Commit ad9bbd8c authored Dec 09, 2020 by Patrick Baumann

Adds caller check to getAllPackages()

This change enforces that only system, root or shell may call
getAllPackages(), a hidden API that shares all package names regardless
of user, instant app or package visibility rules.

Bug: 174661955
Test: 'adb shell pm compile -a -m speed' doesn't fail with
      SecurityException
Change-Id: I86a03c46896f21cdbeeda2af150675fe77d61955

parent a397f028

services/core/java/com/android/server/pm/PackageManagerService.java

+1 −0

Original line number	Diff line number	Diff line
		@@ -8946,6 +8946,7 @@ public class PackageManagerService extends IPackageManager.Stub

		@Override
		public List<String> getAllPackages() {
		enforceSystemOrRootOrShell("getAllPackages is limited to privileged callers");
		final int callingUid = Binder.getCallingUid();
		final int callingUserId = UserHandle.getUserId(callingUid);
		synchronized (mLock) {