diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index 9a996795622c6..3dddf61444e9e 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -629,6 +629,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { private static final String CREDENTIAL_MANAGEMENT_APP_INVALID_ALIAS_MSG = "The alias provided must be contained in the aliases specified in the credential " + "management app's authentication policy"; + private static final String NOT_SYSTEM_CALLER_MSG = "Only the system can %s"; final Context mContext; final Injector mInjector; @@ -3631,7 +3632,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { @Override public boolean isSeparateProfileChallengeAllowed(int userHandle) { - enforceSystemCaller("query separate challenge support"); + Preconditions.checkCallAuthorization(isSystemUid(getCallerIdentity()), + String.format(NOT_SYSTEM_CALLER_MSG, "query separate challenge support")); ComponentName profileOwner = getProfileOwnerAsUser(userHandle); // Profile challenge is supported on N or newer release. @@ -5982,7 +5984,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { public void choosePrivateKeyAlias(final int uid, final Uri uri, final String alias, final IBinder response) { final CallerIdentity caller = getCallerIdentity(); - enforceSystemCaller("choose private key alias"); + Preconditions.checkCallAuthorization(isSystemUid(caller), + String.format(NOT_SYSTEM_CALLER_MSG, "choose private key alias")); // If there is a profile owner, redirect to that; otherwise query the device owner. ComponentName aliasChooser = getProfileOwnerAsUser(caller.getUserId()); @@ -6530,7 +6533,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { @Override public String getAlwaysOnVpnPackageForUser(int userHandle) { - enforceSystemCaller("getAlwaysOnVpnPackageForUser"); + Preconditions.checkCallAuthorization(isSystemUid(getCallerIdentity()), + String.format(NOT_SYSTEM_CALLER_MSG, "call getAlwaysOnVpnPackageForUser")); synchronized (getLockObject()) { ActiveAdmin admin = getDeviceOrProfileOwnerAdminLocked(userHandle); return admin != null ? admin.mAlwaysOnVpnPackage : null; @@ -6556,7 +6560,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { @Override public boolean isAlwaysOnVpnLockdownEnabledForUser(int userHandle) { - enforceSystemCaller("isAlwaysOnVpnLockdownEnabledForUser"); + Preconditions.checkCallAuthorization(isSystemUid(getCallerIdentity()), + String.format(NOT_SYSTEM_CALLER_MSG, "call isAlwaysOnVpnLockdownEnabledForUser")); synchronized (getLockObject()) { ActiveAdmin admin = getDeviceOrProfileOwnerAdminLocked(userHandle); return admin != null ? admin.mAlwaysOnVpnLockdown : null; @@ -9155,10 +9160,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { hasCallingOrSelfPermission(permission.MANAGE_PROFILE_AND_DEVICE_OWNERS)); if ((mIsWatch || hasUserSetupCompleted(userHandle))) { - if (!isCallerWithSystemUid()) { - throw new IllegalStateException("Cannot set the profile owner on a user which is " - + "already set-up"); - } + Preconditions.checkState(isSystemUid(caller), + "Cannot set the profile owner on a user which is already set-up"); if (!mIsWatch) { // Only the default supervision profile owner can be set as profile owner after SUW @@ -9313,10 +9316,6 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } } - private boolean isCallerWithSystemUid() { - return UserHandle.isSameApp(mInjector.binderGetCallingUid(), Process.SYSTEM_UID); - } - private boolean isSystemUid(CallerIdentity caller) { return UserHandle.isSameApp(caller.getUid(), Process.SYSTEM_UID); } @@ -9747,7 +9746,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { @Override public ComponentName getRestrictionsProvider(int userHandle) { - enforceSystemCaller("query the permission provider"); + Preconditions.checkCallAuthorization(isSystemUid(getCallerIdentity()), + String.format(NOT_SYSTEM_CALLER_MSG, "query the permission provider")); synchronized (getLockObject()) { DevicePolicyData userData = getUserData(userHandle); return userData != null ? userData.mRestrictionsProvider : null; @@ -10017,7 +10017,9 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } Objects.requireNonNull(who, "ComponentName is null"); Preconditions.checkStringNotEmpty(packageName, "packageName is null"); - enforceSystemCaller("query if an accessibility service is disabled by admin"); + Preconditions.checkCallAuthorization(isSystemUid(getCallerIdentity()), + String.format(NOT_SYSTEM_CALLER_MSG, + "query if an accessibility service is disabled by admin")); synchronized (getLockObject()) { ActiveAdmin admin = getActiveAdminUncheckedLocked(who, userHandle); @@ -10163,7 +10165,9 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } Objects.requireNonNull(who, "ComponentName is null"); Preconditions.checkStringNotEmpty(packageName, "packageName is null"); - enforceSystemCaller("query if an input method is disabled by admin"); + Preconditions.checkCallAuthorization(isSystemUid(getCallerIdentity()), + String.format(NOT_SYSTEM_CALLER_MSG, + "query if an input method is disabled by admin")); synchronized (getLockObject()) { ActiveAdmin admin = getParentOfAdminIfRequired( @@ -10223,7 +10227,9 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } Preconditions.checkStringNotEmpty(packageName, "packageName is null or empty"); - enforceSystemCaller("query if a notification listener service is permitted"); + Preconditions.checkCallAuthorization(isSystemUid(getCallerIdentity()), + String.format(NOT_SYSTEM_CALLER_MSG, + "query if a notification listener service is permitted")); synchronized (getLockObject()) { ActiveAdmin profileOwner = getProfileOwnerAdminLocked(userId); @@ -10236,12 +10242,6 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } } - private void enforceSystemCaller(String action) { - if (!isCallerWithSystemUid()) { - throw new SecurityException("Only the system can " + action); - } - } - private void maybeSendAdminEnabledBroadcastLocked(int userHandle) { DevicePolicyData policyData = getUserData(userHandle); if (policyData.mAdminBroadcastPending) { @@ -11785,7 +11785,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { @Override public void notifyLockTaskModeChanged(boolean isEnabled, String pkg, int userHandle) { - enforceSystemCaller("call notifyLockTaskModeChanged"); + Preconditions.checkCallAuthorization(isSystemUid(getCallerIdentity()), + String.format(NOT_SYSTEM_CALLER_MSG, "call notifyLockTaskModeChanged")); synchronized (getLockObject()) { final DevicePolicyData policy = getUserData(userHandle); @@ -13688,7 +13689,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { return null; } Objects.requireNonNull(who, "ComponentName is null"); - enforceSystemCaller("query support message for user"); + Preconditions.checkCallAuthorization(isSystemUid(getCallerIdentity()), + String.format(NOT_SYSTEM_CALLER_MSG, "query support message for user")); synchronized (getLockObject()) { ActiveAdmin admin = getActiveAdminUncheckedLocked(who, userHandle); @@ -13705,7 +13707,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { return null; } Objects.requireNonNull(who, "ComponentName is null"); - enforceSystemCaller("query support message for user"); + Preconditions.checkCallAuthorization(isSystemUid(getCallerIdentity()), + String.format(NOT_SYSTEM_CALLER_MSG, "query support message for user")); synchronized (getLockObject()) { ActiveAdmin admin = getActiveAdminUncheckedLocked(who, userHandle); @@ -13935,7 +13938,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { if (!mHasFeature) { return false; } - enforceSystemCaller("query restricted pkgs for a specific user"); + Preconditions.checkCallAuthorization(isSystemUid(getCallerIdentity()), + String.format(NOT_SYSTEM_CALLER_MSG, "query restricted pkgs for a specific user")); synchronized (getLockObject()) { final ActiveAdmin admin = getActiveAdminUncheckedLocked(who, userId); @@ -14200,7 +14204,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } synchronized (getLockObject()) { - if (!isCallerWithSystemUid()) { + if (!isSystemUid(getCallerIdentity())) { final CallerIdentity caller = getCallerIdentity(admin, packageName); if (admin != null) { Preconditions.checkCallAuthorization( @@ -16598,7 +16602,9 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { @Override public boolean canProfileOwnerResetPasswordWhenLocked(int userId) { - enforceSystemCaller("call canProfileOwnerResetPasswordWhenLocked"); + Preconditions.checkCallAuthorization(isSystemUid(getCallerIdentity()), + String.format(NOT_SYSTEM_CALLER_MSG, + "call canProfileOwnerResetPasswordWhenLocked")); synchronized (getLockObject()) { final ActiveAdmin poAdmin = getProfileOwnerAdminLocked(userId); if (poAdmin == null