Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Restrict MANAGE_DEVICE_ADMIN permissions to signature

Browse Source 
We want to prevent privileged apps from calling DevicePolicyManager#setActiveAdmin. After this, only apps signed with the platform certificate (e.g Settings / ManagedProvisioning) will be allowed to set Device Admins.

Leave @SystemApi so that it is clear that it 'was' a privileged permission, but add @removed to show that it is no longer a privileged permission.

Bug: 111153365
Test: atest PermissionsHostTest && atest CtsAdminTestCases
Change-Id: I688e87cf09ad206f4f517a7be960c2aa01af8fc4
This commit is contained in:
Zimuzo
2018-08-29 10:47:51 +01:00
parent be749520c5
commit 8236d331be
3 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
api/system-current.txt
View File

@@ -94,7 +94,6 @@ package android {
field public static final java.lang.String MANAGE_CONTENT_CAPTURE = "android.permission.MANAGE_CONTENT_CAPTURE";
field public static final java.lang.String MANAGE_CONTENT_SUGGESTIONS = "android.permission.MANAGE_CONTENT_SUGGESTIONS";
field public static final java.lang.String MANAGE_DEBUGGING = "android.permission.MANAGE_DEBUGGING";
field public static final java.lang.String MANAGE_DEVICE_ADMINS = "android.permission.MANAGE_DEVICE_ADMINS";
field public static final java.lang.String MANAGE_IPSEC_TUNNELS = "android.permission.MANAGE_IPSEC_TUNNELS";
field public static final java.lang.String MANAGE_ROLE_HOLDERS = "android.permission.MANAGE_ROLE_HOLDERS";
field public static final java.lang.String MANAGE_ROLLBACKS = "android.permission.MANAGE_ROLLBACKS";

8
api/system-removed.txt
View File

@@ -1,3 +1,11 @@
package android {
public static final class Manifest.permission {
field public static final java.lang.String MANAGE_DEVICE_ADMINS = "android.permission.MANAGE_DEVICE_ADMINS";
}
}
package android.app {
public class Notification implements android.os.Parcelable {

5
core/res/AndroidManifest.xml
View File

@@ -3196,9 +3196,10 @@
<!-- @SystemApi Required to add or remove another application as a device admin.
<p>Not for use by third-party applications.
@hide -->
@hide
@removed -->
<permission android:name="android.permission.MANAGE_DEVICE_ADMINS"
android:protectionLevel="signature|privileged" />
android:protectionLevel="signature" />
<!-- @SystemApi Allows an app to reset the device password.
<p>Not for use by third-party applications.