commit ad32ba97ad1f4448409225fe717b871d3b9a5d7f
author Mårten Kongstad <marten.kongstad@sony.com> Tue Mar 26 16:05:23 2019 +0100
committer Todd Kennedy <toddke@google.com> Tue Apr 02 11:35:38 2019 -0700
tree 3f6a207b1e10dddc1ec850e6115f8ab692cd3d13
parent a50bed00f39325a2e2cca689939abdc5cfb611d1

OMS: ignore instant apps

Harden security by teaching the OMS to ignore instant apps, be they
target or overlays. This means that instant apps cannot be targeted by
overlays (except indirectly by overlaying the framework) and that
instant apps cannot act as overlays.

Bug: 128931092
Test: atest OverlayHostTests
Change-Id: Id86e287f5ccc83ba40895bcfc1c60536894f8dfb

services/core/java/com/android/server/om/OverlayManagerService.java

diff --git a/services/core/java/com/android/server/om/OverlayManagerService.java b/services/core/java/com/android/server/om/OverlayManagerService.java
index 13ff873..54bd9cb 100644
--- a/services/core/java/com/android/server/om/OverlayManagerService.java
+++ b/services/core/java/com/android/server/om/OverlayManagerService.java
@@ -374,7 +374,7 @@
                     synchronized (mLock) {
                         final PackageInfo pi = mPackageManager.getPackageInfo(packageName, userId,
                                 false);
-                        if (pi != null) {
+                        if (pi != null && !pi.applicationInfo.isInstantApp()) {
                             mPackageManager.cachePackageInfo(packageName, userId, pi);
                             if (pi.isOverlayPackage()) {
                                 mImpl.onOverlayPackageAdded(packageName, userId);
@@ -397,7 +397,7 @@
                     synchronized (mLock) {
                         final PackageInfo pi = mPackageManager.getPackageInfo(packageName, userId,
                                 false);
-                        if (pi != null) {
+                        if (pi != null && pi.applicationInfo.isInstantApp()) {
                             mPackageManager.cachePackageInfo(packageName, userId, pi);
                             if (pi.isOverlayPackage()) {
                                 mImpl.onOverlayPackageChanged(packageName, userId);
@@ -438,7 +438,7 @@
                     synchronized (mLock) {
                         final PackageInfo pi = mPackageManager.getPackageInfo(packageName, userId,
                                 false);
-                        if (pi != null) {
+                        if (pi != null && !pi.applicationInfo.isInstantApp()) {
                             mPackageManager.cachePackageInfo(packageName, userId, pi);
                             if (pi.isOverlayPackage()) {
                                 mImpl.onOverlayPackageUpgraded(packageName, userId);