Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Removing enforcePermissionsAndGetEnforcingAdmin from cleanCallingIdentity block

Browse Source 
enforcePermissions was failing with security exception as it checks callingIdentity which was being
cleared beforehand.

Bug: b/282180465
Test: manual
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:1e415b7937550dbb22075c0bd91a60b7f1a1245b)
Merged-In: Iae54d93f4ba08657f5d7d466cfa8e02bfa6c5809
Change-Id: Iae54d93f4ba08657f5d7d466cfa8e02bfa6c5809
This commit is contained in:
shreyacsingh
2023-06-06 17:18:09 +00:00
committed by Cherrypicker Worker
parent f4f5ce437c
commit 9d85929aa4
1 changed files with 25 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -7840,27 +7840,29 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
throw new SecurityException("Cannot wipe data. " + restriction
+ " restriction is set for user " + userId);
}
});
boolean isSystemUser = userId == UserHandle.USER_SYSTEM;
boolean wipeDevice;
if (factoryReset == null || !mInjector.isChangeEnabled(EXPLICIT_WIPE_BEHAVIOUR,
adminPackage,
userId)) {
// Legacy mode
wipeDevice = isSystemUser;
boolean isSystemUser = userId == UserHandle.USER_SYSTEM;
boolean wipeDevice;
if (factoryReset == null || !mInjector.isChangeEnabled(EXPLICIT_WIPE_BEHAVIOUR,
adminPackage,
userId)) {
// Legacy mode
wipeDevice = isSystemUser;
} else {
// Explicit behaviour
if (factoryReset) {
EnforcingAdmin enforcingAdmin = enforcePermissionsAndGetEnforcingAdmin(
/*admin=*/ null,
/*permission=*/ new String[]{MANAGE_DEVICE_POLICY_WIPE_DATA,
MASTER_CLEAR},
USES_POLICY_WIPE_DATA,
adminPackage,
factoryReset ? UserHandle.USER_ALL :
getAffectedUser(calledOnParentInstance));
wipeDevice = true;
} else {
// Explicit behaviour
if (factoryReset) {
EnforcingAdmin enforcingAdmin = enforcePermissionsAndGetEnforcingAdmin(
/*admin=*/ null,
/*permission=*/ new String[]{MANAGE_DEVICE_POLICY_WIPE_DATA,
MASTER_CLEAR},
USES_POLICY_WIPE_DATA,
adminPackage,
factoryReset ? UserHandle.USER_ALL :
getAffectedUser(calledOnParentInstance));
wipeDevice = true;
} else {
mInjector.binderWithCleanCallingIdentity(() -> {
Preconditions.checkCallAuthorization(!isSystemUser,
"User %s is a system user and cannot be removed", userId);
boolean isLastNonHeadlessUser = getUserInfo(userId).isFull()
@@ -7871,9 +7873,11 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
"Removing user %s would leave the device without any active users. "
+ "Consider factory resetting the device instead.",
userId);
wipeDevice = false;
}
});
wipeDevice = false;
}
}
mInjector.binderWithCleanCallingIdentity(() -> {
if (wipeDevice) {
forceWipeDeviceNoLock(
(flags & WIPE_EXTERNAL_STORAGE) != 0,