Merge "Don't allow shell to spoof initiating package name." into rvc-dev (717f3d84) · Commits · e / os / android_frameworks_base

services/core/java/com/android/server/pm/PackageInstallerService.java

+3 −1

Original line number	Diff line number	Diff line
		@@ -522,7 +522,9 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements

		if ((callingUid == Process.SHELL_UID) \|\| (callingUid == Process.ROOT_UID)) {
		params.installFlags \|= PackageManager.INSTALL_FROM_ADB;

		// adb installs can override the installingPackageName, but not the
		// initiatingPackageName
		installerPackageName = null;
		} else {
		if (callingUid != Process.SYSTEM_UID) {
		// The supplied installerPackageName must always belong to the calling app.