Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix DPMS.isCredentialManagementApp()

Browse Source 
Call KeyChain.bindAsUser() with cleared binder identity.

Bug: 175032227
Test: atest MixedManagedProfileOwnerTest#testDelegation
Change-Id: I4c696519a630a81f9a2210d5ec07045298738f7b
This commit is contained in:
Rubin Xu
2020-12-14 16:50:26 +00:00
parent a64af9764f
commit 81d4a1ff3e
1 changed files with 17 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -5905,25 +5905,26 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
* @return {@code true} if the calling process is the credential management app.
*/
private boolean isCredentialManagementApp(CallerIdentity caller, String alias) {
// Should include alias in authentication policy
try (KeyChainConnection connection = KeyChain.bindAsUser(mContext,
caller.getUserHandle())) {
// The policy will be null if there is no credential management app
AppUriAuthenticationPolicy policy =
connection.getService().getCredentialManagementAppPolicy();
if (policy == null || policy.getAppAndUriMappings().isEmpty()
|| !containsAlias(policy, alias)) {
return mInjector.binderWithCleanCallingIdentity(() -> {
// Should include alias in authentication policy
try (KeyChainConnection connection = KeyChain.bindAsUser(mContext,
caller.getUserHandle())) {
// The policy will be null if there is no credential management app
AppUriAuthenticationPolicy policy =
connection.getService().getCredentialManagementAppPolicy();
if (policy == null || policy.getAppAndUriMappings().isEmpty()
|| !containsAlias(policy, alias)) {
return false;
}
} catch (RemoteException | InterruptedException e) {
return false;
}
} catch (RemoteException | InterruptedException e) {
return false;
}
AppOpsManager appOpsManager = mInjector.getAppOpsManager();
return appOpsManager != null
? appOpsManager.noteOpNoThrow(AppOpsManager.OP_MANAGE_CREDENTIALS, caller.getUid(),
caller.getPackageName(), null, null) == AppOpsManager.MODE_ALLOWED
: false;
AppOpsManager appOpsManager = mInjector.getAppOpsManager();
if (appOpsManager == null) return false;
return appOpsManager.noteOpNoThrow(AppOpsManager.OP_MANAGE_CREDENTIALS, caller.getUid(),
caller.getPackageName(), null, null) == AppOpsManager.MODE_ALLOWED;
});
}
private static boolean containsAlias(AppUriAuthenticationPolicy policy, String alias) {