From ab0a45f0491d1b2266b041cf2676b47051d35ff6 Mon Sep 17 00:00:00 2001
From: Felipe Leme <felipeal@google.com>
Date: Thu, 30 Sep 2021 16:20:30 -0700
Subject: [PATCH] Proper fix for setDeviceOwner() permission check.

Previous fix was clearing the binding identity for the whole
manageUserUnchecked() call, which would break setting it using adb -
this change limits the scope just to the package manager calls.

Test: atest com.android.bedstead.nene.devicepolicy.DevicePolicyTest#setDeviceOwner_deviceOwnerIsAlreadySet_throwsException
Test: adb shell dpm set-device-owner --user 0 com.afwsamples.testdpc/.DeviceAdminReceiver

Fixes: 200810234

BYPASS_INCLUSIVE_LANGUAGE_REASON=existing API

Change-Id: I82e4ea2bef710420306ab17f58255ef7bc9cbb06
---
 .../DevicePolicyManagerService.java           | 26 ++++++++++---------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 6e3c954278e28..3eb8500a6f191 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -10627,19 +10627,21 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
             }
         }
         final String adminPkg = admin.getPackageName();
-        try {
-            // Install the profile owner if not present.
-            if (!mIPackageManager.isPackageAvailable(adminPkg, userId)) {
-                mIPackageManager.installExistingPackageAsUser(adminPkg, userId,
-                        PackageManager.INSTALL_ALL_WHITELIST_RESTRICTED_PERMISSIONS,
-                        PackageManager.INSTALL_REASON_POLICY,
-                        /* allowlistedRestrictedPermissions= */ null);
+        mInjector.binderWithCleanCallingIdentity(() -> {
+            try {
+                // Install the profile owner if not present.
+                if (!mIPackageManager.isPackageAvailable(adminPkg, userId)) {
+                    mIPackageManager.installExistingPackageAsUser(adminPkg, userId,
+                            PackageManager.INSTALL_ALL_WHITELIST_RESTRICTED_PERMISSIONS,
+                            PackageManager.INSTALL_REASON_POLICY,
+                            /* allowlistedRestrictedPermissions= */ null);
+                }
+            } catch (RemoteException e) {
+                // Does not happen, same process
+                Slogf.wtf(LOG_TAG, e, "Failed to install admin package %s for user %d",
+                        adminPkg, userId);
             }
-        } catch (RemoteException e) {
-            // Does not happen, same process
-            Slogf.wtf(LOG_TAG, e, "Failed to install admin package %s for user %d",
-                    adminPkg, userId);
-        }
+        });
 
         // Set admin.
         setActiveAdmin(profileOwner, /* refreshing= */ true, userId);