Disallow device admin package and protected packages to be reinstalle…

…d as instant.

We should prevent the following types of apps from being reinstalled with
--install-existing as an instant.
(1)device admin package
(2)protected packages

Flag: EXEMPT bugfix

Bug: 341256043
Test: Manual test
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:b5f80792e258a38eb88b3cb480e1d468d7cd2a43)
Merged-In: Ib1ed417072a3e942284e267e660631bd9e863248
Change-Id: Ib1ed417072a3e942284e267e660631bd9e863248

services/core/java/com/android/server/pm/InstallPackageHelper.java

@@ -551,6 +551,9 @@ public int installExistingPackageAsUser(@Nullable String packageName, @UserIdInt
                     (installFlags & PackageManager.INSTALL_INSTANT_APP) != 0;
             final boolean fullApp =
                     (installFlags & PackageManager.INSTALL_FULL_APP) != 0;
+            final boolean isPackageDeviceAdmin = mPm.isPackageDeviceAdmin(packageName, userId);
+            final boolean isProtectedPackage = mPm.mProtectedPackages != null
+                    && mPm.mProtectedPackages.isPackageStateProtected(userId, packageName);
 
             // writer
             synchronized (mPm.mLock) {
@@ -559,7 +562,8 @@ public int installExistingPackageAsUser(@Nullable String packageName, @UserIdInt
                 if (pkgSetting == null) {
                     return PackageManager.INSTALL_FAILED_INVALID_URI;
                 }
-                if (instantApp && (pkgSetting.isSystem() || pkgSetting.isUpdatedSystemApp())) {
+                if (instantApp && (pkgSetting.isSystem() || pkgSetting.isUpdatedSystemApp()
+                        || isPackageDeviceAdmin || isProtectedPackage)) {
                     return PackageManager.INSTALL_FAILED_INVALID_URI;
                 }
                 if (!snapshot.canViewInstantApps(callingUid, UserHandle.getUserId(callingUid))) {