commit c7df7d7dcb1059dd3ca8a30616076e5cd1fc1405
author Todd Kennedy <toddke@google.com> Fri Jul 28 07:31:51 2017 -0700
committer Todd Kennedy <toddke@google.com> Fri Jul 28 07:31:51 2017 -0700
tree c975040ac21d11e5298aa11efe3c561cb4b45b55
parent b3d487da64b143d00755404663a3e2a645954721

Allow the launcher to get all instant apps

Change-Id: Ie0381d01fe8cd5293a0a3671c1bdf497ca5c5783
Fixes: 63814920
Test: Manual
Test: Make and install a launcher that calls the protected APIs
Test: Run launcher, see that it gets a security exception
Test: Make the launcher the default, see that it gets a security exception
Test: Install the launcher as a system app
Test: Run the launcher, see that it gets a security exception
Test: Make the launcher the default, see that the API works

services/core/java/com/android/server/pm/PackageManagerService.java

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 98b6949..3ac7384 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -8282,8 +8282,10 @@
         if (HIDE_EPHEMERAL_APIS || isEphemeralDisabled()) {
             return null;
         }
-        mContext.enforceCallingOrSelfPermission(Manifest.permission.ACCESS_INSTANT_APPS,
-                "getEphemeralApplications");
+        if (!canViewInstantApps(Binder.getCallingUid(), userId)) {
+            mContext.enforceCallingOrSelfPermission(Manifest.permission.ACCESS_INSTANT_APPS,
+                    "getEphemeralApplications");
+        }
         enforceCrossUserPermission(Binder.getCallingUid(), userId,
                 true /* requireFullPermission */, false /* checkShell */,
                 "getEphemeralApplications");
@@ -8368,9 +8370,10 @@
             return null;
         }
 
-        mContext.enforceCallingOrSelfPermission(Manifest.permission.ACCESS_INSTANT_APPS,
-                "getInstantAppIcon");
-
+        if (!canViewInstantApps(Binder.getCallingUid(), userId)) {
+            mContext.enforceCallingOrSelfPermission(Manifest.permission.ACCESS_INSTANT_APPS,
+                    "getInstantAppIcon");
+        }
         enforceCrossUserPermission(Binder.getCallingUid(), userId,
                 true /* requireFullPermission */, false /* checkShell */,
                 "getInstantAppIcon");