commit f4a6ba88b3f5d44da53209b7c18ad714125bff5d
author Calin Juravle <calin@google.com> Thu May 06 15:25:32 2021 -0700
committer Calin Juravle <calin@google.com> Fri May 07 15:31:09 2021 -0700
tree 0e0ef2fa15ea8a10f5f985dbfd8f3928cd8e7dd9
parent a5786a15e198e42075770637c75ef89dae4cdf43

Enforce system/root/shell for dexopt operation.

Dexopt acquires system level locks (e.g. installd locks) so it should
not be called by artbitrary apps via `adb shell` commands.

Test: manual
Bug: 180652564
Change-Id: I385d5346df7721d95edf40c45d06b969870e4bda

services/core/java/com/android/server/pm/PackageManagerService.java

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 48fee0b..ed09acd 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -9962,6 +9962,8 @@
     public boolean performDexOptMode(String packageName,
             boolean checkProfiles, String targetCompilerFilter, boolean force,
             boolean bootComplete, String splitName) {
+        enforceSystemOrRootOrShell("performDexOptMode");
+
         int flags = (checkProfiles ? DexoptOptions.DEXOPT_CHECK_FOR_PROFILES_UPDATES : 0) |
                 (force ? DexoptOptions.DEXOPT_FORCE : 0) |
                 (bootComplete ? DexoptOptions.DEXOPT_BOOT_COMPLETE : 0);