Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Merge check Device ID logic in DPMS"

Browse Source
This commit is contained in:
Eghosa Ewansiha-Vlachavas
2022-08-24 08:24:07 +00:00
committed by Android (Google) Code Review
parent a8daba0e25 713cf9ac12
commit 22301bbe8b
1 changed files with 15 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -5786,29 +5786,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
@VisibleForTesting
public void enforceCallerCanRequestDeviceIdAttestation(CallerIdentity caller)
throws SecurityException {
/**
* First check if there's a profile owner because the device could be in COMP mode (where
* there's a device owner and profile owner on the same device).
* If the caller is from the work profile, then it must be the PO or the delegate, and
* it must have the right permission to access device identifiers.
*/
int callerUserId = caller.getUserId();
if (hasProfileOwner(callerUserId)) {
// Make sure that the caller is the profile owner or delegate.
Preconditions.checkCallAuthorization(canInstallCertificates(caller));
// Verify that the managed profile is on an organization-owned device (or is affiliated
// with the device owner user) and as such the profile owner can access Device IDs.
if (isProfileOwnerOfOrganizationOwnedDevice(callerUserId)
|| isUserAffiliatedWithDevice(callerUserId)) {
return;
}
throw new SecurityException(
"Profile Owner is not allowed to access Device IDs.");
}
// If not, fall back to the device owner check.
Preconditions.checkCallAuthorization(
isDefaultDeviceOwner(caller) || isCallerDelegate(caller, DELEGATION_CERT_INSTALL));
Preconditions.checkCallAuthorization(hasDeviceIdAccessUnchecked(caller.getPackageName(),
caller.getUid()));
}
@VisibleForTesting
@@ -5856,7 +5835,6 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
final boolean deviceIdAttestationRequired = attestationUtilsFlags != null;
KeyGenParameterSpec keySpec = parcelableKeySpec.getSpec();
final String alias = keySpec.getKeystoreAlias();
Preconditions.checkStringNotEmpty(alias, "Empty alias provided");
Preconditions.checkArgument(
!deviceIdAttestationRequired || keySpec.getAttestationChallenge() != null,
@@ -9393,26 +9371,33 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
if (!hasPermission(permission.READ_PHONE_STATE, pid, uid)) {
return false;
}
return hasDeviceIdAccessUnchecked(packageName, uid);
}
// Allow access to the device owner or delegate cert installer or profile owner of an
// affiliated user
/**
* Check if caller is device owner, delegate cert installer or profile owner of
* affiliated user. Or if caller is profile owner for a specified user or delegate cert
* installer on an organization-owned device.
*/
private boolean hasDeviceIdAccessUnchecked(String packageName, int uid) {
// Is the caller a device owner, delegate cert installer or profile owner of an
// affiliated user.
ComponentName deviceOwner = getDeviceOwnerComponent(true);
if (deviceOwner != null && (deviceOwner.getPackageName().equals(packageName)
|| isCallerDelegate(packageName, uid, DELEGATION_CERT_INSTALL))) {
return true;
}
final int userId = UserHandle.getUserId(uid);
// Allow access to the profile owner for the specified user, or delegate cert installer
// But only if this is an organization-owned device.
// Is the caller the profile owner for the specified user, or delegate cert installer on an
// organization-owned device.
ComponentName profileOwner = getProfileOwnerAsUser(userId);
final boolean isCallerProfileOwnerOrDelegate = profileOwner != null
&& (profileOwner.getPackageName().equals(packageName)
|| isCallerDelegate(packageName, uid, DELEGATION_CERT_INSTALL));
|| isCallerDelegate(packageName, uid, DELEGATION_CERT_INSTALL));
if (isCallerProfileOwnerOrDelegate && (isProfileOwnerOfOrganizationOwnedDevice(userId)
|| isUserAffiliatedWithDevice(userId))) {
return true;
}
return false;
}