Require INSTALL_PACKAGES permission

Although it's not technically necessary for the ephemeral installer
to hold the INSTALL_PACKAGES permission, it leads to a pretty
poor experience -- the user has to confirm ephemeral installation --
which is a primary reason for ephemeral apps.

Change-Id: Ic3f947d677964521cd4742f66c1c3fe808c4c55a
Fixes: 33073519
Test: manual; installed packages w/ and w/o INSTALL_PACKAGES and only the apps with INSTALL_PACKAGES were made the installer

1 files changed, 12 insertions, 0 deletions

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index ee3f42b7808e..c1f755be9ee3 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -2925,6 +2925,18 @@ public class PackageManagerService extends IPackageManager.Stub {
                 | (!Build.IS_DEBUGGABLE ? MATCH_SYSTEM_ONLY : 0);
         final List<ResolveInfo> matches = queryIntentActivitiesInternal(intent, PACKAGE_MIME_TYPE,
                 resolveFlags, UserHandle.USER_SYSTEM);
+        Iterator<ResolveInfo> iter = matches.iterator();
+        while (iter.hasNext()) {
+            final ResolveInfo rInfo = iter.next();
+            final PackageSetting ps = mSettings.mPackages.get(rInfo.activityInfo.packageName);
+            if (ps != null) {
+                final PermissionsState permissionsState = ps.getPermissionsState();
+                if (permissionsState.hasPermission(Manifest.permission.INSTALL_PACKAGES, 0)) {
+                    continue;
+                }
+            }
+            iter.remove();
+        }
         if (matches.size() == 0) {
             return null;
         } else if (matches.size() == 1) {