Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0806568d authored by Winson's avatar Winson Committed by Winson Chiu
Browse files

Unexport all PackageInstaller receivers 

All of PackageInstaller's declared receivers receive system broadcasts,
so they do not need to be exported. Leaving them exported opens up
vulnerabilities for apps to launch them and execute functionality that
PackageInstaller includes.

Bug: 191283525

Test: manual, verify receivers still work
Test: atest com.android.packageinstaller.test.ExportedComponentTest

Change-Id: I782fc21c848831a2a4aeab736cd47ad45781b290
parent 659cfbeb

packages/PackageInstaller/AndroidManifest.xml

+4 −4
Original line number Diff line number Diff line
@@ -31,7 +31,7 @@ 
            android:directBootAware="true">



        <receiver android:name=".TemporaryFileManager"

            android:exported="true">

            android:exported="false">

            <intent-filter>

                <action android:name="android.intent.action.BOOT_COMPLETED" />

            </intent-filter>
@@ -76,7 +76,7 @@ 


        <receiver android:name=".InstallEventReceiver"

                android:permission="android.permission.INSTALL_PACKAGES"

                android:exported="true">

                android:exported="false">

            <intent-filter android:priority="1">

                <action android:name="com.android.packageinstaller.ACTION_INSTALL_COMMIT" />

            </intent-filter>
@@ -106,14 +106,14 @@ 


        <receiver android:name=".UninstallEventReceiver"

            android:permission="android.permission.INSTALL_PACKAGES"

            android:exported="true">

            android:exported="false">

            <intent-filter android:priority="1">

                <action android:name="com.android.packageinstaller.ACTION_UNINSTALL_COMMIT" />

            </intent-filter>

        </receiver>



        <receiver android:name=".PackageInstalledReceiver"

                android:exported="true">

                android:exported="false">

            <intent-filter android:priority="1">

                <action android:name="android.intent.action.PACKAGE_ADDED" />

                <data android:scheme="package" />

packages/PackageInstaller/TEST_MAPPING

+4 −1
Original line number Diff line number Diff line
@@ -19,6 +19,9 @@ 
    },

    {

      "name": "CtsPackageUninstallTestCases"

    },

    {

      "name": "PackageInstallerTests"

    }

  ]

}

services/tests/PackageManager/packageinstaller/Android.bp

0 → 100644
+39 −0
Original line number Diff line number Diff line 
// Copyright (C) 2021 The Android Open Source Project

//

// Licensed under the Apache License, Version 2.0 (the "License");

// you may not use this file except in compliance with the License.

// You may obtain a copy of the License at

//

//      http://www.apache.org/licenses/LICENSE-2.0

//

// Unless required by applicable law or agreed to in writing, software

// distributed under the License is distributed on an "AS IS" BASIS,

// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

// See the License for the specific language governing permissions and

// limitations under the License.



package {

    // See: http://go/android-license-faq

    // A large-scale-change added 'default_applicable_licenses' to import

    // all of the 'license_kinds' from "frameworks_base_license"

    // to get the below license kinds:

    //   SPDX-license-identifier-Apache-2.0

    default_applicable_licenses: ["frameworks_base_license"],

}



android_test {

    name: "PackageInstallerTests",

    srcs: [

        "src/**/*.java",

        "src/**/*.kt",

    ],

    static_libs: [

        "androidx.test.rules",

        "androidx.test.runner",

        "junit",

        "kotlin-test",

        "truth-prebuilt",

    ],

    platform_apis: true,

    test_suites: ["device-tests"],

}

services/tests/PackageManager/packageinstaller/AndroidManifest.xml

0 → 100644
+29 −0
Original line number Diff line number Diff line 
<?xml version="1.0" encoding="utf-8"?>

<!--

  ~ Copyright (C) 2021 The Android Open Source Project

  ~

  ~ Licensed under the Apache License, Version 2.0 (the "License");

  ~ you may not use this file except in compliance with the License.

  ~ You may obtain a copy of the License at

  ~

  ~      http://www.apache.org/licenses/LICENSE-2.0

  ~

  ~ Unless required by applicable law or agreed to in writing, software

  ~ distributed under the License is distributed on an "AS IS" BASIS,

  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

  ~ See the License for the specific language governing permissions and

  ~ limitations under the License.

  -->



<manifest xmlns:android="http://schemas.android.com/apk/res/android"

    package="com.android.packageinstaller.test">



    <uses-permission android:name="android.permission.QUERY_ALL_PACKAGES"/>



    <instrumentation

        android:name="androidx.test.runner.AndroidJUnitRunner"

        android:targetPackage="com.android.packageinstaller.test"

        />



</manifest>

services/tests/PackageManager/packageinstaller/AndroidTest.xml

0 → 100644
+29 −0
Original line number Diff line number Diff line 
<?xml version="1.0" encoding="utf-8"?>

<!--

  ~ Copyright (C) 2021 The Android Open Source Project

  ~

  ~ Licensed under the Apache License, Version 2.0 (the "License");

  ~ you may not use this file except in compliance with the License.

  ~ You may obtain a copy of the License at

  ~

  ~      http://www.apache.org/licenses/LICENSE-2.0

  ~

  ~ Unless required by applicable law or agreed to in writing, software

  ~ distributed under the License is distributed on an "AS IS" BASIS,

  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

  ~ See the License for the specific language governing permissions and

  ~ limitations under the License.

  -->



<configuration description="Test module config for PackageInstallerTests">

    <option name="test-tag" value="PackageInstallerTests" />



    <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">

        <option name="cleanup-apks" value="true" />

        <option name="test-file-name" value="PackageInstallerTests.apk" />

    </target_preparer>



    <test class="com.android.tradefed.testtype.AndroidJUnitTest">

        <option name="package" value="com.android.packageinstaller.test" />

    </test>

</configuration>