are visible to Instant Apps.

         */

        public boolean visibleToInstantApps;



        public Package(String packageName) {

            this.packageName = packageName;

            this.manifestPackageName = packageName;

services/core/java/com/android/server/pm/PackageManagerService.java

+5 −3
Original line number Diff line number Diff line
@@ -3348,7 +3348,7 @@ public class PackageManagerService extends IPackageManager.Stub { 
        //   * The system/shell/root can see metadata for any app

        //   * An installed app can see metadata for 1) other installed apps

        //     and 2) ephemeral apps that have explicitly interacted with it

        //   * Ephemeral apps can only see their own metadata

        //   * Ephemeral apps can only see their own data and exposed installed apps

        //   * Holding a signature permission allows seeing instant apps

        final int callingAppId = UserHandle.getAppId(Binder.getCallingUid());

        if (callingAppId != Process.SYSTEM_UID
@@ -3358,8 +3358,10 @@ public class PackageManagerService extends IPackageManager.Stub { 
                        Binder.getCallingUid()) != PackageManager.PERMISSION_GRANTED) {

            final String instantAppPackageName = getInstantAppPackageName(Binder.getCallingUid());

            if (instantAppPackageName != null) {

                // ephemeral apps can only get information on themselves

                if (!instantAppPackageName.equals(p.packageName)) {

                // ephemeral apps can only get information on themselves or

                // installed apps that are exposed.

                if (!instantAppPackageName.equals(p.packageName)

                        && (ps.getInstantApp(userId) || !p.visibleToInstantApps)) {

                    return null;

                }

            } else {