From 1df91489315266dd5c3933b442b15a51a55a3ec9 Mon Sep 17 00:00:00 2001 From: kholoud mohamed Date: Wed, 28 Apr 2021 16:29:01 +0100 Subject: [PATCH] Fix security vulnerability in DPMS#setProfileOwner Fail with a more general error message if the provided component is not installed, this avoids exploiting the API to identify which packages are installed without holding QUERY_ALL_PACKAGES Test: Manual testing Bug: 184658476 Change-Id: I47b80acb4c847f3bc0c6550deca40b192f57d598 --- .../server/devicepolicy/DevicePolicyManagerService.java | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index d9fa471351117..4d80188d2a38f 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -8552,11 +8552,12 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { synchronized (getLockObject()) { enforceCanSetProfileOwnerLocked( caller, who, userHandle, hasIncompatibleAccountsOrNonAdb); - Preconditions.checkArgument(isPackageInstalledForUser(who.getPackageName(), userHandle), - "Component " + who + " not installed for userId:" + userHandle); final ActiveAdmin admin = getActiveAdminUncheckedLocked(who, userHandle); - Preconditions.checkArgument(admin != null && !getUserData( - userHandle).mRemovingAdmins.contains(who), "Not active admin: " + who); + Preconditions.checkArgument( + isPackageInstalledForUser(who.getPackageName(), userHandle) + && admin != null + && !getUserData(userHandle).mRemovingAdmins.contains(who), + "Not active admin: " + who); final int parentUserId = getProfileParentId(userHandle); // When trying to set a profile owner on a new user, it may be that this user is