Fix connected apps for headless (was previously always checking allowed

apps on user 0).

Also correctly makes DISALLOW_DEBUGGING_FEATURES global to block adb on
HSUM

Test: Manual use of connected apps settings on HSUM
Fixes: 264853055
Fixes: 266542871
Change-Id: I5caecdeeefa42671f1410a07ce06646610256905

core/java/android/app/admin/DevicePolicyManager.java

@@ -15495,7 +15495,7 @@ public class DevicePolicyManager {
         throwIfParentInstance("getAllCrossProfilePackages");
         if (mService != null) {
             try {
-                return new ArraySet<>(mService.getAllCrossProfilePackages());
+                return new ArraySet<>(mService.getAllCrossProfilePackages(mContext.getUserId()));
             } catch (RemoteException e) {
                 throw e.rethrowFromSystemServer();
             }

core/java/android/app/admin/DevicePolicyManagerInternal.java

@@ -206,7 +206,7 @@ public abstract class DevicePolicyManagerInternal {
      *
      * @hide
      */
-    public abstract List<String> getAllCrossProfilePackages();
+    public abstract List<String> getAllCrossProfilePackages(int userId);
 
     /**
      * Returns the default package names set by the OEM that are allowed to communicate

core/java/android/app/admin/IDevicePolicyManager.aidl

@@ -515,7 +515,7 @@ interface IDevicePolicyManager {
     void setCrossProfilePackages(in ComponentName admin, in List<String> packageNames);
     List<String> getCrossProfilePackages(in ComponentName admin);
 
-    List<String> getAllCrossProfilePackages();
+    List<String> getAllCrossProfilePackages(int userId);
     List<String> getDefaultCrossProfilePackages();
 
     boolean isManagedKiosk();

services/core/java/com/android/server/pm/CrossProfileAppsServiceImpl.java

@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 package com.android.server.pm;
+
 import static android.Manifest.permission.CONFIGURE_INTERACT_ACROSS_PROFILES;
 import static android.Manifest.permission.INTERACT_ACROSS_PROFILES;
 import static android.Manifest.permission.INTERACT_ACROSS_USERS;
@@ -333,9 +334,10 @@ public class CrossProfileAppsServiceImpl extends ICrossProfileApps.Stub {
     }
 
     private boolean isCrossProfilePackageAllowlisted(String packageName) {
+        int userId = mInjector.getCallingUserId();
         return mInjector.withCleanCallingIdentity(() ->
                 mInjector.getDevicePolicyManagerInternal()
-                        .getAllCrossProfilePackages().contains(packageName));
+                        .getAllCrossProfilePackages(userId).contains(packageName));
     }
 
     private boolean isCrossProfilePackageAllowlistedByDefault(String packageName) {

services/core/java/com/android/server/pm/UserRestrictionsUtils.java

@@ -238,6 +238,7 @@ public class UserRestrictionsUtils {
                     UserManager.DISALLOW_CONFIG_DATE_TIME,
                     UserManager.DISALLOW_CONFIG_PRIVATE_DNS,
                     UserManager.DISALLOW_CHANGE_WIFI_STATE,
+                    UserManager.DISALLOW_DEBUGGING_FEATURES,
                     UserManager.DISALLOW_WIFI_TETHERING,
                     UserManager.DISALLOW_WIFI_DIRECT,
                     UserManager.DISALLOW_ADD_WIFI_CONFIG,

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

@@ -13389,14 +13389,8 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
                 PolicyDefinition<Boolean> policyDefinition =
                         PolicyDefinition.getPolicyDefinitionForUserRestriction(key);
                 if (enabledFromThisOwner) {
-                    // TODO: Remove this special case - replace with breaking change to require
-                    //  setGlobally to disable ADB
-                    if (key.equals(UserManager.DISALLOW_DEBUGGING_FEATURES) && parent) {
-                        setGlobalUserRestrictionInternal(admin, key, /* enabled= */ true);
-                    } else {
-                        setLocalUserRestrictionInternal(
-                                admin, key, /* enabled= */ true, affectedUserId);
-                    }
+                    setLocalUserRestrictionInternal(
+                            admin, key, /* enabled= */ true, affectedUserId);
                 } else {
                     // Remove any local and global policy that was set by the admin
                     if (!policyDefinition.isLocalOnlyPolicy()) {
@@ -13914,7 +13908,6 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
         CallerIdentity caller = getCallerIdentity(who, callerPackage);
         final int userId = parent ? getProfileParentId(caller.getUserId()) : caller.getUserId();
         if (isPolicyEngineForFinanceFlagEnabled()) {
-            // TODO: We need to ensure the delegate with DELEGATION_PACKAGE_ACCESS can do this
             enforcePermission(MANAGE_DEVICE_POLICY_PACKAGE_STATE, caller.getPackageName(), userId);
         } else {
             Preconditions.checkCallAuthorization((caller.hasAdminComponent()
@@ -16085,8 +16078,8 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
         }
 
         @Override
-        public List<String> getAllCrossProfilePackages() {
-            return DevicePolicyManagerService.this.getAllCrossProfilePackages();
+        public List<String> getAllCrossProfilePackages(int userId) {
+            return DevicePolicyManagerService.this.getAllCrossProfilePackages(userId);
         }
 
         @Override
@@ -20305,7 +20298,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
     }
 
     @Override
-    public List<String> getAllCrossProfilePackages() {
+    public List<String> getAllCrossProfilePackages(int userId) {
         if (!mHasFeature) {
             return Collections.emptyList();
         }
@@ -20314,10 +20307,10 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
                 isSystemUid(caller) || isRootUid(caller) || hasCallingPermission(
                         permission.INTERACT_ACROSS_USERS) || hasCallingPermission(
                         permission.INTERACT_ACROSS_USERS_FULL) || hasPermissionForPreflight(
-                        caller, permission.INTERACT_ACROSS_PROFILES));
+                                                caller, permission.INTERACT_ACROSS_PROFILES));
 
         synchronized (getLockObject()) {
-            final List<ActiveAdmin> admins = getProfileOwnerAdminsForCurrentProfileGroup();
+            final List<ActiveAdmin> admins = getProfileOwnerAdminsForProfileGroup(userId);
             final List<String> packages = getCrossProfilePackagesForAdmins(admins);
 
             packages.addAll(getDefaultCrossProfilePackages());
@@ -20346,11 +20339,10 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
         return new ArrayList<>(crossProfilePackages);
     }
 
-    private List<ActiveAdmin> getProfileOwnerAdminsForCurrentProfileGroup() {
+    private List<ActiveAdmin> getProfileOwnerAdminsForProfileGroup(int userId) {
         synchronized (getLockObject()) {
             final List<ActiveAdmin> admins = new ArrayList<>();
-            int[] users = mUserManager.getProfileIdsWithDisabled(
-                    mInjector.userHandleGetCallingUserId());
+            int[] users = mUserManager.getProfileIdsWithDisabled(userId);
             for (int i = 0; i < users.length; i++) {
                 final ComponentName componentName = getProfileOwnerAsUser(users[i]);
                 if (componentName != null) {

services/robotests/src/com/android/server/pm/CrossProfileAppsServiceImplRoboTest.java

@@ -201,7 +201,7 @@ public class CrossProfileAppsServiceImplRoboTest {
     }
 
     private void mockCrossProfileAppWhitelisted() {
-        when(mDevicePolicyManagerInternal.getAllCrossProfilePackages())
+        when(mDevicePolicyManagerInternal.getAllCrossProfilePackages(anyInt()))
                 .thenReturn(Lists.newArrayList(CROSS_PROFILE_APP_PACKAGE_NAME));
     }
 
@@ -662,7 +662,7 @@ public class CrossProfileAppsServiceImplRoboTest {
     }
 
     private void mockCrossProfileAppNotWhitelisted() {
-        when(mDevicePolicyManagerInternal.getAllCrossProfilePackages())
+        when(mDevicePolicyManagerInternal.getAllCrossProfilePackages(anyInt()))
                 .thenReturn(new ArrayList<>());
     }