Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Fix non-inclusive terms in framework device policy logic"

Browse Source
This commit is contained in:
Treehugger Robot
2020-10-09 16:19:46 +00:00
committed by Gerrit Code Review
parent 9e388035c9 d40199b5b2
commit 64add27a7c
4 changed files with 68 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
core/java/android/app/admin/DevicePolicyManager.java
View File

@@ -5718,8 +5718,8 @@ public class DevicePolicyManager {
* System apps can always bypass VPN. * System apps can always bypass VPN.
* <p> Note that the system doesn't update the allowlist when packages are installed or * <p> Note that the system doesn't update the allowlist when packages are installed or
* uninstalled, the admin app must call this method to keep the list up to date. * uninstalled, the admin app must call this method to keep the list up to date.
* <p> When {@code lockdownEnabled} is false {@code lockdownWhitelist} is ignored . When * <p> When {@code lockdownEnabled} is false {@code lockdownAllowlist} is ignored . When
* {@code lockdownEnabled} is {@code true} and {@code lockdownWhitelist} is {@code null} or * {@code lockdownEnabled} is {@code true} and {@code lockdownAllowlist} is {@code null} or
* empty, only system apps can bypass VPN. * empty, only system apps can bypass VPN.
* <p> Setting always-on VPN package to {@code null} or using * <p> Setting always-on VPN package to {@code null} or using
* {@link #setAlwaysOnVpnPackage(ComponentName, String, boolean)} clears lockdown allowlist. * {@link #setAlwaysOnVpnPackage(ComponentName, String, boolean)} clears lockdown allowlist.
@@ -5728,24 +5728,24 @@ public class DevicePolicyManager {
* to remove an existing always-on VPN configuration * to remove an existing always-on VPN configuration
* @param lockdownEnabled {@code true} to disallow networking when the VPN is not connected or * @param lockdownEnabled {@code true} to disallow networking when the VPN is not connected or
* {@code false} otherwise. This has no effect when clearing. * {@code false} otherwise. This has no effect when clearing.
* @param lockdownWhitelist Packages that will be able to access the network directly when VPN * @param lockdownAllowlist Packages that will be able to access the network directly when VPN
* is in lockdown mode but not connected. Has no effect when clearing. * is in lockdown mode but not connected. Has no effect when clearing.
* @throws SecurityException if {@code admin} is not a device or a profile * @throws SecurityException if {@code admin} is not a device or a profile
* owner. * owner.
* @throws NameNotFoundException if {@code vpnPackage} or one of * @throws NameNotFoundException if {@code vpnPackage} or one of
* {@code lockdownWhitelist} is not installed. * {@code lockdownAllowlist} is not installed.
* @throws UnsupportedOperationException if {@code vpnPackage} exists but does * @throws UnsupportedOperationException if {@code vpnPackage} exists but does
* not support being set as always-on, or if always-on VPN is not * not support being set as always-on, or if always-on VPN is not
* available. * available.
*/ */
public void setAlwaysOnVpnPackage(@NonNull ComponentName admin, @Nullable String vpnPackage, public void setAlwaysOnVpnPackage(@NonNull ComponentName admin, @Nullable String vpnPackage,
boolean lockdownEnabled, @Nullable Set<String> lockdownWhitelist) boolean lockdownEnabled, @Nullable Set<String> lockdownAllowlist)
throws NameNotFoundException { throws NameNotFoundException {
throwIfParentInstance("setAlwaysOnVpnPackage"); throwIfParentInstance("setAlwaysOnVpnPackage");
if (mService != null) { if (mService != null) {
try { try {
mService.setAlwaysOnVpnPackage(admin, vpnPackage, lockdownEnabled, mService.setAlwaysOnVpnPackage(admin, vpnPackage, lockdownEnabled,
lockdownWhitelist == null ? null : new ArrayList<>(lockdownWhitelist)); lockdownAllowlist == null ? null : new ArrayList<>(lockdownAllowlist));
} catch (ServiceSpecificException e) { } catch (ServiceSpecificException e) {
switch (e.errorCode) { switch (e.errorCode) {
case ERROR_VPN_PACKAGE_NOT_FOUND: case ERROR_VPN_PACKAGE_NOT_FOUND:
@@ -5820,9 +5820,9 @@ public class DevicePolicyManager {
throwIfParentInstance("getAlwaysOnVpnLockdownWhitelist"); throwIfParentInstance("getAlwaysOnVpnLockdownWhitelist");
if (mService != null) { if (mService != null) {
try { try {
final List<String> whitelist = final List<String> allowlist =
mService.getAlwaysOnVpnLockdownWhitelist(admin); mService.getAlwaysOnVpnLockdownAllowlist(admin);
return whitelist == null ? null : new HashSet<>(whitelist); return allowlist == null ? null : new HashSet<>(allowlist);
} catch (RemoteException e) { } catch (RemoteException e) {
throw e.rethrowFromSystemServer(); throw e.rethrowFromSystemServer();
} }

20
core/java/android/app/admin/FreezePeriod.java
View File

@@ -39,8 +39,8 @@ import java.util.List;
public class FreezePeriod { public class FreezePeriod {
private static final String TAG = "FreezePeriod"; private static final String TAG = "FreezePeriod";
private static final int DUMMY_YEAR = 2001; private static final int SENTINEL_YEAR = 2001;
static final int DAYS_IN_YEAR = 365; // 365 since DUMMY_YEAR is not a leap year static final int DAYS_IN_YEAR = 365; // 365 since SENTINEL_YEAR is not a leap year
private final MonthDay mStart; private final MonthDay mStart;
private final MonthDay mEnd; private final MonthDay mEnd;
@@ -60,9 +60,9 @@ public class FreezePeriod {
*/ */
public FreezePeriod(MonthDay start, MonthDay end) { public FreezePeriod(MonthDay start, MonthDay end) {
mStart = start; mStart = start;
mStartDay = mStart.atYear(DUMMY_YEAR).getDayOfYear(); mStartDay = mStart.atYear(SENTINEL_YEAR).getDayOfYear();
mEnd = end; mEnd = end;
mEndDay = mEnd.atYear(DUMMY_YEAR).getDayOfYear(); mEndDay = mEnd.atYear(SENTINEL_YEAR).getDayOfYear();
} }
/** /**
@@ -166,9 +166,9 @@ public class FreezePeriod {
endYearAdjustment = 1; endYearAdjustment = 1;
} }
} }
final LocalDate startDate = LocalDate.ofYearDay(DUMMY_YEAR, mStartDay).withYear( final LocalDate startDate = LocalDate.ofYearDay(SENTINEL_YEAR, mStartDay).withYear(
now.getYear() + startYearAdjustment); now.getYear() + startYearAdjustment);
final LocalDate endDate = LocalDate.ofYearDay(DUMMY_YEAR, mEndDay).withYear( final LocalDate endDate = LocalDate.ofYearDay(SENTINEL_YEAR, mEndDay).withYear(
now.getYear() + endYearAdjustment); now.getYear() + endYearAdjustment);
return new Pair<>(startDate, endDate); return new Pair<>(startDate, endDate);
} }
@@ -176,13 +176,13 @@ public class FreezePeriod {
@Override @Override
public String toString() { public String toString() {
DateTimeFormatter formatter = DateTimeFormatter.ofPattern("MMM dd"); DateTimeFormatter formatter = DateTimeFormatter.ofPattern("MMM dd");
return LocalDate.ofYearDay(DUMMY_YEAR, mStartDay).format(formatter) + " - " return LocalDate.ofYearDay(SENTINEL_YEAR, mStartDay).format(formatter) + " - "
+ LocalDate.ofYearDay(DUMMY_YEAR, mEndDay).format(formatter); + LocalDate.ofYearDay(SENTINEL_YEAR, mEndDay).format(formatter);
} }
/** @hide */ /** @hide */
private static MonthDay dayOfYearToMonthDay(int dayOfYear) { private static MonthDay dayOfYearToMonthDay(int dayOfYear) {
LocalDate date = LocalDate.ofYearDay(DUMMY_YEAR, dayOfYear); LocalDate date = LocalDate.ofYearDay(SENTINEL_YEAR, dayOfYear);
return MonthDay.of(date.getMonth(), date.getDayOfMonth()); return MonthDay.of(date.getMonth(), date.getDayOfMonth());
} }
@@ -191,7 +191,7 @@ public class FreezePeriod {
* @hide * @hide
*/ */
private static int dayOfYearDisregardLeapYear(LocalDate date) { private static int dayOfYearDisregardLeapYear(LocalDate date) {
return date.withYear(DUMMY_YEAR).getDayOfYear(); return date.withYear(SENTINEL_YEAR).getDayOfYear();
} }
/** /**

4
core/java/android/app/admin/IDevicePolicyManager.aidl
View File

@@ -197,12 +197,12 @@ interface IDevicePolicyManager {
void setCertInstallerPackage(in ComponentName who, String installerPackage); void setCertInstallerPackage(in ComponentName who, String installerPackage);
String getCertInstallerPackage(in ComponentName who); String getCertInstallerPackage(in ComponentName who);
boolean setAlwaysOnVpnPackage(in ComponentName who, String vpnPackage, boolean lockdown, in List<String> lockdownWhitelist); boolean setAlwaysOnVpnPackage(in ComponentName who, String vpnPackage, boolean lockdown, in List<String> lockdownAllowlist);
String getAlwaysOnVpnPackage(in ComponentName who); String getAlwaysOnVpnPackage(in ComponentName who);
String getAlwaysOnVpnPackageForUser(int userHandle); String getAlwaysOnVpnPackageForUser(int userHandle);
boolean isAlwaysOnVpnLockdownEnabled(in ComponentName who); boolean isAlwaysOnVpnLockdownEnabled(in ComponentName who);
boolean isAlwaysOnVpnLockdownEnabledForUser(int userHandle); boolean isAlwaysOnVpnLockdownEnabledForUser(int userHandle);
List<String> getAlwaysOnVpnLockdownWhitelist(in ComponentName who); List<String> getAlwaysOnVpnLockdownAllowlist(in ComponentName who);
void addPersistentPreferredActivity(in ComponentName admin, in IntentFilter filter, in ComponentName activity); void addPersistentPreferredActivity(in ComponentName admin, in IntentFilter filter, in ComponentName activity);
void clearPackagePersistentPreferredActivities(in ComponentName admin, String packageName); void clearPackagePersistentPreferredActivities(in ComponentName admin, String packageName);

94
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -480,38 +480,38 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
private static final int STATUS_BAR_DISABLE2_MASK = private static final int STATUS_BAR_DISABLE2_MASK =
StatusBarManager.DISABLE2_QUICK_SETTINGS; StatusBarManager.DISABLE2_QUICK_SETTINGS;
private static final Set<String> SECURE_SETTINGS_WHITELIST; private static final Set<String> SECURE_SETTINGS_ALLOWLIST;
private static final Set<String> SECURE_SETTINGS_DEVICEOWNER_WHITELIST; private static final Set<String> SECURE_SETTINGS_DEVICEOWNER_ALLOWLIST;
private static final Set<String> GLOBAL_SETTINGS_WHITELIST; private static final Set<String> GLOBAL_SETTINGS_ALLOWLIST;
private static final Set<String> GLOBAL_SETTINGS_DEPRECATED; private static final Set<String> GLOBAL_SETTINGS_DEPRECATED;
private static final Set<String> SYSTEM_SETTINGS_WHITELIST; private static final Set<String> SYSTEM_SETTINGS_ALLOWLIST;
private static final Set<Integer> DA_DISALLOWED_POLICIES; private static final Set<Integer> DA_DISALLOWED_POLICIES;
// A collection of user restrictions that are deprecated and should simply be ignored. // A collection of user restrictions that are deprecated and should simply be ignored.
private static final Set<String> DEPRECATED_USER_RESTRICTIONS; private static final Set<String> DEPRECATED_USER_RESTRICTIONS;
private static final String AB_DEVICE_KEY = "ro.build.ab_update"; private static final String AB_DEVICE_KEY = "ro.build.ab_update";
static { static {
SECURE_SETTINGS_WHITELIST = new ArraySet<>(); SECURE_SETTINGS_ALLOWLIST = new ArraySet<>();
SECURE_SETTINGS_WHITELIST.add(Settings.Secure.DEFAULT_INPUT_METHOD); SECURE_SETTINGS_ALLOWLIST.add(Settings.Secure.DEFAULT_INPUT_METHOD);
SECURE_SETTINGS_WHITELIST.add(Settings.Secure.SKIP_FIRST_USE_HINTS); SECURE_SETTINGS_ALLOWLIST.add(Settings.Secure.SKIP_FIRST_USE_HINTS);
SECURE_SETTINGS_WHITELIST.add(Settings.Secure.INSTALL_NON_MARKET_APPS); SECURE_SETTINGS_ALLOWLIST.add(Settings.Secure.INSTALL_NON_MARKET_APPS);
SECURE_SETTINGS_DEVICEOWNER_WHITELIST = new ArraySet<>(); SECURE_SETTINGS_DEVICEOWNER_ALLOWLIST = new ArraySet<>();
SECURE_SETTINGS_DEVICEOWNER_WHITELIST.addAll(SECURE_SETTINGS_WHITELIST); SECURE_SETTINGS_DEVICEOWNER_ALLOWLIST.addAll(SECURE_SETTINGS_ALLOWLIST);
SECURE_SETTINGS_DEVICEOWNER_WHITELIST.add(Settings.Secure.LOCATION_MODE); SECURE_SETTINGS_DEVICEOWNER_ALLOWLIST.add(Settings.Secure.LOCATION_MODE);
GLOBAL_SETTINGS_WHITELIST = new ArraySet<>(); GLOBAL_SETTINGS_ALLOWLIST = new ArraySet<>();
GLOBAL_SETTINGS_WHITELIST.add(Settings.Global.ADB_ENABLED); GLOBAL_SETTINGS_ALLOWLIST.add(Settings.Global.ADB_ENABLED);
GLOBAL_SETTINGS_WHITELIST.add(Settings.Global.ADB_WIFI_ENABLED); GLOBAL_SETTINGS_ALLOWLIST.add(Settings.Global.ADB_WIFI_ENABLED);
GLOBAL_SETTINGS_WHITELIST.add(Settings.Global.AUTO_TIME); GLOBAL_SETTINGS_ALLOWLIST.add(Settings.Global.AUTO_TIME);
GLOBAL_SETTINGS_WHITELIST.add(Settings.Global.AUTO_TIME_ZONE); GLOBAL_SETTINGS_ALLOWLIST.add(Settings.Global.AUTO_TIME_ZONE);
GLOBAL_SETTINGS_WHITELIST.add(Settings.Global.DATA_ROAMING); GLOBAL_SETTINGS_ALLOWLIST.add(Settings.Global.DATA_ROAMING);
GLOBAL_SETTINGS_WHITELIST.add(Settings.Global.USB_MASS_STORAGE_ENABLED); GLOBAL_SETTINGS_ALLOWLIST.add(Settings.Global.USB_MASS_STORAGE_ENABLED);
GLOBAL_SETTINGS_WHITELIST.add(Settings.Global.WIFI_SLEEP_POLICY); GLOBAL_SETTINGS_ALLOWLIST.add(Settings.Global.WIFI_SLEEP_POLICY);
GLOBAL_SETTINGS_WHITELIST.add(Settings.Global.STAY_ON_WHILE_PLUGGED_IN); GLOBAL_SETTINGS_ALLOWLIST.add(Settings.Global.STAY_ON_WHILE_PLUGGED_IN);
GLOBAL_SETTINGS_WHITELIST.add(Settings.Global.WIFI_DEVICE_OWNER_CONFIGS_LOCKDOWN); GLOBAL_SETTINGS_ALLOWLIST.add(Settings.Global.WIFI_DEVICE_OWNER_CONFIGS_LOCKDOWN);
GLOBAL_SETTINGS_WHITELIST.add(Settings.Global.PRIVATE_DNS_MODE); GLOBAL_SETTINGS_ALLOWLIST.add(Settings.Global.PRIVATE_DNS_MODE);
GLOBAL_SETTINGS_WHITELIST.add(Settings.Global.PRIVATE_DNS_SPECIFIER); GLOBAL_SETTINGS_ALLOWLIST.add(Settings.Global.PRIVATE_DNS_SPECIFIER);
GLOBAL_SETTINGS_DEPRECATED = new ArraySet<>(); GLOBAL_SETTINGS_DEPRECATED = new ArraySet<>();
GLOBAL_SETTINGS_DEPRECATED.add(Settings.Global.BLUETOOTH_ON); GLOBAL_SETTINGS_DEPRECATED.add(Settings.Global.BLUETOOTH_ON);
@@ -520,11 +520,11 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
GLOBAL_SETTINGS_DEPRECATED.add(Settings.Global.NETWORK_PREFERENCE); GLOBAL_SETTINGS_DEPRECATED.add(Settings.Global.NETWORK_PREFERENCE);
GLOBAL_SETTINGS_DEPRECATED.add(Settings.Global.WIFI_ON); GLOBAL_SETTINGS_DEPRECATED.add(Settings.Global.WIFI_ON);
SYSTEM_SETTINGS_WHITELIST = new ArraySet<>(); SYSTEM_SETTINGS_ALLOWLIST = new ArraySet<>();
SYSTEM_SETTINGS_WHITELIST.add(Settings.System.SCREEN_BRIGHTNESS); SYSTEM_SETTINGS_ALLOWLIST.add(Settings.System.SCREEN_BRIGHTNESS);
SYSTEM_SETTINGS_WHITELIST.add(Settings.System.SCREEN_BRIGHTNESS_FLOAT); SYSTEM_SETTINGS_ALLOWLIST.add(Settings.System.SCREEN_BRIGHTNESS_FLOAT);
SYSTEM_SETTINGS_WHITELIST.add(Settings.System.SCREEN_BRIGHTNESS_MODE); SYSTEM_SETTINGS_ALLOWLIST.add(Settings.System.SCREEN_BRIGHTNESS_MODE);
SYSTEM_SETTINGS_WHITELIST.add(Settings.System.SCREEN_OFF_TIMEOUT); SYSTEM_SETTINGS_ALLOWLIST.add(Settings.System.SCREEN_OFF_TIMEOUT);
DA_DISALLOWED_POLICIES = new ArraySet<>(); DA_DISALLOWED_POLICIES = new ArraySet<>();
DA_DISALLOWED_POLICIES.add(DeviceAdminInfo.USES_POLICY_DISABLE_CAMERA); DA_DISALLOWED_POLICIES.add(DeviceAdminInfo.USES_POLICY_DISABLE_CAMERA);
@@ -1231,13 +1231,13 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
String startUserSessionMessage = null; String startUserSessionMessage = null;
String endUserSessionMessage = null; String endUserSessionMessage = null;
// The whitelist of packages that can access cross profile calendar APIs. // The allowlist of packages that can access cross profile calendar APIs.
// This whitelist should be in default an empty list, which indicates that no package // This allowlist should be in default an empty list, which indicates that no package
// is whitelisted. // is allowed.
List<String> mCrossProfileCalendarPackages = Collections.emptyList(); List<String> mCrossProfileCalendarPackages = Collections.emptyList();
// The whitelist of packages that the admin has enabled to be able to request consent from // The allowlist of packages that the admin has enabled to be able to request consent from
// the user to communicate cross-profile. By default, no packages are whitelisted, which is // the user to communicate cross-profile. By default, no packages are allowed, which is
// represented as an empty list. // represented as an empty list.
List<String> mCrossProfilePackages = Collections.emptyList(); List<String> mCrossProfilePackages = Collections.emptyList();
@@ -2818,7 +2818,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
final IIntentSender.Stub mLocalSender = new IIntentSender.Stub() { final IIntentSender.Stub mLocalSender = new IIntentSender.Stub() {
@Override @Override
public void send(int code, Intent intent, String resolvedType, IBinder whitelistToken, public void send(int code, Intent intent, String resolvedType, IBinder allowlistToken,
IIntentReceiver finishedReceiver, String requiredPermission, Bundle options) { IIntentReceiver finishedReceiver, String requiredPermission, Bundle options) {
final int status = intent.getIntExtra( final int status = intent.getIntExtra(
PackageInstaller.EXTRA_STATUS, PackageInstaller.STATUS_FAILURE); PackageInstaller.EXTRA_STATUS, PackageInstaller.STATUS_FAILURE);
@@ -7067,7 +7067,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
*/ */
@Override @Override
public boolean setAlwaysOnVpnPackage(ComponentName who, String vpnPackage, boolean lockdown, public boolean setAlwaysOnVpnPackage(ComponentName who, String vpnPackage, boolean lockdown,
List<String> lockdownWhitelist) List<String> lockdownAllowlist)
throws SecurityException { throws SecurityException {
enforceProfileOrDeviceOwner(who); enforceProfileOrDeviceOwner(who);
@@ -7079,10 +7079,10 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
DevicePolicyManager.ERROR_VPN_PACKAGE_NOT_FOUND, vpnPackage); DevicePolicyManager.ERROR_VPN_PACKAGE_NOT_FOUND, vpnPackage);
} }
if (vpnPackage != null && lockdown && lockdownWhitelist != null) { if (vpnPackage != null && lockdown && lockdownAllowlist != null) {
for (String packageName : lockdownWhitelist) { for (String packageName : lockdownAllowlist) {
if (!isPackageInstalledForUser(packageName, userId)) { if (!isPackageInstalledForUser(packageName, userId)) {
Slog.w(LOG_TAG, "Non-existent package in VPN whitelist: " + packageName); Slog.w(LOG_TAG, "Non-existent package in VPN allowlist: " + packageName);
throw new ServiceSpecificException( throw new ServiceSpecificException(
DevicePolicyManager.ERROR_VPN_PACKAGE_NOT_FOUND, packageName); DevicePolicyManager.ERROR_VPN_PACKAGE_NOT_FOUND, packageName);
} }
@@ -7090,7 +7090,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
} }
// If some package is uninstalled after the check above, it will be ignored by CM. // If some package is uninstalled after the check above, it will be ignored by CM.
if (!mInjector.getConnectivityManager().setAlwaysOnVpnPackageForUser( if (!mInjector.getConnectivityManager().setAlwaysOnVpnPackageForUser(
userId, vpnPackage, lockdown, lockdownWhitelist)) { userId, vpnPackage, lockdown, lockdownAllowlist)) {
throw new UnsupportedOperationException(); throw new UnsupportedOperationException();
} }
DevicePolicyEventLogger DevicePolicyEventLogger
@@ -7098,7 +7098,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
.setAdmin(who) .setAdmin(who)
.setStrings(vpnPackage) .setStrings(vpnPackage)
.setBoolean(lockdown) .setBoolean(lockdown)
.setInt(lockdownWhitelist != null ? lockdownWhitelist.size() : 0) .setInt(lockdownAllowlist != null ? lockdownAllowlist.size() : 0)
.write(); .write();
}); });
synchronized (getLockObject()) { synchronized (getLockObject()) {
@@ -7151,7 +7151,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
} }
@Override @Override
public List<String> getAlwaysOnVpnLockdownWhitelist(ComponentName admin) public List<String> getAlwaysOnVpnLockdownAllowlist(ComponentName admin)
throws SecurityException { throws SecurityException {
enforceProfileOrDeviceOwner(admin); enforceProfileOrDeviceOwner(admin);
@@ -11911,7 +11911,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
return; return;
} }
if (!GLOBAL_SETTINGS_WHITELIST.contains(setting) if (!GLOBAL_SETTINGS_ALLOWLIST.contains(setting)
&& !UserManager.isDeviceInDemoMode(mContext)) { && !UserManager.isDeviceInDemoMode(mContext)) {
throw new SecurityException(String.format( throw new SecurityException(String.format(
"Permission denial: device owners cannot update %1$s", setting)); "Permission denial: device owners cannot update %1$s", setting));
@@ -11939,7 +11939,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
synchronized (getLockObject()) { synchronized (getLockObject()) {
getActiveAdminForCallerLocked(who, DeviceAdminInfo.USES_POLICY_PROFILE_OWNER); getActiveAdminForCallerLocked(who, DeviceAdminInfo.USES_POLICY_PROFILE_OWNER);
if (!SYSTEM_SETTINGS_WHITELIST.contains(setting)) { if (!SYSTEM_SETTINGS_ALLOWLIST.contains(setting)) {
throw new SecurityException(String.format( throw new SecurityException(String.format(
"Permission denial: device owners cannot update %1$s", setting)); "Permission denial: device owners cannot update %1$s", setting));
} }
@@ -12083,12 +12083,12 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
getActiveAdminForCallerLocked(who, DeviceAdminInfo.USES_POLICY_PROFILE_OWNER); getActiveAdminForCallerLocked(who, DeviceAdminInfo.USES_POLICY_PROFILE_OWNER);
if (isDeviceOwner(who, callingUserId)) { if (isDeviceOwner(who, callingUserId)) {
if (!SECURE_SETTINGS_DEVICEOWNER_WHITELIST.contains(setting) if (!SECURE_SETTINGS_DEVICEOWNER_ALLOWLIST.contains(setting)
&& !isCurrentUserDemo()) { && !isCurrentUserDemo()) {
throw new SecurityException(String.format( throw new SecurityException(String.format(
"Permission denial: Device owners cannot update %1$s", setting)); "Permission denial: Device owners cannot update %1$s", setting));
} }
} else if (!SECURE_SETTINGS_WHITELIST.contains(setting) && !isCurrentUserDemo()) { } else if (!SECURE_SETTINGS_ALLOWLIST.contains(setting) && !isCurrentUserDemo()) {
throw new SecurityException(String.format( throw new SecurityException(String.format(
"Permission denial: Profile owners cannot update %1$s", setting)); "Permission denial: Profile owners cannot update %1$s", setting));
} }
@@ -13859,7 +13859,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
@Override @Override
public void markProfileOwnerOnOrganizationOwnedDevice(ComponentName who, int userId) { public void markProfileOwnerOnOrganizationOwnedDevice(ComponentName who, int userId) {
// As the caller is the system, it must specify the component name of the profile owner // As the caller is the system, it must specify the component name of the profile owner
// as a sanity / safety check. // as a safety check.
Objects.requireNonNull(who); Objects.requireNonNull(who);
if (!mHasFeature) { if (!mHasFeature) {
@@ -13895,7 +13895,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
@GuardedBy("getLockObject()") @GuardedBy("getLockObject()")
private void markProfileOwnerOnOrganizationOwnedDeviceUncheckedLocked( private void markProfileOwnerOnOrganizationOwnedDeviceUncheckedLocked(
ComponentName who, int userId) { ComponentName who, int userId) {
// Sanity check: Make sure that the user has a profile owner and that the specified // Make sure that the user has a profile owner and that the specified
// component is the profile owner of that user. // component is the profile owner of that user.
if (!isProfileOwner(who, userId)) { if (!isProfileOwner(who, userId)) {
throw new IllegalArgumentException(String.format( throw new IllegalArgumentException(String.format(