Allow public profile compilation for primary apks

It is ok to perform a "public" compilation with
profiles comming from dex metdata files.

The PackageManager is responsible to set the is_public flag for
primary apks; so we no longer check it in installd.

(cherry picked from commit 0b386e03f83d9a308aecaebb6c7c1d6f36b79e27)

Test: installd_dexopt_test
Bug: 30934496
Merged-In: I72519c6a05aa318985396c6f93176624fe76c4be
Change-Id: I72519c6a05aa318985396c6f93176624fe76c4be
diff --git a/cmds/installd/dexopt.cpp b/cmds/installd/dexopt.cpp
index 1139ebc..2a7ad61 100644
--- a/cmds/installd/dexopt.cpp
+++ b/cmds/installd/dexopt.cpp
@@ -1327,9 +1327,21 @@
 Dex2oatFileWrapper maybe_open_reference_profile(const std::string& pkgname,
         const std::string& dex_path, const char* profile_name, bool profile_guided,
         bool is_public, int uid, bool is_secondary_dex) {
-    // Public apps should not be compiled with profile information ever. Same goes for the special
-    // package '*' used for the system server.
-    if (!profile_guided || is_public || (pkgname[0] == '*')) {
+    // If we are not profile guided compilation, or we are compiling system server
+    // do not bother to open the profiles; we won't be using them.
+    if (!profile_guided || (pkgname[0] == '*')) {
+        return Dex2oatFileWrapper();
+    }
+
+    // If this is a secondary dex path which is public do not open the profile.
+    // We cannot compile public secondary dex paths with profiles. That's because
+    // it will expose how the dex files are used by their owner.
+    //
+    // Note that the PackageManager is responsible to set the is_public flag for
+    // primary apks and we do not check it here. In some cases, e.g. when
+    // compiling with a public profile from the .dm file the PackageManager will
+    // set is_public toghether with the profile guided compilation.
+    if (is_secondary_dex && is_public) {
         return Dex2oatFileWrapper();
     }