Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Allows DPM.generateKeyPair() to be called from PO of affiliated user." into sc-v2-dev

Browse Source
This commit is contained in:
Felipe Leme
2022-02-25 04:47:34 +00:00
committed by Android (Google) Code Review
parent 009e56f32c e8caa07e9f
commit 4459afb810
2 changed files with 23 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
core/java/android/app/admin/DevicePolicyManager.java
View File

@@ -6388,10 +6388,10 @@ public class DevicePolicyManager {
* management app can use {@link #ID_TYPE_BASE_INFO} to request inclusion of the general device
* information including manufacturer, model, brand, device and product in the attestation
* record.
* Only device owner, profile owner on an organization-owned device and their delegated
* certificate installers can use {@link #ID_TYPE_SERIAL}, {@link #ID_TYPE_IMEI} and
* {@link #ID_TYPE_MEID} to request unique device identifiers to be attested (the serial number,
* IMEI and MEID correspondingly), if supported by the device
* Only device owner, profile owner on an organization-owned device or affiliated user, and
* their delegated certificate installers can use {@link #ID_TYPE_SERIAL}, {@link #ID_TYPE_IMEI}
* and {@link #ID_TYPE_MEID} to request unique device identifiers to be attested (the serial
* number, IMEI and MEID correspondingly), if supported by the device
* (see {@link #isDeviceIdAttestationSupported()}).
* Additionally, device owner, profile owner on an organization-owned device and their delegated
* certificate installers can also request the attestation record to be signed using an

27
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -5894,6 +5894,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
* (1.1) The caller is the Device Owner
* (1.2) The caller is another app in the same user as the device owner, AND
* The caller is the delegated certificate installer.
* (1.3) The caller is a Profile Owner and the calling user is affiliated.
* (2) The user has a profile owner, AND:
* (2.1) The profile owner has been granted access to Device IDs and one of the following
* holds:
@@ -5919,12 +5920,14 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
* If the caller is from the work profile, then it must be the PO or the delegate, and
* it must have the right permission to access device identifiers.
*/
if (hasProfileOwner(caller.getUserId())) {
int callerUserId = caller.getUserId();
if (hasProfileOwner(callerUserId)) {
// Make sure that the caller is the profile owner or delegate.
Preconditions.checkCallAuthorization(canInstallCertificates(caller));
// Verify that the managed profile is on an organization-owned device and as such
// the profile owner can access Device IDs.
if (isProfileOwnerOfOrganizationOwnedDevice(caller.getUserId())) {
// Verify that the managed profile is on an organization-owned device (or is affiliated
// with the device owner user) and as such the profile owner can access Device IDs.
if (isProfileOwnerOfOrganizationOwnedDevice(callerUserId)
|| isUserAffiliatedWithDevice(callerUserId)) {
return;
}
throw new SecurityException(
@@ -9305,10 +9308,11 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
return false;
}
// Allow access to the device owner or delegate cert installer.
// Allow access to the device owner or delegate cert installer or profile owner of an
// affiliated user
ComponentName deviceOwner = getDeviceOwnerComponent(true);
if (deviceOwner != null && (deviceOwner.getPackageName().equals(packageName)
|| isCallerDelegate(packageName, uid, DELEGATION_CERT_INSTALL))) {
|| isCallerDelegate(packageName, uid, DELEGATION_CERT_INSTALL))) {
return true;
}
final int userId = UserHandle.getUserId(uid);
@@ -9318,7 +9322,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
final boolean isCallerProfileOwnerOrDelegate = profileOwner != null
&& (profileOwner.getPackageName().equals(packageName)
|| isCallerDelegate(packageName, uid, DELEGATION_CERT_INSTALL));
if (isCallerProfileOwnerOrDelegate && isProfileOwnerOfOrganizationOwnedDevice(userId)) {
if (isCallerProfileOwnerOrDelegate && (isProfileOwnerOfOrganizationOwnedDevice(userId)
|| isUserAffiliatedWithDevice(userId))) {
return true;
}
@@ -14602,7 +14607,13 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
final CallerIdentity caller = getCallerIdentity();
Preconditions.checkCallAuthorization(hasCrossUsersPermission(caller, userId));
return isUserAffiliatedWithDeviceLocked(userId);
return isUserAffiliatedWithDevice(userId);
}
private boolean isUserAffiliatedWithDevice(@UserIdInt int userId) {
synchronized (getLockObject()) {
return isUserAffiliatedWithDeviceLocked(userId);
}
}
private boolean isUserAffiliatedWithDeviceLocked(@UserIdInt int userId) {