From 11d2fb77a19c9b53c825f4ab5fcd68054e097c06 Mon Sep 17 00:00:00 2001
From: Ayush Sharma <ayushsha@google.com>
Date: Fri, 20 Aug 2021 22:20:42 +0000
Subject: [PATCH] Refactor permission checks removeActiveAdmin

Reorder permissions checks to not leak information about a package if
it's admin or not.

Bug: 192369136
Test: atest DevicePolicyManagerTest#testRemoveActiveAdmin_SecurityException
      atest DevicePolicyManagerTest#testRemoveActiveAdmin_userNotRunningOrLocked
      atest DevicePolicyManagerTest#testRemoveActiveAdmin_fromDifferentUserWithINTERACT_ACROSS_USERS_FULL
      atest DevicePolicyManagerTest#testRemoveActiveAdmin_sameUserNoMANAGE_DEVICE_ADMINS
      atest DevicePolicyManagerTest#testRemoveActiveAdmin_multipleAdminsInUser
      atest DevicePolicyManagerTest#testSetDeviceOwner
      atest DevicePolicyManagerTest#testSetDeviceOwner_headlessSystemUserMode
      atest DevicePolicyManagerTest#testSetProfileOwner
Change-Id: I132e09f680c06fb5068bdbe140c08cafcc13f102
---
 .../server/devicepolicy/DevicePolicyManagerService.java     | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 5b205cdfba412..0ee91cccff7ce 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -3786,7 +3786,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
         }
         Preconditions.checkArgumentNonnegative(userHandle, "Invalid userId");
 
-        final CallerIdentity caller = getCallerIdentity();
+        final CallerIdentity caller = hasCallingOrSelfPermission(permission.MANAGE_DEVICE_ADMINS)
+                ? getCallerIdentity() : getCallerIdentity(adminReceiver);
         Preconditions.checkCallAuthorization(hasFullCrossUsersPermission(caller, userHandle));
         checkCanExecuteOrThrowUnsafe(DevicePolicyManager.OPERATION_REMOVE_ACTIVE_ADMIN);
         enforceUserUnlocked(userHandle);
@@ -3803,8 +3804,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
                         + adminReceiver);
                 return;
             }
-            Preconditions.checkCallAuthorization(admin.getUid() == caller.getUid()
-                    || hasCallingOrSelfPermission(permission.MANAGE_DEVICE_ADMINS));
+
             mInjector.binderWithCleanCallingIdentity(() ->
                     removeActiveAdminLocked(adminReceiver, userHandle));
         }