PACKAGE_INSTALLER apps are allowed to use SYSTEM_EXEMPTED foreground

service type.

Bug: 262580021
Test: build and run.
Change-Id: I918b11216db20325919b077f5310a351de1afcf1

2 files changed, 20 insertions, 0 deletions

diff --git a/apex/jobscheduler/framework/java/android/os/PowerExemptionManager.java b/apex/jobscheduler/framework/java/android/os/PowerExemptionManager.java
index 78214dc27a9f..711caf7feb62 100644
--- a/apex/jobscheduler/framework/java/android/os/PowerExemptionManager.java
+++ b/apex/jobscheduler/framework/java/android/os/PowerExemptionManager.java
@@ -391,6 +391,12 @@ public class PowerExemptionManager {
      */
     public static final int REASON_MEDIA_NOTIFICATION_TRANSFER = 325;
 
+    /**
+     * Package installer.
+     * @hide
+     */
+    public static final int REASON_PACKAGE_INSTALLER = 326;
+
     /** @hide The app requests out-out. */
     public static final int REASON_OPT_OUT_REQUESTED = 1000;
 
@@ -472,6 +478,7 @@ public class PowerExemptionManager {
             REASON_DISALLOW_APPS_CONTROL,
             REASON_ACTIVE_DEVICE_ADMIN,
             REASON_MEDIA_NOTIFICATION_TRANSFER,
+            REASON_PACKAGE_INSTALLER,
     })
     @Retention(RetentionPolicy.SOURCE)
     public @interface ReasonCode {}
@@ -839,6 +846,8 @@ public class PowerExemptionManager {
                 return "REASON_OPT_OUT_REQUESTED";
             case REASON_MEDIA_NOTIFICATION_TRANSFER:
                 return "REASON_MEDIA_NOTIFICATION_TRANSFER";
+            case REASON_PACKAGE_INSTALLER:
+                return "REASON_PACKAGE_INSTALLER";
             default:
                 return "(unknown:" + reasonCode + ")";
         }
diff --git a/services/core/java/com/android/server/am/ActiveServices.java b/services/core/java/com/android/server/am/ActiveServices.java
index 4ebd7146252a..bcea40e5a9db 100644
--- a/services/core/java/com/android/server/am/ActiveServices.java
+++ b/services/core/java/com/android/server/am/ActiveServices.java
@@ -54,6 +54,7 @@ import static android.os.PowerExemptionManager.REASON_INSTR_BACKGROUND_FGS_PERMI
 import static android.os.PowerExemptionManager.REASON_OPT_OUT_REQUESTED;
 import static android.os.PowerExemptionManager.REASON_OP_ACTIVATE_PLATFORM_VPN;
 import static android.os.PowerExemptionManager.REASON_OP_ACTIVATE_VPN;
+import static android.os.PowerExemptionManager.REASON_PACKAGE_INSTALLER;
 import static android.os.PowerExemptionManager.REASON_PROC_STATE_PERSISTENT;
 import static android.os.PowerExemptionManager.REASON_PROC_STATE_PERSISTENT_UI;
 import static android.os.PowerExemptionManager.REASON_PROC_STATE_TOP;
@@ -194,6 +195,7 @@ import com.android.internal.notification.SystemNotificationChannels;
 import com.android.internal.os.SomeArgs;
 import com.android.internal.os.TimeoutRecord;
 import com.android.internal.os.TransferPipe;
+import com.android.internal.util.ArrayUtils;
 import com.android.internal.util.DumpUtils;
 import com.android.internal.util.FastPrintWriter;
 import com.android.internal.util.FrameworkStatsLog;
@@ -202,6 +204,7 @@ import com.android.server.LocalServices;
 import com.android.server.SystemService;
 import com.android.server.am.ActivityManagerService.ItemMatcher;
 import com.android.server.am.LowMemDetector.MemFactor;
+import com.android.server.pm.KnownPackages;
 import com.android.server.uri.NeededUriGrants;
 import com.android.server.wm.ActivityServiceConnectionsHolder;
 
@@ -2382,6 +2385,13 @@ public final class ActiveServices {
                             .getPotentialUserAllowedExemptionReason(callerUid, packageName);
                 }
             }
+            if (reason == REASON_DENIED) {
+                if (ArrayUtils.contains(mAm.getPackageManagerInternal().getKnownPackageNames(
+                        KnownPackages.PACKAGE_INSTALLER, UserHandle.USER_SYSTEM), packageName)) {
+                    reason = REASON_PACKAGE_INSTALLER;
+                }
+            }
+
             switch (reason) {
                 case REASON_SYSTEM_UID:
                 case REASON_SYSTEM_ALLOW_LISTED:
@@ -2397,6 +2407,7 @@ public final class ActiveServices {
                 case REASON_ACTIVE_DEVICE_ADMIN:
                 case REASON_ROLE_EMERGENCY:
                 case REASON_ALLOWLISTED_PACKAGE:
+                case REASON_PACKAGE_INSTALLER:
                     return PERMISSION_GRANTED;
                 default:
                     return PERMISSION_DENIED;