Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

getUserPropertiesCopy handles Query/Manage perms

Browse Source 
getUserPropertiesCopy should use the standard way of querying whether a
caller has Query or Manage users permission. In particular, a caller
that has Manage should be treated as though it has Query as well, which
this cl will ensure. Some variable names and comments are updated to
make this clearer.

Test: atest UserManagerServiceUserPropertiesTest
Change-Id: I6ba312b27e6ab47498a03ecac6c1ffd6f60442e8
This commit is contained in:
Adam Bookatz
2022-10-21 14:42:25 -07:00
parent 9d8f4ade3d
commit 6d410f10e8
2 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
core/java/android/content/pm/UserProperties.java
View File

@@ -114,7 +114,7 @@ public final class UserProperties implements Parcelable {
public UserProperties(UserProperties orig,
boolean exposeAllFields,
boolean hasManagePermission,
boolean hasQueryPermission) {
boolean hasQueryOrManagePermission) {
if (orig.mDefaultProperties == null) {
throw new IllegalArgumentException("Attempting to copy a non-original UserProperties.");
@@ -122,17 +122,19 @@ public final class UserProperties implements Parcelable {
this.mDefaultProperties = null;
// Insert each setter into the following hierarchy based on its permission requirements.
// NOTE: Copy each property using getters to ensure default values are copied if needed.
if (exposeAllFields) {
// Add items that require exposeAllFields to be true (strictest permission level).
setStartWithParent(orig.getStartWithParent());
}
if (hasManagePermission) {
// Add any items that require this permission.
// Add items that require MANAGE_USERS or stronger.
}
if (hasQueryPermission) {
// Add any items that require this permission.
if (hasQueryOrManagePermission) {
// Add items that require QUERY_USERS or stronger.
}
// Add any items that require no permissions at all.
// Add items that have no permission requirements at all.
setShowInLauncher(orig.getShowInLauncher());
}

7
services/core/java/com/android/server/pm/UserManagerService.java
View File

@@ -1540,10 +1540,9 @@ public class UserManagerService extends IUserManager.Stub {
checkQueryOrInteractPermissionIfCallerInOtherProfileGroup(userId, "getUserProperties");
final UserProperties origProperties = getUserPropertiesInternal(userId);
if (origProperties != null) {
int callingUid = Binder.getCallingUid();
boolean exposeAllFields = callingUid == Process.SYSTEM_UID;
boolean hasManage = hasPermissionGranted(Manifest.permission.MANAGE_USERS, callingUid);
boolean hasQuery = hasPermissionGranted(Manifest.permission.QUERY_USERS, callingUid);
boolean exposeAllFields = Binder.getCallingUid() == Process.SYSTEM_UID;
boolean hasManage = hasManageUsersPermission();
boolean hasQuery = hasQueryUsersPermission();
return new UserProperties(origProperties, exposeAllFields, hasManage, hasQuery);
}
// A non-existent or partial user will reach here.