Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d3e3e87b authored by Winson Chiu's avatar Winson Chiu Committed by Automerger Merge Worker
Browse files

Merge "Verify INSTALL_PACKAGES permissions when adding installer package" into... 

Merge "Verify INSTALL_PACKAGES permissions when adding installer package" into rvc-dev am: 4ea77cc0 am: 732fcc5d am: e92baaaf am: e082c7cf

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/11367087

Change-Id: I788bef093cb341b311df2b30de742226221ceda7
parents 9efe8739 e082c7cf

services/core/java/com/android/server/pm/PackageManagerService.java

+46 −12
Original line number Diff line number Diff line
@@ -148,6 +148,8 @@ import android.app.ResourcesManager; 
import android.app.admin.IDevicePolicyManager;

import android.app.admin.SecurityLog;

import android.app.backup.IBackupManager;

import android.compat.annotation.ChangeId;

import android.compat.annotation.EnabledAfter;

import android.content.BroadcastReceiver;

import android.content.ComponentName;

import android.content.ContentResolver;
@@ -639,6 +641,19 @@ public class PackageManagerService extends IPackageManager.Stub 
     */

    private static final int DEFAULT_VERIFICATION_RESPONSE = PackageManager.VERIFICATION_ALLOW;













    /**













     * Adding an installer package name to a package that does not have one set requires the













     * INSTALL_PACKAGES permission.













     *













     * If the caller targets R, this will throw a SecurityException. Otherwise the request will













     * fail silently. In both cases, and regardless of whether this change is enabled, the













     * installer package will remain unchanged.













     */













    @ChangeId













    @EnabledAfter(targetSdkVersion = Build.VERSION_CODES.Q)













    private static final long THROW_EXCEPTION_ON_REQUIRE_INSTALL_PACKAGES_TO_ADD_INSTALLER_PACKAGE =













            150857253;



























    public static final String PLATFORM_PACKAGE_NAME = "android";





























    private static final String PACKAGE_MIME_TYPE = "application/vnd.android.package-archive";










@@ -14172,19 +14187,38 @@ public class PackageManagerService extends IPackageManager.Stub













            // be signed with the same cert as the caller.















            String targetInstallerPackageName =















                    targetPackageSetting.installSource.installerPackageName;













            if (targetInstallerPackageName != null) {













                PackageSetting setting = mSettings.mPackages.get(













                        targetInstallerPackageName);













                // If the currently set package isn't valid, then it's always













                // okay to change it.













                if (setting != null) {













            PackageSetting targetInstallerPkgSetting = targetInstallerPackageName == null ? null :













                    mSettings.mPackages.get(targetInstallerPackageName);

























            if (targetInstallerPkgSetting != null) {















                if (compareSignatures(callerSignature,













                            setting.signatures.mSigningDetails.signatures)













                        targetInstallerPkgSetting.signatures.mSigningDetails.signatures)















                        != PackageManager.SIGNATURE_MATCH) {















                    throw new SecurityException(















                            "Caller does not have same cert as old installer package "















                            + targetInstallerPackageName);















                }













            } else if (mContext.checkCallingOrSelfPermission(Manifest.permission.INSTALL_PACKAGES)













                    != PackageManager.PERMISSION_GRANTED) {













                // This is probably an attempt to exploit vulnerability b/150857253 of taking













                // privileged installer permissions when the installer has been uninstalled or













                // was never set.













                EventLog.writeEvent(0x534e4554, "150857253", callingUid, "");

























                long binderToken = Binder.clearCallingIdentity();













                try {













                    if (mInjector.getCompatibility().isChangeEnabledByUid(













                            THROW_EXCEPTION_ON_REQUIRE_INSTALL_PACKAGES_TO_ADD_INSTALLER_PACKAGE,













                            callingUid)) {













                        throw new SecurityException("Neither user " + callingUid













                                + " nor current process has "













                                + Manifest.permission.INSTALL_PACKAGES);













                    } else {













                        // If change disabled, fail silently for backwards compatibility













                        return;













                    }













                } finally {













                    Binder.restoreCallingIdentity(binderToken);















                }















            }