From 54dc06ab9968da8137e60f020c44d2e692eb4c1c Mon Sep 17 00:00:00 2001 From: kholoud mohamed Date: Mon, 7 Jun 2021 15:49:22 +0100 Subject: [PATCH] Fix security vulnerability in DPMS Changed DPMS#getCrossProfileCalendarPackagesForUser to always require INTERACT_ACROSS_USERS or INTERACT_ACROSS_USERS_FULL. Bug: 187043444 Test: N/A Change-Id: I53300bfe2e0481df0d473cc73a85857b5603a45e --- core/java/android/app/admin/DevicePolicyManager.java | 4 ++++ .../server/devicepolicy/DevicePolicyManagerService.java | 6 +++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/core/java/android/app/admin/DevicePolicyManager.java b/core/java/android/app/admin/DevicePolicyManager.java index 8d747961fab1f..5b65795612d0e 100644 --- a/core/java/android/app/admin/DevicePolicyManager.java +++ b/core/java/android/app/admin/DevicePolicyManager.java @@ -13112,6 +13112,10 @@ public class DevicePolicyManager { * @see #getCrossProfileCalendarPackages(ComponentName) * @hide */ + @RequiresPermission(anyOf = { + permission.INTERACT_ACROSS_USERS_FULL, + permission.INTERACT_ACROSS_USERS + }) public @Nullable Set getCrossProfileCalendarPackages() { throwIfParentInstance("getCrossProfileCalendarPackages"); if (mService != null) { diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index dddf3df637935..228bc0ecc0512 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -16016,9 +16016,9 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { return Collections.emptyList(); } Preconditions.checkArgumentNonnegative(userHandle, "Invalid userId"); - - final CallerIdentity caller = getCallerIdentity(); - Preconditions.checkCallAuthorization(hasCrossUsersPermission(caller, userHandle)); + Preconditions.checkCallAuthorization( + hasCallingOrSelfPermission(permission.INTERACT_ACROSS_USERS) + || hasCallingOrSelfPermission(permission.INTERACT_ACROSS_USERS_FULL)); synchronized (getLockObject()) { final ActiveAdmin admin = getProfileOwnerAdminLocked(userHandle);