Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[RESTRICT AUTOMERGE] Prevent installing apps in policy restricted work profile using ADB

Browse Source 
If DISALLOW_DEBUGGING_FEATURES or DISALLOW_INSTALL_APPS restrictions are
set on a work profile, prevent side loading of APKs using ADB in the
work profile.

Bug: 257443065
Test: atest CtsPackageInstallTestCases:UserRestrictionInstallTest

Merged-In: I169a1f72c84528ca606b6a4da165d4fbcd02b08d

Change-Id: I169a1f72c84528ca606b6a4da165d4fbcd02b08d
(cherry picked from commit febe391802)
This commit is contained in:
Sumedh Sen
2023-03-23 16:29:47 -07:00
parent 5206e4ebd2
commit 28e133dff1
1 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
services/core/java/com/android/server/pm/InstallPackageHelper.java
View File

@@ -2093,9 +2093,25 @@ final class InstallPackageHelper {
// The caller explicitly specified INSTALL_ALL_USERS flag. // The caller explicitly specified INSTALL_ALL_USERS flag.
// Thus, updating the settings to install the app for all users. // Thus, updating the settings to install the app for all users.
for (int currentUserId : allUsers) { for (int currentUserId : allUsers) {
// If the app is already installed for the currentUser,
// keep it as installed as we might be updating the app at this place.
// If not currently installed, check if the currentUser is restricted by
// DISALLOW_INSTALL_APPS or DISALLOW_DEBUGGING_FEATURES device policy.
// Install / update the app if the user isn't restricted. Skip otherwise.
final boolean installedForCurrentUser = ArrayUtils.contains(
installedForUsers, currentUserId);
final boolean restrictedByPolicy =
mPm.isUserRestricted(currentUserId,
UserManager.DISALLOW_INSTALL_APPS)
|| mPm.isUserRestricted(currentUserId,
UserManager.DISALLOW_DEBUGGING_FEATURES);
if (installedForCurrentUser || !restrictedByPolicy) {
ps.setInstalled(true, currentUserId); ps.setInstalled(true, currentUserId);
ps.setEnabled(COMPONENT_ENABLED_STATE_DEFAULT, userId, ps.setEnabled(COMPONENT_ENABLED_STATE_DEFAULT, currentUserId,
installerPackageName); installerPackageName);
} else {
ps.setInstalled(false, currentUserId);
}
} }
} }