Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace profile owner and device owner access checks DPMS

Browse Source 
Remove enforce methods
* enforceDeviceOwnerOrManageUsers
* enforceProfileOwnerOrSystemUser
* enforceProfileOwnerOrFullCrossPermission

* Use precondition checks instead

Bug: 167960209
Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest
      atest com.android.cts.devicepolicy.MixedDeviceOwnerTest
      atest com.android.cts.devicepolicy.ProfileOwnerTest
      atest com.android.cts.devicepolicy.ManagedProfileTest
Change-Id: Ic9b55063e11cf5ba365c485a97c77f98260d3b81
This commit is contained in:
Alex Johnston
2020-10-29 16:58:28 +00:00
parent 4b36182cd8
commit 09e32e8953
1 changed files with 25 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -4255,18 +4255,18 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
mInjector.getPackageManager().getPackagesForUid(
mInjector.binderGetCallingUid()))
.write();
final int callingUserId = mInjector.userHandleGetCallingUserId();
final CallerIdentity caller = getCallerIdentity();
if (parent) {
enforceProfileOwnerOrSystemUser();
}
enforceUserUnlocked(callingUserId);
Preconditions.checkCallAuthorization(!parent || (isDeviceOwner(caller)
|| isProfileOwner(caller) || isSystemUid(caller)),
"Only profile owner, device owner and system may call this method.");
enforceUserUnlocked(caller.getUserId());
mContext.enforceCallingOrSelfPermission(
REQUEST_PASSWORD_COMPLEXITY,
"Must have " + REQUEST_PASSWORD_COMPLEXITY + " permission.");
synchronized (getLockObject()) {
final int credentialOwner = getCredentialOwner(callingUserId, parent);
final int credentialOwner = getCredentialOwner(caller.getUserId(), parent);
PasswordMetrics metrics = mLockSettingsInternal.getUserPasswordMetrics(credentialOwner);
return metrics == null ? PASSWORD_COMPLEXITY_NONE : metrics.determineComplexity();
}
@@ -7299,7 +7299,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
@Override
public boolean hasDeviceOwner() {
enforceDeviceOwnerOrManageUsers();
final CallerIdentity caller = getCallerIdentity();
Preconditions.checkCallAuthorization(isDeviceOwner(caller) || canManageUsers(caller));
return mOwners.hasDeviceOwner();
}
@@ -8355,32 +8356,6 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
|| hasCallingOrSelfPermission(permission.INTERACT_ACROSS_USERS);
}
private void enforceDeviceOwnerOrManageUsers() {
final CallerIdentity caller = getCallerIdentity();
if (isDeviceOwner(caller)) {
return;
}
Preconditions.checkCallAuthorization(canManageUsers(caller));
}
private void enforceProfileOwnerOrSystemUser() {
final CallerIdentity caller = getCallerIdentity();
if (isDeviceOwner(caller) || isProfileOwner(caller)) {
return;
}
Preconditions.checkState(isSystemUid(caller),
"Only profile owner, device owner and system may call this method.");
}
private void enforceProfileOwnerOrFullCrossUsersPermission(CallerIdentity caller,
int userId) {
if ((userId == caller.getUserId()) && (isProfileOwner(caller) || isDeviceOwner(caller))) {
// Device Owner/Profile Owner may access the user it runs on.
return;
}
Preconditions.checkCallAuthorization(hasFullCrossUsersPermission(caller, userId));
}
private boolean canUserUseLockTaskLocked(int userId) {
if (isUserAffiliatedWithDeviceLocked(userId)) {
return true;
@@ -12457,7 +12432,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
if (!mHasFeature) {
return null;
}
enforceDeviceOwnerOrManageUsers();
final CallerIdentity caller = getCallerIdentity();
Preconditions.checkCallAuthorization(isDeviceOwner(caller) || canManageUsers(caller));
synchronized (getLockObject()) {
final ActiveAdmin deviceOwnerAdmin = getDeviceOwnerAdminLocked();
return deviceOwnerAdmin == null ? null : deviceOwnerAdmin.organizationName;
@@ -13604,19 +13580,22 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
@Override
public long getLastSecurityLogRetrievalTime() {
enforceDeviceOwnerOrManageUsers();
final CallerIdentity caller = getCallerIdentity();
Preconditions.checkCallAuthorization(isDeviceOwner(caller) || canManageUsers(caller));
return getUserData(UserHandle.USER_SYSTEM).mLastSecurityLogRetrievalTime;
}
@Override
public long getLastBugReportRequestTime() {
enforceDeviceOwnerOrManageUsers();
final CallerIdentity caller = getCallerIdentity();
Preconditions.checkCallAuthorization(isDeviceOwner(caller) || canManageUsers(caller));
return getUserData(UserHandle.USER_SYSTEM).mLastBugReportRequestTime;
}
@Override
public long getLastNetworkLogRetrievalTime() {
enforceDeviceOwnerOrManageUsers();
final CallerIdentity caller = getCallerIdentity();
Preconditions.checkCallAuthorization(isDeviceOwner(caller) || canManageUsers(caller));
return getUserData(UserHandle.USER_SYSTEM).mLastNetworkLogsRetrievalTime;
}
@@ -13720,15 +13699,21 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
@Override
public boolean isCurrentInputMethodSetByOwner() {
enforceProfileOwnerOrSystemUser();
return getUserData(mInjector.userHandleGetCallingUserId()).mCurrentInputMethodSet;
final CallerIdentity caller = getCallerIdentity();
Preconditions.checkCallAuthorization(isDeviceOwner(caller)
|| isProfileOwner(caller) || isSystemUid(caller),
"Only profile owner, device owner and system may call this method.");
return getUserData(caller.getUserId()).mCurrentInputMethodSet;
}
@Override
public StringParceledListSlice getOwnerInstalledCaCerts(@NonNull UserHandle user) {
final int userId = user.getIdentifier();
final CallerIdentity caller = getCallerIdentity();
enforceProfileOwnerOrFullCrossUsersPermission(caller, userId);
Preconditions.checkCallAuthorization((userId == caller.getUserId())
|| isProfileOwner(caller) || isDeviceOwner(caller)
|| hasFullCrossUsersPermission(caller, userId));
synchronized (getLockObject()) {
return new StringParceledListSlice(
new ArrayList<>(getUserData(userId).mOwnerInstalledCaCerts));