From 7f632dca959784127235e1e7ff138cb62684137f Mon Sep 17 00:00:00 2001
From: Alex Johnston <acjohnston@google.com>
Date: Fri, 23 Jul 2021 14:01:05 +0100
Subject: [PATCH] Stop managed profile owner granting READ_SMS

Reason: There is only one telephony stack shared
between the personal and work profile.

Bug: 194382185
Bug: 189942529
Test: atest com.android.cts.devicepolicy.MixedManagedProfileOwnerTest#testGrantOfSensorsRelatedPermissions
      atest com.android.cts.devicepolicy.MixedManagedProfileOwnerTest#testDenyOfSensorsRelatedPermissions
      atest com.android.cts.devicepolicy.MixedManagedProfileOwnerTest#testSensorsRelatedPermissionsNotGrantedViaPolicy
      atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testGrantOfSensorsRelatedPermissions
      atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testDenyOfSensorsRelatedPermissions
      atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testSensorsRelatedPermissionsNotGrantedViaPolicy
Change-Id: I99384d5713bb2d04f5b6fbe20c17bd72a39b57d7
---
 core/java/android/app/admin/DevicePolicyManager.java | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/core/java/android/app/admin/DevicePolicyManager.java b/core/java/android/app/admin/DevicePolicyManager.java
index 6bc331d323acc..01c9f7036789b 100644
--- a/core/java/android/app/admin/DevicePolicyManager.java
+++ b/core/java/android/app/admin/DevicePolicyManager.java
@@ -10997,6 +10997,16 @@ public class DevicePolicyManager {
      * {@link #EXTRA_PROVISIONING_SENSORS_PERMISSION_GRANT_OPT_OUT} in the provisioning parameters.
      * In that case the device owner's control will be limited do denying these permissions.
      * <p>
+     * NOTE: On devices running {@link android.os.Build.VERSION_CODES#S} and above, control over
+     * the following permissions are restricted for managed profile owners:
+     * <ul>
+     *    <li>Manifest.permission.READ_SMS</li>
+     * </ul>
+     * <p>
+     * A managed profile owner may not grant these permissions (i.e. call this method with any of
+     * the permissions listed above and {@code grantState} of
+     * {@code #PERMISSION_GRANT_STATE_GRANTED}), but may deny them.
+     * <p>
      * Attempts by the admin to grant these permissions, when the admin is restricted from doing
      * so, will be silently ignored (no exception will be thrown).
      *