summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--services/core/java/com/android/server/pm/InstallPackageHelper.java8
-rw-r--r--services/core/java/com/android/server/pm/PackageManagerService.java8
2 files changed, 12 insertions, 4 deletions
diff --git a/services/core/java/com/android/server/pm/InstallPackageHelper.java b/services/core/java/com/android/server/pm/InstallPackageHelper.java
index 69ef3f780172..e487267cd0a0 100644
--- a/services/core/java/com/android/server/pm/InstallPackageHelper.java
+++ b/services/core/java/com/android/server/pm/InstallPackageHelper.java
@@ -1135,22 +1135,22 @@ final class InstallPackageHelper {
// behavior.
if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_PACKAGE_MANAGER_SERVICE,
"MinInstallableTargetSdk__install_block_enabled",
- false)) {
+ true)) {
int minInstallableTargetSdk =
DeviceConfig.getInt(DeviceConfig.NAMESPACE_PACKAGE_MANAGER_SERVICE,
"MinInstallableTargetSdk__min_installable_target_sdk",
- 0);
+ PackageManagerService.MIN_INSTALLABLE_TARGET_SDK);
// Determine if enforcement is in strict mode
boolean strictMode = false;
if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_PACKAGE_MANAGER_SERVICE,
"MinInstallableTargetSdk__install_block_strict_mode_enabled",
- false)) {
+ true)) {
if (parsedPackage.getTargetSdkVersion()
< DeviceConfig.getInt(DeviceConfig.NAMESPACE_PACKAGE_MANAGER_SERVICE,
"MinInstallableTargetSdk__strict_mode_target_sdk",
- 0)) {
+ PackageManagerService.MIN_INSTALLABLE_TARGET_SDK)) {
strictMode = true;
}
}
diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index e4e3a9d0b7d3..3e1a1ac2605f 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -560,6 +560,14 @@ public class PackageManagerService implements PackageSender, TestUtilityService
// How many required verifiers can be on the system.
private static final int REQUIRED_VERIFIERS_MAX_COUNT = 2;
+ /**
+ * Specifies the minimum target SDK version an apk must specify in order to be installed
+ * on the system. This improves security and privacy by blocking low
+ * target sdk apps as malware can target older sdk versions to avoid
+ * the enforcement of new API behavior.
+ */
+ public static final int MIN_INSTALLABLE_TARGET_SDK = Build.VERSION_CODES.M;
+
// Compilation reasons.
// TODO(b/260124949): Clean this up with the legacy dexopt code.
public static final int REASON_FIRST_BOOT = 0;