Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Relax permissions for isUserOfType, isUserNameSet

Browse Source 
* Relaxes isUserNameSet to have the same permission requirements as
  getUserName
* Relaxes isUserOfType to have the same permissions requirements as
  getUserType (although the former is SystemApi and the latter is
TestApi).

Test: android.multiuser.cts.UserManagerTest
Bug: 155116208
Bug: 155114273
Change-Id: I70a9cf98e5ff27f8db8a6616778c7d87bcccb9f9
This commit is contained in:
Adam Bookatz
2022-03-03 12:37:27 -08:00
parent ef439b26ee
commit 48f7d7f056
3 changed files with 26 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/api/system-current.txt
View File

@@ -9828,8 +9828,8 @@ package android.os {
method public boolean isRestrictedProfile();
method @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.CREATE_USERS}, conditional=true) public boolean isRestrictedProfile(@NonNull android.os.UserHandle);
method @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.QUERY_USERS}) public boolean isSameProfileGroup(@NonNull android.os.UserHandle, @NonNull android.os.UserHandle);
method @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.GET_ACCOUNTS_PRIVILEGED}) public boolean isUserNameSet();
method @RequiresPermission(android.Manifest.permission.MANAGE_USERS) public boolean isUserOfType(@NonNull String);
method @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.CREATE_USERS, android.Manifest.permission.QUERY_USERS, android.Manifest.permission.GET_ACCOUNTS_PRIVILEGED}) public boolean isUserNameSet();
method @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.CREATE_USERS, android.Manifest.permission.QUERY_USERS}) public boolean isUserOfType(@NonNull String);
method @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.INTERACT_ACROSS_USERS}, conditional=true) public boolean isUserUnlockingOrUnlocked(@NonNull android.os.UserHandle);
method @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.CREATE_USERS}) public boolean removeUser(@NonNull android.os.UserHandle);
method @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.CREATE_USERS}) public int removeUserWhenPossible(@NonNull android.os.UserHandle, boolean);

19
core/java/android/os/UserManager.java
View File

@@ -2155,9 +2155,17 @@ public class UserManager {
* @hide
*/
@SystemApi
@RequiresPermission(anyOf = {Manifest.permission.MANAGE_USERS,
Manifest.permission.GET_ACCOUNTS_PRIVILEGED})
@UserHandleAware(enabledSinceTargetSdkVersion = Build.VERSION_CODES.TIRAMISU)
@RequiresPermission(anyOf = {
android.Manifest.permission.MANAGE_USERS,
android.Manifest.permission.CREATE_USERS,
android.Manifest.permission.QUERY_USERS,
android.Manifest.permission.GET_ACCOUNTS_PRIVILEGED})
@UserHandleAware(
enabledSinceTargetSdkVersion = Build.VERSION_CODES.TIRAMISU,
requiresAnyOfPermissionsIfNotCaller = {
android.Manifest.permission.MANAGE_USERS,
android.Manifest.permission.CREATE_USERS,
android.Manifest.permission.QUERY_USERS})
public boolean isUserNameSet() {
try {
return mService.isUserNameSet(getContextUserIfAppropriate());
@@ -2261,8 +2269,11 @@ public class UserManager {
* @hide
*/
@SystemApi
@RequiresPermission(anyOf = {
android.Manifest.permission.MANAGE_USERS,
android.Manifest.permission.CREATE_USERS,
android.Manifest.permission.QUERY_USERS})
@UserHandleAware
@RequiresPermission(android.Manifest.permission.MANAGE_USERS)
public boolean isUserOfType(@NonNull String userType) {
try {
return mService.isUserOfType(mUserId, userType);

14
services/core/java/com/android/server/pm/UserManagerService.java
View File

@@ -1387,7 +1387,7 @@ public class UserManagerService extends IUserManager.Stub {
*/
@Override
public boolean isUserOfType(@UserIdInt int userId, String userType) {
checkManageUsersPermission("check user type");
checkQueryOrCreateUsersPermission("check user type");
return userType != null && userType.equals(getUserTypeNoChecks(userId));
}
@@ -1643,7 +1643,7 @@ public class UserManagerService extends IUserManager.Stub {
if (!hasQueryOrCreateUsersPermission()
&& !hasPermissionGranted(
android.Manifest.permission.GET_ACCOUNTS_PRIVILEGED, callingUid)) {
throw new SecurityException("You need MANAGE_USERS or CREATE_USERS or "
throw new SecurityException("You need MANAGE_USERS, CREATE_USERS, QUERY_USERS, or "
+ "GET_ACCOUNTS_PRIVILEGED permissions to: get user name");
}
final int userId = UserHandle.getUserId(callingUid);
@@ -5064,9 +5064,13 @@ public class UserManagerService extends IUserManager.Stub {
@Override
public boolean isUserNameSet(@UserIdInt int userId) {
if (!hasManageUsersOrPermission(android.Manifest.permission.GET_ACCOUNTS_PRIVILEGED)) {
throw new SecurityException("You need MANAGE_USERS or GET_ACCOUNTS_PRIVILEGED "
+ "permissions to: get whether user name is set");
final int callingUid = Binder.getCallingUid();
final int callingUserId = UserHandle.getUserId(callingUid);
if (!hasQueryOrCreateUsersPermission()
&& !(callingUserId == userId && hasPermissionGranted(
android.Manifest.permission.GET_ACCOUNTS_PRIVILEGED, callingUid))) {
throw new SecurityException("You need MANAGE_USERS, CREATE_USERS, QUERY_USERS, or "
+ "GET_ACCOUNTS_PRIVILEGED permissions to: get whether user name is set");
}
synchronized (mUsersLock) {
final UserInfo userInfo = getUserInfoLU(userId);