From 7f44da66bad8ee64ea0609d19001b5cb84d81ef9 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Tue, 31 Jan 2023 05:47:41 +0000 Subject: [PATCH] DPMS: add permission check to getDeviceOwnerLockScreenInfo() The public API DPMS.getDeviceOwnerLockScreenInfo() currently doesn't require any permission, as it doesn't check for one itself, and it uses ILockSettings.getString() which doesn't check for a permission either. We're fixing ILockSettings.getString() to check for ACCESS_KEYGUARD_SECURE_STORAGE. Therefore, to keep DPMS.getDeviceOwnerLockScreenInfo() working for DPCs, make it explicitly check for the device or profile owner before calling into ILockSettings with a cleared calling identity. Note, this is the same permission check that DPMS.setDeviceOwnerLockScreenInfo() does. Bug: 256170784 Test: m cts && atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testLockScreenInfo Change-Id: Ic81d04b7c3746fa2da65f932ca28cb852fdeccb8 --- .../server/devicepolicy/DevicePolicyManagerService.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index 9c64054be37e9..90c79a9554b99 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -9321,7 +9321,11 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { @Override public CharSequence getDeviceOwnerLockScreenInfo() { - return mLockPatternUtils.getDeviceOwnerInfo(); + final CallerIdentity caller = getCallerIdentity(); + Preconditions.checkCallAuthorization( + isDefaultDeviceOwner(caller) || isProfileOwnerOfOrganizationOwnedDevice(caller)); + return mInjector.binderWithCleanCallingIdentity(() -> + mLockPatternUtils.getDeviceOwnerInfo()); } private void clearUserPoliciesLocked(int userId) {