Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Fix APIs which use admin policies in permission check" into udc-dev

Browse Source
This commit is contained in:
Elis Elliott
2023-05-11 15:24:10 +00:00
committed by Android (Google) Code Review
parent 28ce92a21f 78bcc2f399
commit 03a43c31c3
1 changed files with 24 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -5553,7 +5553,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
if (isPermissionCheckFlagEnabled()) {
CallerIdentity caller = getCallerIdentity(who, callerPackageName);
ap = enforcePermissionAndGetEnforcingAdmin(
who, MANAGE_DEVICE_POLICY_WIPE_DATA,
who,
/*permission=*/ MANAGE_DEVICE_POLICY_WIPE_DATA,
/* adminPolicy=*/ DeviceAdminInfo.USES_POLICY_WIPE_DATA,
caller.getPackageName(), affectedUserId).getActiveAdmin();
} else {
// This API can only be called by an active device admin,
@@ -5835,9 +5837,11 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
ActiveAdmin ap;
if (isPermissionCheckFlagEnabled()) {
CallerIdentity caller = getCallerIdentity(who, callerPackageName);
// TODO: Allow use of USES_POLICY_FORCE_LOCK
ap = enforcePermissionAndGetEnforcingAdmin(
who, MANAGE_DEVICE_POLICY_LOCK, caller.getPackageName(),
who,
/*permission=*/ MANAGE_DEVICE_POLICY_LOCK,
/*AdminPolicy=*/DeviceAdminInfo.USES_POLICY_FORCE_LOCK,
caller.getPackageName(),
affectedUserId).getActiveAdmin();
} else {
ap = getActiveAdminForCallerLocked(
@@ -11802,9 +11806,10 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
if (isPermissionCheckFlagEnabled()) {
CallerIdentity caller = getCallerIdentity(admin, callerPackageName);
int affectedUserId = parent ? getProfileParentId(userHandle) : userHandle;
// TODO: Support USES_POLICY_DISABLE_KEYGUARD_FEATURES
ap = enforcePermissionAndGetEnforcingAdmin(
admin, MANAGE_DEVICE_POLICY_KEYGUARD,
admin,
/*permission=*/MANAGE_DEVICE_POLICY_KEYGUARD,
/*adminPolicy=*/DeviceAdminInfo.USES_POLICY_DISABLE_KEYGUARD_FEATURES,
caller.getPackageName(), affectedUserId).getActiveAdmin();
} else {
ap = getActiveAdminForCallerLocked(admin,
@@ -13350,23 +13355,23 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
caller = getCallerIdentity(who);
}
int userId = caller.getUserId();
int affectedUserId = parent ? getProfileParentId(userId) : userId;
checkCanExecuteOrThrowUnsafe(DevicePolicyManager.OPERATION_SET_USER_RESTRICTION);
if (isPolicyEngineForFinanceFlagEnabled()) {
if (!isDeviceOwner(caller) && !isProfileOwner(caller)) {
EnforcingAdmin admin = enforcePermissionForUserRestriction(
who,
key,
caller.getPackageName(),
affectedUserId);
if (!mInjector.isChangeEnabled(ENABLE_COEXISTENCE_CHANGE, callerPackage, userId)) {
throw new IllegalStateException("Calling package is not targeting Android U.");
}
if (!UserRestrictionsUtils.isValidRestriction(key)) {
throw new IllegalArgumentException("Invalid restriction key: " + key);
}
int affectedUserId = parent ? getProfileParentId(userId) : userId;
EnforcingAdmin admin = enforcePermissionForUserRestriction(
who,
key,
caller.getPackageName(),
affectedUserId);
PolicyDefinition<Boolean> policyDefinition =
PolicyDefinition.getPolicyDefinitionForUserRestriction(key);
if (enabledFromThisOwner) {
@@ -22998,6 +23003,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
MANAGE_DEVICE_POLICY_FACTORY_RESET,
MANAGE_DEVICE_POLICY_INSTALL_UNKNOWN_SOURCES,
MANAGE_DEVICE_POLICY_KEYGUARD,
MANAGE_DEVICE_POLICY_LOCK_CREDENTIALS,
MANAGE_DEVICE_POLICY_LOCK_TASK,
MANAGE_DEVICE_POLICY_ORGANIZATION_IDENTITY,
MANAGE_DEVICE_POLICY_RUNTIME_PERMISSIONS,
@@ -23005,7 +23011,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
MANAGE_DEVICE_POLICY_SUPPORT_MESSAGE,
MANAGE_DEVICE_POLICY_TIME,
MANAGE_DEVICE_POLICY_USERS,
MANAGE_DEVICE_POLICY_LOCK_CREDENTIALS
MANAGE_DEVICE_POLICY_WIPE_DATA
);
/**
@@ -23525,14 +23531,15 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
*
* @param callerPackageName The package name of the calling application.
* @param adminPolicy The admin policy that should grant holders permission.
* @param permission The name of the permission being checked.
* @param permissions The names of the permissions being checked.
* @param targetUserId The userId of the user which the caller needs permission to act on.
* @throws SecurityException if the caller has not been granted the given permission,
* the associated cross-user permission if the caller's user is different to the target user.
*/
private void enforcePermissions(String[] permissions, int adminPolicy,
String callerPackageName, int targetUserId) throws SecurityException {
if (hasAdminPolicy(adminPolicy, callerPackageName)) {
if (hasAdminPolicy(adminPolicy, callerPackageName)
&& mInjector.userHandleGetCallingUserId() == targetUserId) {
return;
}
enforcePermissions(permissions, callerPackageName, targetUserId);
@@ -23561,8 +23568,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
private boolean hasAdminPolicy(int adminPolicy, String callerPackageName) {
CallerIdentity caller = getCallerIdentity(callerPackageName);
ActiveAdmin deviceAdmin = getActiveAdminForCaller(null, caller);
return deviceAdmin != null && deviceAdmin.info.usesPolicy(adminPolicy);
ActiveAdmin deviceAdmin = getActiveAdminWithPolicyForUidLocked(
null, adminPolicy, caller.getUid());
return deviceAdmin != null;
}
/**