android11禁止安装apk

应客户需求，需要设备禁止安装其它apk。

由于一套代码中有多个产品，所以想到用设置属性的方式来决定是否可安装apk,详见以下补丁

1、相关文件

复制代码

frameworks/base/packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java
frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java
frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java

2、禁止机器中识别到的apk文件的安装，修改如下：

复制代码

diff --git a/packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java b/packages/Pa
ckageInstaller/src/com/android/packageinstaller/InstallStart.java
index 0b8de6c7d4f1..0db15ddf050d 100644
--- a/packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java
+++ b/packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java
@@ -38,6 +38,8 @@ import android.os.RemoteException;
 import android.os.UserManager;
 import android.permission.IPermissionManager;
 import android.util.Log;
+import android.widget.Toast;
+import android.os.SystemProperties;
 
 import java.util.List;
 
@@ -53,6 +55,7 @@ public class InstallStart extends Activity {
     private IPermissionManager mIPermissionManager;
     private UserManager mUserManager;
     private boolean mAbortInstall = false;
+    private boolean APK_INSTALL_FINISH = SystemProperties.getBoolean("persist.sys.third.apk.install", false);
 
     @Override
     protected void onCreate(@Nullable Bundle savedInstanceState) {
@@ -150,7 +153,16 @@ public class InstallStart extends Activity {
         }
 
         if (nextActivity != null) {
-            startActivity(nextActivity);
+               if(!APK_INSTALL_FINISH) {
+                       //startActivity(nextActivity);
+                       Toast.makeText(InstallStart.this, "Installation prohibited", Toast.LENGTH_LONG).show();
+                       Intent result = new Intent();
+                               result.putExtra(Intent.EXTRA_INSTALL_RESULT,
+                           PackageManager.INSTALL_FAILED_INVALID_URI);
+                       setResult(RESULT_FIRST_USER, result);
+               } else{
+                   startActivity(nextActivity);
+               }
         }
         finish();
     }

3、禁止adb命令安装apk，修改如下：

复制代码

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index d35f0b28d299..82d70af87648 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -496,6 +496,8 @@ public class PackageManagerService extends IPackageManager.Stub
     public static final boolean DEBUG_PERMISSIONS = false;
     private static final boolean DEBUG_SHARED_LIBRARIES = false;
     public static final boolean DEBUG_COMPRESSION = Build.IS_DEBUGGABLE;
+    
+    private boolean APK_INSTALL_FINISH = SystemProperties.getBoolean("persist.sys.third.apk.install", false);
 
     // Debug output for dexopting. This is shared between PackageManagerService, OtaDexoptService
     // and PackageDexOptimizer. All these classes have their own flag to allow switching a single
@@ -1692,6 +1694,10 @@ public class PackageManagerService extends IPackageManager.Stub
         void doHandleMessage(Message msg) {
             switch (msg.what) {
                 case INIT_COPY: {
+                   if(!APK_INSTALL_FINISH){
+                             SystemProperties.set("persist.sys.third.apk.install", "true");
+                       return;
+                   }
                     HandlerParams params = (HandlerParams) msg.obj;
                     if (params != null) {
                         if (DEBUG_INSTALL) Slog.i(TAG, "init_copy: " + params);
@@ -3445,7 +3451,8 @@ public class PackageManagerService extends IPackageManager.Stub
             Slog.i(TAG, "Time to scan packages: "
                     + ((SystemClock.uptimeMillis()-startTime)/1000f)
                     + " seconds");
-
+       
+           APK_INSTALL_FINISH = true;
             // If the platform SDK has changed since the last time we booted,
             // we need to re-grant app permission to catch any new ones that
             // appear.  This is really a hack, and means that apps can in some

4、让adb安装命令跟着设置的属性走

复制代码

diff --git a/services/core/java/com/android/server/pm/PackageInstallerSession.java b/services/core/java/com/android/server/pm/PackageInstallerSession.java
old mode 100644
new mode 100755
index d690ae9e70f1..f7566858a95f
--- a/services/core/java/com/android/server/pm/PackageInstallerSession.java
+++ b/services/core/java/com/android/server/pm/PackageInstallerSession.java
@@ -969,6 +969,13 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub {
         // Quick sanity check of state, and allocate a pipe for ourselves. We
         // then do heavy disk allocation outside the lock, but this open pipe
         // will block any attempted install transitions.
+               
+               
+               boolean installFlag= SystemProperties.getBoolean("persist.sys.third.apk.install", false);
+               if(!installFlag){
+                        return null;
+               }
+               
         final RevocableFileDescriptor fd;
         final FileBridge bridge;
         synchronized (mLock) {