diff --git a/core/api/system-current.txt b/core/api/system-current.txt index 7950e46463e6d..3997d512519b3 100644 --- a/core/api/system-current.txt +++ b/core/api/system-current.txt @@ -299,6 +299,7 @@ package android { field public static final String SIGNAL_REBOOT_READINESS = "android.permission.SIGNAL_REBOOT_READINESS"; field public static final String SOUND_TRIGGER_RUN_IN_BATTERY_SAVER = "android.permission.SOUND_TRIGGER_RUN_IN_BATTERY_SAVER"; field public static final String START_ACTIVITIES_FROM_BACKGROUND = "android.permission.START_ACTIVITIES_FROM_BACKGROUND"; + field public static final String START_CROSS_PROFILE_ACTIVITIES = "android.permission.START_CROSS_PROFILE_ACTIVITIES"; field public static final String START_REVIEW_PERMISSION_DECISIONS = "android.permission.START_REVIEW_PERMISSION_DECISIONS"; field public static final String STATUS_BAR_SERVICE = "android.permission.STATUS_BAR_SERVICE"; field public static final String STOP_APP_SWITCHES = "android.permission.STOP_APP_SWITCHES"; @@ -2844,7 +2845,7 @@ package android.content.pm { } public class CrossProfileApps { - method @RequiresPermission(android.Manifest.permission.INTERACT_ACROSS_PROFILES) public void startActivity(@NonNull android.content.ComponentName, @NonNull android.os.UserHandle); + method @RequiresPermission(anyOf={android.Manifest.permission.INTERACT_ACROSS_PROFILES, android.Manifest.permission.START_CROSS_PROFILE_ACTIVITIES}) public void startActivity(@NonNull android.content.ComponentName, @NonNull android.os.UserHandle); } public class DataLoaderParams { diff --git a/core/java/android/content/pm/CrossProfileApps.java b/core/java/android/content/pm/CrossProfileApps.java index 48b634e52846b..11b2ea1f6523c 100644 --- a/core/java/android/content/pm/CrossProfileApps.java +++ b/core/java/android/content/pm/CrossProfileApps.java @@ -180,6 +180,7 @@ public class CrossProfileApps { * {@link #startMainActivity}, this can start any activity of the caller package, not just * the main activity. * The caller must have the {@link android.Manifest.permission#INTERACT_ACROSS_PROFILES} + * or {@link android.Manifest.permission#START_CROSS_PROFILE_ACTIVITIES} * permission and both the caller and target user profiles must be in the same profile group. * * @param component The ComponentName of the activity to launch. It must be exported. @@ -189,7 +190,9 @@ public class CrossProfileApps { * @hide */ @SystemApi - @RequiresPermission(android.Manifest.permission.INTERACT_ACROSS_PROFILES) + @RequiresPermission(anyOf = { + android.Manifest.permission.INTERACT_ACROSS_PROFILES, + android.Manifest.permission.START_CROSS_PROFILE_ACTIVITIES}) public void startActivity(@NonNull ComponentName component, @NonNull UserHandle targetUser) { try { mService.startActivityAsUser(mContext.getIApplicationThread(), diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml index 432fa044006d2..c314073e08d22 100644 --- a/core/res/AndroidManifest.xml +++ b/core/res/AndroidManifest.xml @@ -2792,6 +2792,10 @@ + + + diff --git a/packages/Shell/AndroidManifest.xml b/packages/Shell/AndroidManifest.xml index 0c70821527dde..1303a62ff13da 100644 --- a/packages/Shell/AndroidManifest.xml +++ b/packages/Shell/AndroidManifest.xml @@ -350,6 +350,9 @@ + + + diff --git a/services/core/java/com/android/server/pm/CrossProfileAppsServiceImpl.java b/services/core/java/com/android/server/pm/CrossProfileAppsServiceImpl.java index 62db886b90e94..b30798485bf7c 100644 --- a/services/core/java/com/android/server/pm/CrossProfileAppsServiceImpl.java +++ b/services/core/java/com/android/server/pm/CrossProfileAppsServiceImpl.java @@ -19,6 +19,7 @@ import static android.Manifest.permission.INTERACT_ACROSS_PROFILES; import static android.Manifest.permission.INTERACT_ACROSS_USERS; import static android.Manifest.permission.INTERACT_ACROSS_USERS_FULL; import static android.Manifest.permission.MANAGE_APP_OPS_MODES; +import static android.Manifest.permission.START_CROSS_PROFILE_ACTIVITIES; import static android.app.AppOpsManager.OP_INTERACT_ACROSS_PROFILES; import static android.content.Intent.FLAG_RECEIVER_REGISTERED_ONLY; import static android.content.pm.CrossProfileApps.ACTION_CAN_INTERACT_ACROSS_PROFILES_CHANGED; @@ -154,17 +155,15 @@ public class CrossProfileAppsServiceImpl extends ICrossProfileApps.Stub { // must have the required permission and the users must be in the same profile group // in order to launch any of its own activities. if (callerUserId != userId) { - final int permissionFlag = PermissionChecker.checkPermissionForPreflight( - mContext, - INTERACT_ACROSS_PROFILES, - callingPid, - callingUid, - callingPackage); - if (permissionFlag != PermissionChecker.PERMISSION_GRANTED - || !isSameProfileGroup(callerUserId, userId)) { - throw new SecurityException("Attempt to launch activity without required " - + INTERACT_ACROSS_PROFILES - + " permission or target user is not in the same profile group."); + if (!hasInteractAcrossProfilesPermission(callingPackage, callingUid, callingPid) + && !isPermissionGranted(START_CROSS_PROFILE_ACTIVITIES, callingUid)) { + throw new SecurityException("Attempt to launch activity without one of the" + + " required " + INTERACT_ACROSS_PROFILES + " or " + + START_CROSS_PROFILE_ACTIVITIES + " permissions."); + } + if (!isSameProfileGroup(callerUserId, userId)) { + throw new SecurityException("Attempt to launch activity when target user is" + + " not in the same profile group."); } } launchIntent.setComponent(component);