Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3693bf9d authored by Rhed Jao's avatar Rhed Jao Committed by Android (Google) Code Review
Browse files

Merge "Fix cross user package visibility leakage for PackageManager (4/n)"

parents c04612b5 338a2358

services/core/java/com/android/server/pm/ComputerEngine.java

+6 −6
Original line number Original line Diff line number Diff line
@@ -5244,10 +5244,11 @@ public class ComputerEngine implements Computer { 
        if (packageName == null || alias == null) {

        if (packageName == null || alias == null) {

            return null;

            return null;

        }

        }

        final int callingUid = Binder.getCallingUid();

        final int callingUserId = UserHandle.getUserId(callingUid);

        final AndroidPackage pkg = mPackages.get(packageName);

        final AndroidPackage pkg = mPackages.get(packageName);

        if (pkg == null

        if (pkg == null || shouldFilterApplicationIncludingUninstalled(

                || shouldFilterApplication(getPackageStateInternal(pkg.getPackageName()),

                getPackageStateInternal(pkg.getPackageName()), callingUid, callingUserId)) {

                Binder.getCallingUid(), UserHandle.getCallingUserId())) {

            Slog.w(TAG, "KeySet requested for unknown package: " + packageName);

            Slog.w(TAG, "KeySet requested for unknown package: " + packageName);

            throw new IllegalArgumentException("Unknown package: " + packageName);

            throw new IllegalArgumentException("Unknown package: " + packageName);

        }

        }
@@ -5264,9 +5265,8 @@ public class ComputerEngine implements Computer { 
        final int callingUid = Binder.getCallingUid();

        final int callingUid = Binder.getCallingUid();

        final int callingUserId = UserHandle.getUserId(callingUid);

        final int callingUserId = UserHandle.getUserId(callingUid);

        final AndroidPackage pkg = mPackages.get(packageName);

        final AndroidPackage pkg = mPackages.get(packageName);

        if (pkg == null

        if (pkg == null || shouldFilterApplicationIncludingUninstalled(

                || shouldFilterApplication(getPackageStateInternal(pkg.getPackageName()),

                getPackageStateInternal(pkg.getPackageName()), callingUid, callingUserId)) {

                callingUid, callingUserId)) {

            Slog.w(TAG, "KeySet requested for unknown package: " + packageName

            Slog.w(TAG, "KeySet requested for unknown package: " + packageName

                    + ", uid:" + callingUid);

                    + ", uid:" + callingUid);

            throw new IllegalArgumentException("Unknown package: " + packageName);

            throw new IllegalArgumentException("Unknown package: " + packageName);

services/tests/PackageManagerServiceTests/appenumeration/src/com/android/server/pm/test/appenumeration/CrossUserPackageVisibilityTests.java

+25 −0
Original line number Original line Diff line number Diff line
@@ -126,6 +126,31 @@ public class CrossUserPackageVisibilityTests { 
                        CROSS_USER_TEST_PACKAGE_NAME, keySet));

                        CROSS_USER_TEST_PACKAGE_NAME, keySet));

    }

    }





    @Test

    public void testGetSigningKeySet_cannotDetectCrossUserPkg() {

        final IllegalArgumentException e1 = assertThrows(IllegalArgumentException.class,

                () -> mIPackageManager.getSigningKeySet(CROSS_USER_TEST_PACKAGE_NAME));



        installPackageForUser(CROSS_USER_TEST_APK_FILE, mOtherUser);



        final IllegalArgumentException e2 = assertThrows(IllegalArgumentException.class,

                () -> mIPackageManager.getSigningKeySet(CROSS_USER_TEST_PACKAGE_NAME));

        assertThat(e1.getMessage()).isEqualTo(e2.getMessage());

    }



    @Test

    public void testGetKeySetByAlias_cannotDetectCrossUserPkg() {

        final String alias = CROSS_USER_TEST_PACKAGE_NAME + ".alias";

        final IllegalArgumentException e1 = assertThrows(IllegalArgumentException.class,

                () -> mIPackageManager.getKeySetByAlias(CROSS_USER_TEST_PACKAGE_NAME, alias));



        installPackageForUser(CROSS_USER_TEST_APK_FILE, mOtherUser);



        final IllegalArgumentException e2 = assertThrows(IllegalArgumentException.class,

                () -> mIPackageManager.getKeySetByAlias(CROSS_USER_TEST_PACKAGE_NAME, alias));

        assertThat(e1.getMessage()).isEqualTo(e2.getMessage());

    }



    private static void installPackageForUser(File apk, UserReference user) {

    private static void installPackageForUser(File apk, UserReference user) {

        assertThat(apk.exists()).isTrue();

        assertThat(apk.exists()).isTrue();

        final StringBuilder cmd = new StringBuilder("pm install --user ");

        final StringBuilder cmd = new StringBuilder("pm install --user ");