From efae78ed2b46bb7807765c21fdea857b648ad130 Mon Sep 17 00:00:00 2001 From: Rubin Xu Date: Fri, 24 Sep 2021 14:59:04 +0100 Subject: [PATCH] Lockdown DPMS.getOrganizationNameForUser() Only allow system components to call this hidden API. Bug: 192368508 Test: atest FrameworksServicesTests:DevicePolicyManagerTest Change-Id: I740943195f016b30607d4103a54ca0fe04d31f8a --- .../server/devicepolicy/DevicePolicyManagerService.java | 1 + .../server/devicepolicy/DevicePolicyManagerTest.java | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index 193d92a3b2ff9..bd0d430c72911 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -14060,6 +14060,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { final CallerIdentity caller = getCallerIdentity(); Preconditions.checkCallAuthorization(hasFullCrossUsersPermission(caller, userHandle)); + Preconditions.checkCallAuthorization(canManageUsers(caller)); Preconditions.checkCallAuthorization(isManagedProfile(userHandle), "You can not get organization name outside a managed profile, userId = %d", userHandle); diff --git a/services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java b/services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java index 7b20bf0f6bc70..63e4efc1cce09 100644 --- a/services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java +++ b/services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java @@ -7753,6 +7753,12 @@ public class DevicePolicyManagerTest extends DpmTestBase { DpmMockContext.CALLER_SYSTEM_USER_UID, admin1.getPackageName(), MODE_DEFAULT); } + @Test + public void testGetOrganizationNameForUser_calledByNonPrivilegedApp_throwsException() { + assertExpectException(SecurityException.class, "Calling identity is not authorized", + () -> dpm.getOrganizationNameForUser(UserHandle.USER_SYSTEM)); + } + private void setupVpnAuthorization(String userVpnPackage, int userVpnUid) { final AppOpsManager.PackageOps vpnOp = new AppOpsManager.PackageOps(userVpnPackage, userVpnUid, List.of(new AppOpsManager.OpEntry(