Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "bindDeviceAdminService requires service to be proected by BIND_DEVICE_ADMIN" into oc-dev

Browse Source 
am: f4362fda59

Change-Id: I130dc84ecfb47263679f6645a0b243f047c04e33
This commit is contained in:
Tony Mak
2017-04-27 09:48:13 +00:00
committed by android-build-merger
parent f595898fca f4362fda59
commit 6fbfc05965
2 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
core/java/android/app/admin/DevicePolicyManager.java
View File

@@ -7826,7 +7826,8 @@ public class DevicePolicyManager {
* See {@link #getBindDeviceAdminTargetUsers} for a definition of which
* device/profile owners are allowed to bind to services of another profile/device owner.
* <p>
* The service must be unexported. Note that the {@link Context} used to obtain this
* The service must be protected by {@link android.Manifest.permission#BIND_DEVICE_ADMIN}.
* Note that the {@link Context} used to obtain this
* {@link DevicePolicyManager} instance via {@link Context#getSystemService(Class)} will be used
* to bind to the {@link android.app.Service}.
*

7
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -16,6 +16,7 @@
package com.android.server.devicepolicy;
import static android.Manifest.permission.BIND_DEVICE_ADMIN;
import static android.Manifest.permission.MANAGE_CA_CERTIFICATES;
import static android.app.admin.DevicePolicyManager.CODE_ACCOUNTS_NOT_EMPTY;
import static android.app.admin.DevicePolicyManager.CODE_ADD_MANAGED_PROFILE_DISALLOWED;
@@ -10844,8 +10845,10 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
if (!expectedPackageName.equals(info.serviceInfo.packageName)) {
throw new SecurityException("Only allow to bind service in " + expectedPackageName);
}
if (info.serviceInfo.exported) {
throw new SecurityException("The service must be unexported");
// STOPSHIP(b/37624960): Remove info.serviceInfo.exported before release.
if (info.serviceInfo.exported && !BIND_DEVICE_ADMIN.equals(info.serviceInfo.permission)) {
throw new SecurityException(
"Service must be protected by BIND_DEVICE_ADMIN permission");
}
// It is the system server to bind the service, it would be extremely dangerous if it
// can be exploited to bind any service. Set the component explicitly to make sure we