Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Clear calling identity when accessing isProfileOwner and listAllOwners

Browse Source 
Last year we added a security fix ag/12968597 to address
b/153995973. Now, some DPM methods require the interact
across users permission, unlike in R. This CL aims to
prevent potential security exceptions in these methods
by clearing their calling identity.

Bug: 182279073
Test: atest DevicePolicyManagerTest
Change-Id: Ie861a7880160563f9613db72e3283edac294a7a1
This commit is contained in:
arangelov
2021-05-24 18:48:06 +01:00
parent 5f28ee3e52
commit 522076dec3
1 changed files with 15 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -1207,16 +1207,16 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
List<OwnerDto> listAllOwners() {
Preconditions.checkCallAuthorization(
hasCallingOrSelfPermission(permission.MANAGE_DEVICE_ADMINS));
List<OwnerDto> owners = mOwners.listAllOwners();
synchronized (getLockObject()) {
for (int i = 0; i < owners.size(); i++) {
OwnerDto owner = owners.get(i);
owner.isAffiliated = isUserAffiliatedWithDeviceLocked(owner.userId);
return mInjector.binderWithCleanCallingIdentity(() -> {
List<OwnerDto> owners = mOwners.listAllOwners();
synchronized (getLockObject()) {
for (int i = 0; i < owners.size(); i++) {
OwnerDto owner = owners.get(i);
owner.isAffiliated = isUserAffiliatedWithDeviceLocked(owner.userId);
}
}
}
return owners;
return owners;
});
}
/**
@@ -8341,7 +8341,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
}
public boolean isProfileOwner(ComponentName who, int userId) {
final ComponentName profileOwner = getProfileOwnerAsUser(userId);
final ComponentName profileOwner = mInjector.binderWithCleanCallingIdentity(() ->
getProfileOwnerAsUser(userId));
return who != null && who.equals(profileOwner);
}
@@ -8358,7 +8359,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
*/
public boolean isProfileOwner(CallerIdentity caller) {
synchronized (getLockObject()) {
final ComponentName profileOwner = getProfileOwnerAsUser(caller.getUserId());
final ComponentName profileOwner = mInjector.binderWithCleanCallingIdentity(() ->
getProfileOwnerAsUser(caller.getUserId()));
// No profile owner.
if (profileOwner == null) {
return false;
@@ -8980,7 +8982,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
Preconditions.checkArgumentNonnegative(userId, "Invalid userId");
CallerIdentity caller = getCallerIdentity();
Preconditions.checkCallAuthorization(hasCrossUsersPermission(caller, userId));
Preconditions.checkCallAuthorization(hasCrossUsersPermission(caller, userId)
|| hasFullCrossUsersPermission(caller, userId));
synchronized (getLockObject()) {
return mOwners.getProfileOwnerComponent(userId);