Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix access control checks getOwnerInstalledCaCerts

Browse Source 
Prevent the profile owner or device owner from reading
ca certs for another user

Bug: 235822598
Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest
Test: atest com.android.cts.devicepolicy.ProfileOwnerTest#testAdminActionBookkeeping
Test: atest com.android.cts.devicepolicy.MixedProfileOwnerTest#testDelegatedCertInstaller
Test: atest com.android.cts.devicepolicy.MixedManagedProfileOwnerTest#testDelegatedCertInstaller
Change-Id: I014fa1cfb4ddbbbdb86fbb0f948464dc4f5c069e
This commit is contained in:
Alex Johnston
2022-09-09 14:19:32 +00:00
parent aafd8fabbd
commit 690d94d664
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -18359,9 +18359,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
public StringParceledListSlice getOwnerInstalledCaCerts(@NonNull UserHandle user) {
final int userId = user.getIdentifier();
final CallerIdentity caller = getCallerIdentity();
Preconditions.checkCallAuthorization((userId == caller.getUserId())
|| isProfileOwner(caller) || isDefaultDeviceOwner(caller)
|| hasFullCrossUsersPermission(caller, userId));
Preconditions.checkCallAuthorization(
(isProfileOwner(caller) || isDefaultDeviceOwner(caller) || canQueryAdminPolicy(
caller)) && hasFullCrossUsersPermission(caller, userId));
synchronized (getLockObject()) {
return new StringParceledListSlice(