diff options
| author | Todd Kennedy <toddke@google.com> | 2018-05-29 15:18:06 -0700 |
|---|---|---|
| committer | Todd Kennedy <toddke@google.com> | 2018-05-30 13:56:17 -0700 |
| commit | ef9acb6ed97ececa4c8554adb693ec948a963db1 (patch) | |
| tree | 88965c52e964c34056ba99735d7f2a66577c45fc /core/java/android | |
| parent | e3348a25935099838a917cf4556c4dccc714e0ef (diff) | |
Ensure permission held for MATCH_KNOWN_PACKAGES
There's an escape clause that passes the cross user permissions
if the caller UID is identical to the target user ID [eg. we're not
operating across users]. However, the method getInstalledPackagesList()
uses android.permission.INTERACT_ACROSS_USERS to filter the results and
a calling UID check is not sufficient. Ensuure the permission is
actually held, regardless of the calling UID or target user.
Change-Id: Iebf88668766d387a15246d6eea6420610665105a
Fixes: 80435086
Test: atest CtsAppSecurityHostTestCases:ApplicationVisibilityTest
Diffstat (limited to 'core/java/android')
| -rw-r--r-- | core/java/android/content/pm/PackageManager.java | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/core/java/android/content/pm/PackageManager.java b/core/java/android/content/pm/PackageManager.java index 63de8bf49f8b..3f9798b7d6c9 100644 --- a/core/java/android/content/pm/PackageManager.java +++ b/core/java/android/content/pm/PackageManager.java @@ -461,6 +461,7 @@ public abstract class PackageManager { * package. * @hide */ + @TestApi public static final int MATCH_KNOWN_PACKAGES = MATCH_UNINSTALLED_PACKAGES | MATCH_ANY_USER; /** @@ -3420,6 +3421,7 @@ public abstract class PackageManager { * deleted with {@code DONT_DELETE_DATA} flag set). * @hide */ + @TestApi @SystemApi @RequiresPermission(android.Manifest.permission.INTERACT_ACROSS_USERS_FULL) public abstract List<PackageInfo> getInstalledPackagesAsUser(@PackageInfoFlags int flags, |