Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 338a2358 authored by Rhed Jao's avatar Rhed Jao
Browse files

Fix cross user package visibility leakage for PackageManager (4/n) 

APIs:
- IPackageManager#getSigningKeySet
- IPackageManager#getKeySetByAlias

Fix: 216115467
Fix: 216116017
Test: atest CrossUserPackageVisibilityTests
Change-Id: Iae69a7450bfb23a9e3f8baf6a461d2897249d8d4
parent dea5a7c8

services/core/java/com/android/server/pm/ComputerEngine.java

+6 −6
Original line number Diff line number Diff line
@@ -5244,10 +5244,11 @@ public class ComputerEngine implements Computer { 
        if (packageName == null || alias == null) {

            return null;

        }

        final int callingUid = Binder.getCallingUid();

        final int callingUserId = UserHandle.getUserId(callingUid);

        final AndroidPackage pkg = mPackages.get(packageName);

        if (pkg == null

                || shouldFilterApplication(getPackageStateInternal(pkg.getPackageName()),

                Binder.getCallingUid(), UserHandle.getCallingUserId())) {

        if (pkg == null || shouldFilterApplicationIncludingUninstalled(

                getPackageStateInternal(pkg.getPackageName()), callingUid, callingUserId)) {

            Slog.w(TAG, "KeySet requested for unknown package: " + packageName);

            throw new IllegalArgumentException("Unknown package: " + packageName);

        }
@@ -5264,9 +5265,8 @@ public class ComputerEngine implements Computer { 
        final int callingUid = Binder.getCallingUid();

        final int callingUserId = UserHandle.getUserId(callingUid);

        final AndroidPackage pkg = mPackages.get(packageName);

        if (pkg == null

                || shouldFilterApplication(getPackageStateInternal(pkg.getPackageName()),

                callingUid, callingUserId)) {

        if (pkg == null || shouldFilterApplicationIncludingUninstalled(

                getPackageStateInternal(pkg.getPackageName()), callingUid, callingUserId)) {

            Slog.w(TAG, "KeySet requested for unknown package: " + packageName

                    + ", uid:" + callingUid);

            throw new IllegalArgumentException("Unknown package: " + packageName);

services/tests/PackageManagerServiceTests/appenumeration/src/com/android/server/pm/test/appenumeration/CrossUserPackageVisibilityTests.java

+25 −0
Original line number Diff line number Diff line
@@ -126,6 +126,31 @@ public class CrossUserPackageVisibilityTests { 
                        CROSS_USER_TEST_PACKAGE_NAME, keySet));

    }



    @Test

    public void testGetSigningKeySet_cannotDetectCrossUserPkg() {

        final IllegalArgumentException e1 = assertThrows(IllegalArgumentException.class,

                () -> mIPackageManager.getSigningKeySet(CROSS_USER_TEST_PACKAGE_NAME));



        installPackageForUser(CROSS_USER_TEST_APK_FILE, mOtherUser);



        final IllegalArgumentException e2 = assertThrows(IllegalArgumentException.class,

                () -> mIPackageManager.getSigningKeySet(CROSS_USER_TEST_PACKAGE_NAME));

        assertThat(e1.getMessage()).isEqualTo(e2.getMessage());

    }



    @Test

    public void testGetKeySetByAlias_cannotDetectCrossUserPkg() {

        final String alias = CROSS_USER_TEST_PACKAGE_NAME + ".alias";

        final IllegalArgumentException e1 = assertThrows(IllegalArgumentException.class,

                () -> mIPackageManager.getKeySetByAlias(CROSS_USER_TEST_PACKAGE_NAME, alias));



        installPackageForUser(CROSS_USER_TEST_APK_FILE, mOtherUser);



        final IllegalArgumentException e2 = assertThrows(IllegalArgumentException.class,

                () -> mIPackageManager.getKeySetByAlias(CROSS_USER_TEST_PACKAGE_NAME, alias));

        assertThat(e1.getMessage()).isEqualTo(e2.getMessage());

    }



    private static void installPackageForUser(File apk, UserReference user) {

        assertThat(apk.exists()).isTrue();

        final StringBuilder cmd = new StringBuilder("pm install --user ");