diff options
| author | Winson <chiuwinson@google.com> | 2020-04-23 10:45:55 -0700 |
|---|---|---|
| committer | Anis Assi <anisassi@google.com> | 2020-06-30 16:10:14 -0700 |
| commit | 2f0f72046970cfea594466aab506566aac672749 (patch) | |
| tree | c38c8e5b209cafd1acb91a985d851f5d2e86f427 | |
| parent | 166ad568aba9991e57ddbf86eb54dc4b5993c6c8 (diff) | |
| download | base-2f0f72046970cfea594466aab506566aac672749.tar.gz | |
DO NOT MERGE: Verify INSTALL_PACKAGES permissions when adding installer package
Without this check, any package can set the installer package of
another package whose installer has been removed or was never set.
This provides access to other privileged actions and is undesired.
Bug: 150857253
Test: manual verify with proof of concept in linked bug
Test: atest android.appsecurity.cts.PackageSetInstallerTest
Change-Id: I2159c357911ff39ffd819054b42f96ae86bc98bc
(cherry picked from commit 40ca8b51fa90457cc49b91eac00636d1626b3a1b)
| -rw-r--r-- | services/core/java/com/android/server/pm/PackageManagerService.java | 32 |
1 files changed, 19 insertions, 13 deletions
diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index 50b7888dd083..6e4bfec135b4 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -15877,20 +15877,26 @@ public class PackageManagerService extends IPackageManager.Stub // Verify: if target already has an installer package, it must // be signed with the same cert as the caller. - if (targetPackageSetting.installerPackageName != null) { - PackageSetting setting = mSettings.mPackages.get( - targetPackageSetting.installerPackageName); - // If the currently set package isn't valid, then it's always - // okay to change it. - if (setting != null) { - if (compareSignatures(callerSignature, - setting.signatures.mSignatures) - != PackageManager.SIGNATURE_MATCH) { - throw new SecurityException( - "Caller does not have same cert as old installer package " - + targetPackageSetting.installerPackageName); - } + String targetInstallerPackageName = + targetPackageSetting.installerPackageName; + PackageSetting targetInstallerPkgSetting = targetInstallerPackageName == null ? null : + mSettings.mPackages.get(targetInstallerPackageName); + + if (targetInstallerPkgSetting != null) { + if (compareSignatures(callerSignature, + targetInstallerPkgSetting.signatures.mSignatures) + != PackageManager.SIGNATURE_MATCH) { + throw new SecurityException( + "Caller does not have same cert as old installer package " + + targetInstallerPackageName); } + } else if (mContext.checkCallingOrSelfPermission(Manifest.permission.INSTALL_PACKAGES) + != PackageManager.PERMISSION_GRANTED) { + // This is probably an attempt to exploit vulnerability b/150857253 of taking + // privileged installer permissions when the installer has been uninstalled or + // was never set. + EventLog.writeEvent(0x534e4554, "150857253", callingUid, ""); + return; } // Okay! |