1 files changed, 31 insertions, 6 deletions
diff --git a/service/java/com/android/ecm/EnhancedConfirmationService.java b/service/java/com/android/ecm/EnhancedConfirmationService.java
index dde9fe2fd..af2e81133 100644
--- a/service/java/com/android/ecm/EnhancedConfirmationService.java
+++ b/service/java/com/android/ecm/EnhancedConfirmationService.java
@@ -239,6 +239,10 @@ public class EnhancedConfirmationService extends SystemService {
 
         private static final ArraySet<String> PROTECTED_SETTINGS = new ArraySet<>();
 
+        // Settings restricted when an untrusted call is ongoing. These must also be added to
+        // PROTECTED_SETTINGS
+        private static final ArraySet<String> UNTRUSTED_CALL_RESTRICTED_SETTINGS = new ArraySet<>();
+
         static {
             // Runtime permissions
             PROTECTED_SETTINGS.add(Manifest.permission.SEND_SMS);
@@ -259,6 +263,13 @@ public class EnhancedConfirmationService extends SystemService {
             // Default application roles.
             PROTECTED_SETTINGS.add(RoleManager.ROLE_DIALER);
             PROTECTED_SETTINGS.add(RoleManager.ROLE_SMS);
+
+            if (Flags.unknownCallPackageInstallBlockingEnabled()) {
+                // Requesting package installs, limited during phone calls
+                PROTECTED_SETTINGS.add(AppOpsManager.OPSTR_REQUEST_INSTALL_PACKAGES);
+                UNTRUSTED_CALL_RESTRICTED_SETTINGS.add(
+                        AppOpsManager.OPSTR_REQUEST_INSTALL_PACKAGES);
+            }
         }
 
         private final @NonNull Context mContext;
@@ -287,8 +298,13 @@ public class EnhancedConfirmationService extends SystemService {
                     "settingIdentifier cannot be null or empty");
 
             try {
-                return isSettingEcmProtected(settingIdentifier) && isPackageEcmGuarded(packageName,
-                        userId);
+                if (!isSettingEcmProtected(settingIdentifier)) {
+                    return false;
+                }
+                if (isSettingProtectedGlobally(settingIdentifier)) {
+                    return true;
+                }
+                return isPackageEcmGuarded(packageName, userId);
             } catch (NameNotFoundException e) {
                 throw new IllegalArgumentException(e);
             }
@@ -351,10 +367,11 @@ public class EnhancedConfirmationService extends SystemService {
             }
         }
 
-        @Override
-        public boolean isUntrustedCallOngoing() {
-            enforcePermissions("isUntrustedCallOngoing",
-                    UserHandle.getUserHandleForUid(Binder.getCallingUid()).getIdentifier());
+        private boolean isUntrustedCallOngoing() {
+            if (!Flags.unknownCallPackageInstallBlockingEnabled()) {
+                return false;
+            }
+
             if (hasCallOfType(CALL_TYPE_EMERGENCY)) {
                 // If we have an emergency call, return false always.
                 return false;
@@ -496,6 +513,14 @@ public class EnhancedConfirmationService extends SystemService {
             return false;
         }
 
+        private boolean isSettingProtectedGlobally(@NonNull String settingIdentifier) {
+            if (UNTRUSTED_CALL_RESTRICTED_SETTINGS.contains(settingIdentifier)) {
+                return isUntrustedCallOngoing();
+            }
+
+            return false;
+        }
+
         @Nullable
         private ApplicationInfo getApplicationInfoAsUser(@Nullable String packageName,
                 @UserIdInt int userId) {