Applications should -not- be able to set preferred activities.
I can't believe I let this slip through. And in the SDK no less. :(
The APIs for setting preferred activities will now throw a security
exception when used. This may break some apps, we'll see how it
goes. If it is too bad we can just make these log and not throw
anything, but I would much prefer they throw an exception.
Change-Id: I3aed434750eef8b202aa9d5bd774a0121be521c6
diff --git a/services/java/com/android/server/PackageManagerService.java b/services/java/com/android/server/PackageManagerService.java
index 4c1356b..63afabc 100644
--- a/services/java/com/android/server/PackageManagerService.java
+++ b/services/java/com/android/server/PackageManagerService.java
@@ -6321,10 +6321,14 @@
}
public void clearPackagePreferredActivities(String packageName) {
- mContext.enforceCallingOrSelfPermission(
- android.Manifest.permission.SET_PREFERRED_APPLICATIONS, null);
-
synchronized (mPackages) {
+ int uid = Binder.getCallingUid();
+ PackageParser.Package pkg = mPackages.get(packageName);
+ if (pkg.applicationInfo.uid != uid) {
+ mContext.enforceCallingOrSelfPermission(
+ android.Manifest.permission.SET_PREFERRED_APPLICATIONS, null);
+ }
+
if (clearPackagePreferredActivitiesLP(packageName)) {
mSettings.writeLP();
}