From b52f6dae9992b01a27c91407da19671981bc1fbf Mon Sep 17 00:00:00 2001 From: Alex Johnston Date: Fri, 9 Sep 2022 14:19:32 +0000 Subject: [PATCH] Fix access control checks getOwnerInstalledCaCerts Prevent the profile owner or device owner from reading ca certs for another user Bug: 235822598 Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest Test: atest com.android.cts.devicepolicy.ProfileOwnerTest#testAdminActionBookkeeping Test: atest com.android.cts.devicepolicy.MixedProfileOwnerTest#testDelegatedCertInstaller Test: atest com.android.cts.devicepolicy.MixedManagedProfileOwnerTest#testDelegatedCertInstaller Change-Id: I014fa1cfb4ddbbbdb86fbb0f948464dc4f5c069e --- .../server/devicepolicy/DevicePolicyManagerService.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index 684ede3d6ed03..d1f5fddd16904 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -18504,9 +18504,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { public StringParceledListSlice getOwnerInstalledCaCerts(@NonNull UserHandle user) { final int userId = user.getIdentifier(); final CallerIdentity caller = getCallerIdentity(); - Preconditions.checkCallAuthorization((userId == caller.getUserId()) - || isProfileOwner(caller) || isDefaultDeviceOwner(caller) - || hasFullCrossUsersPermission(caller, userId)); + Preconditions.checkCallAuthorization( + (isProfileOwner(caller) || isDefaultDeviceOwner(caller) || canQueryAdminPolicy( + caller)) && hasFullCrossUsersPermission(caller, userId)); synchronized (getLockObject()) { return new StringParceledListSlice(