Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor permission checks removeActiveAdmin

Browse Source 
Reorder permissions checks to not leak information about a package if
it's admin or not.

Bug: 192369136
Test: atest DevicePolicyManagerTest#testRemoveActiveAdmin_SecurityException
      atest DevicePolicyManagerTest#testRemoveActiveAdmin_userNotRunningOrLocked
      atest DevicePolicyManagerTest#testRemoveActiveAdmin_fromDifferentUserWithINTERACT_ACROSS_USERS_FULL
      atest DevicePolicyManagerTest#testRemoveActiveAdmin_sameUserNoMANAGE_DEVICE_ADMINS
      atest DevicePolicyManagerTest#testRemoveActiveAdmin_multipleAdminsInUser
      atest DevicePolicyManagerTest#testSetDeviceOwner
      atest DevicePolicyManagerTest#testSetDeviceOwner_headlessSystemUserMode
      atest DevicePolicyManagerTest#testSetProfileOwner
Change-Id: I132e09f680c06fb5068bdbe140c08cafcc13f102
This commit is contained in:
Ayush Sharma
2021-08-20 22:20:42 +00:00
parent 575c989cb8
commit 11d2fb77a1
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -3786,7 +3786,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
}
Preconditions.checkArgumentNonnegative(userHandle, "Invalid userId");
final CallerIdentity caller = getCallerIdentity();
final CallerIdentity caller = hasCallingOrSelfPermission(permission.MANAGE_DEVICE_ADMINS)
? getCallerIdentity() : getCallerIdentity(adminReceiver);
Preconditions.checkCallAuthorization(hasFullCrossUsersPermission(caller, userHandle));
checkCanExecuteOrThrowUnsafe(DevicePolicyManager.OPERATION_REMOVE_ACTIVE_ADMIN);
enforceUserUnlocked(userHandle);
@@ -3803,8 +3804,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
+ adminReceiver);
return;
}
Preconditions.checkCallAuthorization(admin.getUid() == caller.getUid()
|| hasCallingOrSelfPermission(permission.MANAGE_DEVICE_ADMINS));
mInjector.binderWithCleanCallingIdentity(() ->
removeActiveAdminLocked(adminReceiver, userHandle));
}