From 37259089a220aeb67a76af2aa60e732e0e623363 Mon Sep 17 00:00:00 2001
From: Alex Johnston <acjohnston@google.com>
Date: Tue, 19 Apr 2022 11:50:55 +0100
Subject: [PATCH] Only a test admin can be unmarked as a COPE admin

Allowing adb and system apps to unmark a COPE admin will have
security implications on the asset mng  guarantee of COPE

Bug: 225834187
Test: com.android.server.devicepolicy.DevicePolicyManagerTest
Change-Id: Ic493c1cb0548ce1a7be4ff57897a4c867c5e0ec3
---
 .../server/devicepolicy/DevicePolicyManagerService.java    | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index c9f2f88a3b49e..58f9d372113a8 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -14649,6 +14649,13 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
             throw new SecurityException(
                     "Only the system can mark a profile owner of organization-owned device.");
         }
+        // Only a test admin can be unmarked as a profile owner on an organization-owned device.
+        synchronized (getLockObject()) {
+            if (!isProfileOwnerOnOrganizationOwnedDevice && !isAdminTestOnlyLocked(who, userId)) {
+                throw new SecurityException("Only a test admin can be unmarked as a "
+                        + "profile owner of organization-owned device.");
+            }
+        }
 
         if (isAdb(caller)) {
             if (hasIncompatibleAccountsOrNonAdbNoLock(caller, userId, who)) {