diff options
| author | Todd Kennedy <toddke@google.com> | 2017-10-25 10:11:09 -0700 |
|---|---|---|
| committer | android-build-team Robot <android-build-team-robot@google.com> | 2017-10-27 14:46:41 +0000 |
| commit | a36fe421702f1bf1abc7dfa5a9b9a897d47f15ef (patch) | |
| tree | a07c3e18b068e83ec4fab98cd78eebe4af71c5ed | |
| parent | b9474a64b317d4fb36a6fa78f96137cc68db1a96 (diff) | |
| download | base-a36fe421702f1bf1abc7dfa5a9b9a897d47f15ef.tar.gz | |
Allow internal services access to instant apps
Any system UID [those with a UID < Process.FIRST_APPLICATION_UID] should be
able to see instant applications. These are trusted processes and will often
need to verify permissions of the calling instant app.
Change-Id: I4ec899ffd45d931a17d4ea0bfacf3004d3e074ef
Fixes: 67849834
Test: Manual.
Test: Install hellozip_base.apk from bug:
Test: $ adb install --instantapp -i com.android.vending hellozip_base.apk
Test: Run hellozip
Test: $ adb shell am start -a android.intent.action.VIEW -c android.intent.category.BROWSABLE -d https://hello.samples.androidinstantapps.com/hello
Test: Try to capture a photo and see that the app crashes with a SecurityException before the patch and that a photo is taken after the patch
Test: Try to record audio and see that the app crashes with an IllegalStateException before the patch and that the app doesn't crash after the patch
(cherry picked from commit 17e40d2fb6d5ad2be3b71d3bc1232ea84f6596b6)
| -rw-r--r-- | services/core/java/com/android/server/pm/PackageManagerService.java | 11 |
1 files changed, 4 insertions, 7 deletions
diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index 0d3925c19b45..06600bf75ffa 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -3794,19 +3794,16 @@ public class PackageManagerService extends IPackageManager.Stub * <p> * Currently, there are three cases in which this can occur: * <ol> - * <li>The calling application is a "special" process. The special - * processes are {@link Process#SYSTEM_UID}, {@link Process#SHELL_UID} - * and {@code 0}</li> + * <li>The calling application is a "special" process. Special processes + * are those with a UID < {@link Process#FIRST_APPLICATION_UID}.</li> * <li>The calling application has the permission - * {@link android.Manifest.permission#ACCESS_INSTANT_APPS}</li> + * {@link android.Manifest.permission#ACCESS_INSTANT_APPS}.</li> * <li>The calling application is the default launcher on the * system partition.</li> * </ol> */ private boolean canViewInstantApps(int callingUid, int userId) { - if (callingUid == Process.SYSTEM_UID - || callingUid == Process.SHELL_UID - || callingUid == Process.ROOT_UID) { + if (callingUid < Process.FIRST_APPLICATION_UID) { return true; } if (mContext.checkCallingOrSelfPermission( |