Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a3efd474 authored by Sumedh Sen's avatar Sumedh Sen
Browse files

Prevent apps from querying other apps without permission 

- Apps could query for other apps installed on the device without having adequate visibility.
- The PackageInstallerActivity checked the existence of the requested package on behalf of the calling package without ensuring has latter the required visibility.
- PackageInstallerActivity now checks if the calling package has the required visibility permissions to query about the requested package, across all users on the device.

Fixes: b/197327805
Bug: b/197327805
Change-Id: I703ce4e87c63fcca49c1583ecb3680868b77239a
Test: atest CtsPackageSchemeTestsWithVisibility CtsPackageSchemeTestsWithoutVisibility
parent 355d1e74

packages/PackageInstaller/src/com/android/packageinstaller/PackageInstallerActivity.java

+15 −7
Original line number Diff line number Diff line
@@ -41,6 +41,7 @@ import android.content.pm.PackageInfo; 
import android.content.pm.PackageInstaller;

import android.content.pm.PackageManager;

import android.content.pm.PackageManager.NameNotFoundException;

import android.content.pm.UserInfo;

import android.net.Uri;

import android.os.Bundle;

import android.os.Process;
@@ -546,20 +547,27 @@ public class PackageInstallerActivity extends AlertActivity { 
     */

    private boolean processPackageUri(final Uri packageUri) {

        mPackageURI = packageUri;



        final String scheme = packageUri.getScheme();

        final String packageName = packageUri.getSchemeSpecificPart();



        if (mLocalLOGV) Log.i(TAG, "processPackageUri(): uri=" + packageUri + ", scheme=" + scheme);



        switch (scheme) {

            case SCHEME_PACKAGE: {

                for (UserInfo info : mUserManager.getUsers()) {

                    PackageManager pmForUser = createContextAsUser(info.getUserHandle(), 0)

                                                .getPackageManager();

                    try {

                    mPkgInfo = mPm.getPackageInfo(packageUri.getSchemeSpecificPart(),

                        if (pmForUser.canPackageQuery(mCallingPackage, packageName)) {

                            mPkgInfo = pmForUser.getPackageInfo(packageName,

                                    PackageManager.GET_PERMISSIONS

                                            | PackageManager.MATCH_UNINSTALLED_PACKAGES);

                        }

                    } catch (NameNotFoundException e) {

                    }

                }

                if (mPkgInfo == null) {

                    Log.w(TAG, "Requested package " + packageUri.getScheme()

                    Log.w(TAG, "Requested package " + packageUri.getSchemeSpecificPart()

                            + " not available. Discontinuing installation");

                    showDialogInner(DLG_PACKAGE_ERROR);

                    setPmResult(PackageManager.INSTALL_FAILED_INVALID_APK);