From 9c3627ab872738258dfbdeeba6e5a7b51dd3a340 Mon Sep 17 00:00:00 2001
From: Felipe Leme <felipeal@google.com>
Date: Wed, 24 Mar 2021 19:29:15 -0700
Subject: [PATCH] Integrated policy-exempt-apps into setApplicationHidden().

Test: atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testApplicationHidden_cannotHidePolicyExemptApps,testApplicationHidden # on phone and automotive
Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest

Bug: 181238156

Change-Id: Id5e194703f1bb5f56be777beae8e0a6cee54890f
---
 .../DevicePolicyManagerService.java             | 17 +++++++++++++++--
 .../devicepolicy/DevicePolicyManagerTest.java   |  9 +++++++++
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 807edca939d7b..00a1786d28db8 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -10692,10 +10692,12 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
     private String[] populateNonExemptAndExemptFromPolicyApps(String[] packageNames,
             Set<String> outputExemptApps) {
         Preconditions.checkArgument(outputExemptApps.isEmpty(), "outputExemptApps is not empty");
-        List<String> exemptApps = listPolicyExemptAppsUnchecked();
-        if (exemptApps.isEmpty()) {
+        List<String> exemptAppsList = listPolicyExemptAppsUnchecked();
+        if (exemptAppsList.isEmpty()) {
             return packageNames;
         }
+        // Using a set so contains() is O(1)
+        Set<String> exemptApps = new HashSet<>(exemptAppsList);
         List<String> nonExemptApps = new ArrayList<>(packageNames.length);
         for (int i = 0; i < packageNames.length; i++) {
             String app = packageNames[i];
@@ -10974,6 +10976,13 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
                 && (isProfileOwner(caller) || isDeviceOwner(caller)))
                 || (caller.hasPackage() && isCallerDelegate(caller, DELEGATION_PACKAGE_ACCESS)));
 
+        List<String> exemptApps = listPolicyExemptAppsUnchecked();
+        if (exemptApps.contains(packageName)) {
+            Slog.d(LOG_TAG, "setApplicationHidden(): ignoring %s as it's on policy-exempt list",
+                    packageName);
+            return false;
+        }
+
         final int userId = parent ? getProfileParentId(caller.getUserId()) : caller.getUserId();
         boolean result;
         synchronized (getLockObject()) {
@@ -10988,6 +10997,10 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
             }
             checkCanExecuteOrThrowUnsafe(DevicePolicyManager.OPERATION_SET_APPLICATION_HIDDEN);
 
+            if (VERBOSE_LOG) {
+                Slog.v(LOG_TAG, "calling pm.setApplicationHiddenSettingAsUser(%s, %b, %d)",
+                        packageName, hidden, userId);
+            }
             result = mInjector.binderWithCleanCallingIdentity(() -> mIPackageManager
                     .setApplicationHiddenSettingAsUser(packageName, hidden, userId));
         }
diff --git a/services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java b/services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java
index cc206a1353b88..6113e4c8ff0fc 100644
--- a/services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java
+++ b/services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java
@@ -2569,6 +2569,7 @@ public class DevicePolicyManagerTest extends DpmTestBase {
         setupDeviceOwner();
         mContext.packageName = admin1.getPackageName();
         setUpPackageManagerForAdmin(admin1, mContext.binder.callingUid);
+        mockEmptyPolicyExemptApps();
 
         String packageName = "com.google.android.test";
 
@@ -2598,6 +2599,7 @@ public class DevicePolicyManagerTest extends DpmTestBase {
         configureProfileOwnerOfOrgOwnedDevice(admin1, CALLER_USER_HANDLE);
         mContext.packageName = admin1.getPackageName();
         setUpPackageManagerForAdmin(admin1, mContext.binder.callingUid);
+        mockEmptyPolicyExemptApps();
 
         String packageName = "com.google.android.test";
 
@@ -7489,4 +7491,11 @@ public class DevicePolicyManagerTest extends DpmTestBase {
         Log.d(TAG, "Mocking R.array.vendor_policy_exempt_apps to return " + Arrays.toString(apps));
         when(mContext.resources.getStringArray(R.array.vendor_policy_exempt_apps)).thenReturn(apps);
     }
+
+    private void mockEmptyPolicyExemptApps() {
+        when(mContext.getResources().getStringArray(R.array.policy_exempt_apps))
+                .thenReturn(new String[0]);
+        when(mContext.getResources().getStringArray(R.array.vendor_policy_exempt_apps))
+                .thenReturn(new String[0]);
+    }
 }