android11禁止安装apk

应客户需求，需要设备禁止安装其它apk。

由于一套代码中有多个产品，所以想到用设置属性的方式来决定是否可安装apk,详见以下补丁

1、相关文件

frameworks/base/packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java
frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java
frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java

2、禁止机器中识别到的apk文件的安装 ，修改如下：

diff --git a/packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java b/packages/Pa
ckageInstaller/src/com/android/packageinstaller/InstallStart.java
index 0b8de6c7d4f1..0db15ddf050d 100644
--- a/packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java
+++ b/packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java
@@ -38,6 +38,8 @@ import android.os.RemoteException;import android.os.UserManager;import android.permission.IPermissionManager;import android.util.Log;
+import android.widget.Toast;
+import android.os.SystemProperties;import java.util.List;@@ -53,6 +55,7 @@ public class InstallStart extends Activity {private IPermissionManager mIPermissionManager;private UserManager mUserManager;private boolean mAbortInstall = false;
+    private boolean APK_INSTALL_FINISH = SystemProperties.getBoolean("persist.sys.third.apk.install", false);@Overrideprotected void onCreate(@Nullable Bundle savedInstanceState) {
@@ -150,7 +153,16 @@ public class InstallStart extends Activity {}if (nextActivity != null) {
-            startActivity(nextActivity);
+               if(!APK_INSTALL_FINISH) {
+                       //startActivity(nextActivity);
+                       Toast.makeText(InstallStart.this, "Installation prohibited", Toast.LENGTH_LONG).show();
+                       Intent result = new Intent();
+                               result.putExtra(Intent.EXTRA_INSTALL_RESULT,
+                           PackageManager.INSTALL_FAILED_INVALID_URI);
+                       setResult(RESULT_FIRST_USER, result);
+               } else{
+                   startActivity(nextActivity);
+               }}finish();}

3、禁止adb命令安装apk，修改如下：   

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index d35f0b28d299..82d70af87648 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -496,6 +496,8 @@ public class PackageManagerService extends IPackageManager.Stubpublic static final boolean DEBUG_PERMISSIONS = false;private static final boolean DEBUG_SHARED_LIBRARIES = false;public static final boolean DEBUG_COMPRESSION = Build.IS_DEBUGGABLE;
+    
+    private boolean APK_INSTALL_FINISH = SystemProperties.getBoolean("persist.sys.third.apk.install", false);// Debug output for dexopting. This is shared between PackageManagerService, OtaDexoptService// and PackageDexOptimizer. All these classes have their own flag to allow switching a single
@@ -1692,6 +1694,10 @@ public class PackageManagerService extends IPackageManager.Stubvoid doHandleMessage(Message msg) {switch (msg.what) {case INIT_COPY: {
+                   if(!APK_INSTALL_FINISH){
+                             SystemProperties.set("persist.sys.third.apk.install", "true");
+                       return;
+                   }HandlerParams params = (HandlerParams) msg.obj;if (params != null) {if (DEBUG_INSTALL) Slog.i(TAG, "init_copy: " + params);
@@ -3445,7 +3451,8 @@ public class PackageManagerService extends IPackageManager.StubSlog.i(TAG, "Time to scan packages: "+ ((SystemClock.uptimeMillis()-startTime)/1000f)+ " seconds");
-
+       
+           APK_INSTALL_FINISH = true;// If the platform SDK has changed since the last time we booted,// we need to re-grant app permission to catch any new ones that// appear.  This is really a hack, and means that apps can in some

4、让adb安装命令跟着设置的属性走

diff --git a/services/core/java/com/android/server/pm/PackageInstallerSession.java b/services/core/java/com/android/server/pm/PackageInstallerSession.java
old mode 100644
new mode 100755
index d690ae9e70f1..f7566858a95f
--- a/services/core/java/com/android/server/pm/PackageInstallerSession.java
+++ b/services/core/java/com/android/server/pm/PackageInstallerSession.java
@@ -969,6 +969,13 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub {// Quick sanity check of state, and allocate a pipe for ourselves. We// then do heavy disk allocation outside the lock, but this open pipe// will block any attempted install transitions.
+               
+               
+               boolean installFlag= SystemProperties.getBoolean("persist.sys.third.apk.install", false);
+               if(!installFlag){
+                        return null;
+               }
+               final RevocableFileDescriptor fd;final FileBridge bridge;synchronized (mLock) {