Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Only call canUserCallLockTask when the caller is a DPC" into udc-dev

Browse Source
This commit is contained in:
Elis Elliott
2023-05-30 09:49:03 +00:00
committed by Android (Google) Code Review
parent 878b61b063 da48fad668
commit 6daf38c0e5
1 changed files with 12 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -11113,7 +11113,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
|| hasCallingOrSelfPermission(permission.INTERACT_ACROSS_USERS); || hasCallingOrSelfPermission(permission.INTERACT_ACROSS_USERS);
} }
private boolean canUserUseLockTaskLocked(int userId) { private boolean canDPCManagedUserUseLockTaskLocked(int userId) {
if (isUserAffiliatedWithDeviceLocked(userId)) { if (isUserAffiliatedWithDeviceLocked(userId)) {
return true; return true;
} }
@@ -11123,13 +11123,10 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
return false; return false;
} }
if (!isPermissionCheckFlagEnabled() && !isPolicyEngineForFinanceFlagEnabled()) { final ComponentName profileOwner = getProfileOwnerAsUser(userId);
final ComponentName profileOwner = getProfileOwnerAsUser(userId); if (profileOwner == null) {
if (profileOwner == null) { return false;
return false;
}
} }
// Managed profiles are not allowed to use lock task // Managed profiles are not allowed to use lock task
if (isManagedProfile(userId)) { if (isManagedProfile(userId)) {
return false; return false;
@@ -11142,7 +11139,8 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
final int userId = caller.getUserId(); final int userId = caller.getUserId();
enforceCanQuery(MANAGE_DEVICE_POLICY_LOCK_TASK, caller.getPackageName(), userId); enforceCanQuery(MANAGE_DEVICE_POLICY_LOCK_TASK, caller.getPackageName(), userId);
if (!canUserUseLockTaskLocked(userId)) { if ((isDeviceOwner(caller) || isProfileOwner(caller))
&& !canDPCManagedUserUseLockTaskLocked(userId)) {
throw new SecurityException("User " + userId + " is not allowed to use lock task"); throw new SecurityException("User " + userId + " is not allowed to use lock task");
} }
} }
@@ -11158,7 +11156,8 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
caller.getPackageName(), caller.getPackageName(),
userId userId
); );
if (!canUserUseLockTaskLocked(userId)) { if ((isDeviceOwner(caller) || isProfileOwner(caller))
&& !canDPCManagedUserUseLockTaskLocked(userId)) {
throw new SecurityException("User " + userId + " is not allowed to use lock task"); throw new SecurityException("User " + userId + " is not allowed to use lock task");
} }
return enforcingAdmin; return enforcingAdmin;
@@ -11169,7 +11168,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
|| isDefaultDeviceOwner(caller) || isFinancedDeviceOwner(caller)); || isDefaultDeviceOwner(caller) || isFinancedDeviceOwner(caller));
final int userId = caller.getUserId(); final int userId = caller.getUserId();
if (!canUserUseLockTaskLocked(userId)) { if (!canDPCManagedUserUseLockTaskLocked(userId)) {
throw new SecurityException("User " + userId + " is not allowed to use lock task"); throw new SecurityException("User " + userId + " is not allowed to use lock task");
} }
} }
@@ -15101,7 +15100,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
final List<UserInfo> userInfos = mUserManager.getAliveUsers(); final List<UserInfo> userInfos = mUserManager.getAliveUsers();
for (int i = userInfos.size() - 1; i >= 0; i--) { for (int i = userInfos.size() - 1; i >= 0; i--) {
int userId = userInfos.get(i).id; int userId = userInfos.get(i).id;
if (canUserUseLockTaskLocked(userId)) { if (canDPCManagedUserUseLockTaskLocked(userId)) {
continue; continue;
} }