diff --git a/core/api/system-current.txt b/core/api/system-current.txt
index 7950e46463e6d..3997d512519b3 100644
--- a/core/api/system-current.txt
+++ b/core/api/system-current.txt
@@ -299,6 +299,7 @@ package android {
field public static final String SIGNAL_REBOOT_READINESS = "android.permission.SIGNAL_REBOOT_READINESS";
field public static final String SOUND_TRIGGER_RUN_IN_BATTERY_SAVER = "android.permission.SOUND_TRIGGER_RUN_IN_BATTERY_SAVER";
field public static final String START_ACTIVITIES_FROM_BACKGROUND = "android.permission.START_ACTIVITIES_FROM_BACKGROUND";
+ field public static final String START_CROSS_PROFILE_ACTIVITIES = "android.permission.START_CROSS_PROFILE_ACTIVITIES";
field public static final String START_REVIEW_PERMISSION_DECISIONS = "android.permission.START_REVIEW_PERMISSION_DECISIONS";
field public static final String STATUS_BAR_SERVICE = "android.permission.STATUS_BAR_SERVICE";
field public static final String STOP_APP_SWITCHES = "android.permission.STOP_APP_SWITCHES";
@@ -2844,7 +2845,7 @@ package android.content.pm {
}
public class CrossProfileApps {
- method @RequiresPermission(android.Manifest.permission.INTERACT_ACROSS_PROFILES) public void startActivity(@NonNull android.content.ComponentName, @NonNull android.os.UserHandle);
+ method @RequiresPermission(anyOf={android.Manifest.permission.INTERACT_ACROSS_PROFILES, android.Manifest.permission.START_CROSS_PROFILE_ACTIVITIES}) public void startActivity(@NonNull android.content.ComponentName, @NonNull android.os.UserHandle);
}
public class DataLoaderParams {
diff --git a/core/java/android/content/pm/CrossProfileApps.java b/core/java/android/content/pm/CrossProfileApps.java
index 48b634e52846b..11b2ea1f6523c 100644
--- a/core/java/android/content/pm/CrossProfileApps.java
+++ b/core/java/android/content/pm/CrossProfileApps.java
@@ -180,6 +180,7 @@ public class CrossProfileApps {
* {@link #startMainActivity}, this can start any activity of the caller package, not just
* the main activity.
* The caller must have the {@link android.Manifest.permission#INTERACT_ACROSS_PROFILES}
+ * or {@link android.Manifest.permission#START_CROSS_PROFILE_ACTIVITIES}
* permission and both the caller and target user profiles must be in the same profile group.
*
* @param component The ComponentName of the activity to launch. It must be exported.
@@ -189,7 +190,9 @@ public class CrossProfileApps {
* @hide
*/
@SystemApi
- @RequiresPermission(android.Manifest.permission.INTERACT_ACROSS_PROFILES)
+ @RequiresPermission(anyOf = {
+ android.Manifest.permission.INTERACT_ACROSS_PROFILES,
+ android.Manifest.permission.START_CROSS_PROFILE_ACTIVITIES})
public void startActivity(@NonNull ComponentName component, @NonNull UserHandle targetUser) {
try {
mService.startActivityAsUser(mContext.getIApplicationThread(),
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index 432fa044006d2..c314073e08d22 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -2792,6 +2792,10 @@
+
+
+
diff --git a/packages/Shell/AndroidManifest.xml b/packages/Shell/AndroidManifest.xml
index 0c70821527dde..1303a62ff13da 100644
--- a/packages/Shell/AndroidManifest.xml
+++ b/packages/Shell/AndroidManifest.xml
@@ -350,6 +350,9 @@
+
+
+
diff --git a/services/core/java/com/android/server/pm/CrossProfileAppsServiceImpl.java b/services/core/java/com/android/server/pm/CrossProfileAppsServiceImpl.java
index 62db886b90e94..b30798485bf7c 100644
--- a/services/core/java/com/android/server/pm/CrossProfileAppsServiceImpl.java
+++ b/services/core/java/com/android/server/pm/CrossProfileAppsServiceImpl.java
@@ -19,6 +19,7 @@ import static android.Manifest.permission.INTERACT_ACROSS_PROFILES;
import static android.Manifest.permission.INTERACT_ACROSS_USERS;
import static android.Manifest.permission.INTERACT_ACROSS_USERS_FULL;
import static android.Manifest.permission.MANAGE_APP_OPS_MODES;
+import static android.Manifest.permission.START_CROSS_PROFILE_ACTIVITIES;
import static android.app.AppOpsManager.OP_INTERACT_ACROSS_PROFILES;
import static android.content.Intent.FLAG_RECEIVER_REGISTERED_ONLY;
import static android.content.pm.CrossProfileApps.ACTION_CAN_INTERACT_ACROSS_PROFILES_CHANGED;
@@ -154,17 +155,15 @@ public class CrossProfileAppsServiceImpl extends ICrossProfileApps.Stub {
// must have the required permission and the users must be in the same profile group
// in order to launch any of its own activities.
if (callerUserId != userId) {
- final int permissionFlag = PermissionChecker.checkPermissionForPreflight(
- mContext,
- INTERACT_ACROSS_PROFILES,
- callingPid,
- callingUid,
- callingPackage);
- if (permissionFlag != PermissionChecker.PERMISSION_GRANTED
- || !isSameProfileGroup(callerUserId, userId)) {
- throw new SecurityException("Attempt to launch activity without required "
- + INTERACT_ACROSS_PROFILES
- + " permission or target user is not in the same profile group.");
+ if (!hasInteractAcrossProfilesPermission(callingPackage, callingUid, callingPid)
+ && !isPermissionGranted(START_CROSS_PROFILE_ACTIVITIES, callingUid)) {
+ throw new SecurityException("Attempt to launch activity without one of the"
+ + " required " + INTERACT_ACROSS_PROFILES + " or "
+ + START_CROSS_PROFILE_ACTIVITIES + " permissions.");
+ }
+ if (!isSameProfileGroup(callerUserId, userId)) {
+ throw new SecurityException("Attempt to launch activity when target user is"
+ + " not in the same profile group.");
}
}
launchIntent.setComponent(component);