Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Perform the user-allowlist check after all other fixed allowlist check" into tm-dev am: 6d33a7c73b am: d1539100c7

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/19302198

Change-Id: I04bf30ad57b6d8bb90a07b5d0bf6e1b72b29bc04
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Jing Ji
2022-07-26 19:01:58 +00:00
committed by Automerger Merge Worker
parent f39d439341 d1539100c7
commit 9891393ca3
1 changed files with 19 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
services/core/java/com/android/server/am/AppRestrictionController.java
View File

@@ -2790,13 +2790,6 @@ public final class AppRestrictionController {
if (isOnSystemDeviceIdleAllowlist(uid)) { if (isOnSystemDeviceIdleAllowlist(uid)) {
return REASON_SYSTEM_ALLOW_LISTED; return REASON_SYSTEM_ALLOW_LISTED;
} }
if (isOnDeviceIdleAllowlist(uid)) {
return REASON_ALLOWLISTED_PACKAGE;
}
final ActivityManagerInternal am = mInjector.getActivityManagerInternal();
if (am.isAssociatedCompanionApp(UserHandle.getUserId(uid), uid)) {
return REASON_COMPANION_DEVICE_MANAGER;
}
if (UserManager.isDeviceInDemoMode(mContext)) { if (UserManager.isDeviceInDemoMode(mContext)) {
return REASON_DEVICE_DEMO_MODE; return REASON_DEVICE_DEMO_MODE;
} }
@@ -2805,6 +2798,7 @@ public final class AppRestrictionController {
.hasUserRestriction(UserManager.DISALLOW_APPS_CONTROL, userId)) { .hasUserRestriction(UserManager.DISALLOW_APPS_CONTROL, userId)) {
return REASON_DISALLOW_APPS_CONTROL; return REASON_DISALLOW_APPS_CONTROL;
} }
final ActivityManagerInternal am = mInjector.getActivityManagerInternal();
if (am.isDeviceOwner(uid)) { if (am.isDeviceOwner(uid)) {
return REASON_DEVICE_OWNER; return REASON_DEVICE_OWNER;
} }
@@ -2822,14 +2816,9 @@ public final class AppRestrictionController {
final AppOpsManager appOpsManager = mInjector.getAppOpsManager(); final AppOpsManager appOpsManager = mInjector.getAppOpsManager();
final PackageManagerInternal pm = mInjector.getPackageManagerInternal(); final PackageManagerInternal pm = mInjector.getPackageManagerInternal();
final AppStandbyInternal appStandbyInternal = mInjector.getAppStandbyInternal(); final AppStandbyInternal appStandbyInternal = mInjector.getAppStandbyInternal();
// Check each packages to see if any of them is in the "fixed" exemption cases.
for (String pkg : packages) { for (String pkg : packages) {
if (appOpsManager.checkOpNoThrow(AppOpsManager.OP_ACTIVATE_VPN, if (isSystemModule(pkg)) {
uid, pkg) == AppOpsManager.MODE_ALLOWED) {
return REASON_OP_ACTIVATE_VPN;
} else if (appOpsManager.checkOpNoThrow(AppOpsManager.OP_ACTIVATE_PLATFORM_VPN,
uid, pkg) == AppOpsManager.MODE_ALLOWED) {
return REASON_OP_ACTIVATE_PLATFORM_VPN;
} else if (isSystemModule(pkg)) {
return REASON_SYSTEM_MODULE; return REASON_SYSTEM_MODULE;
} else if (isCarrierApp(pkg)) { } else if (isCarrierApp(pkg)) {
return REASON_CARRIER_PRIVILEGED_APP; return REASON_CARRIER_PRIVILEGED_APP;
@@ -2843,6 +2832,16 @@ public final class AppRestrictionController {
return REASON_ACTIVE_DEVICE_ADMIN; return REASON_ACTIVE_DEVICE_ADMIN;
} }
} }
// Loop the packages again, and check the user-configurable exemptions.
for (String pkg : packages) {
if (appOpsManager.checkOpNoThrow(AppOpsManager.OP_ACTIVATE_VPN,
uid, pkg) == AppOpsManager.MODE_ALLOWED) {
return REASON_OP_ACTIVATE_VPN;
} else if (appOpsManager.checkOpNoThrow(AppOpsManager.OP_ACTIVATE_PLATFORM_VPN,
uid, pkg) == AppOpsManager.MODE_ALLOWED) {
return REASON_OP_ACTIVATE_PLATFORM_VPN;
}
}
} }
if (isRoleHeldByUid(RoleManager.ROLE_DIALER, uid)) { if (isRoleHeldByUid(RoleManager.ROLE_DIALER, uid)) {
return REASON_ROLE_DIALER; return REASON_ROLE_DIALER;
@@ -2850,6 +2849,12 @@ public final class AppRestrictionController {
if (isRoleHeldByUid(RoleManager.ROLE_EMERGENCY, uid)) { if (isRoleHeldByUid(RoleManager.ROLE_EMERGENCY, uid)) {
return REASON_ROLE_EMERGENCY; return REASON_ROLE_EMERGENCY;
} }
if (isOnDeviceIdleAllowlist(uid)) {
return REASON_ALLOWLISTED_PACKAGE;
}
if (am.isAssociatedCompanionApp(UserHandle.getUserId(uid), uid)) {
return REASON_COMPANION_DEVICE_MANAGER;
}
return REASON_DENIED; return REASON_DENIED;
} }