From 3a595e73920a83691f812af6d52ed3aefbce3038 Mon Sep 17 00:00:00 2001 From: Ayush Sharma Date: Tue, 2 Aug 2022 16:10:04 +0100 Subject: [PATCH] Simplify checks for get profile/device owner Bug: 225127000 Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest Change-Id: Idefdf0d4967cdd9d6c6e24c92ff0a066fad2c9c5 --- .../DevicePolicyManagerService.java | 218 +++++++++--------- 1 file changed, 107 insertions(+), 111 deletions(-) diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index bb6bd4aa1bbc3..0effe17c874a7 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -2485,83 +2485,41 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { reqPolicy, /* permission= */ null); } - @NonNull ActiveAdmin getDeviceOwnerLocked(final CallerIdentity caller) { + ActiveAdmin getDeviceOwnerLocked(@UserIdInt int userId) { ensureLocked(); ComponentName doComponent = mOwners.getDeviceOwnerComponent(); - Preconditions.checkState(doComponent != null, - "No device owner for user %d", caller.getUid()); - - // Use the user ID of the caller instead of mOwners.getDeviceOwnerUserId() because - // secondary, affiliated users will have their own admin. - ActiveAdmin doAdmin = getUserData(caller.getUserId()).mAdminMap.get(doComponent); - Preconditions.checkState(doAdmin != null, - "Device owner %s for user %d not found", doComponent, - caller.getUid()); - - Preconditions.checkCallAuthorization(doAdmin.getUid() == caller.getUid(), - "Admin %s is not owned by uid %d, but uid %d", doComponent, - caller.getUid(), doAdmin.getUid()); - - Preconditions.checkCallAuthorization( - !caller.hasAdminComponent() - || doAdmin.info.getComponent().equals(caller.getComponentName()), - "Caller component %s is not device owner", - caller.getComponentName()); - + ActiveAdmin doAdmin = getUserData(userId).mAdminMap.get(doComponent); return doAdmin; } - @NonNull ActiveAdmin getProfileOwnerLocked(final CallerIdentity caller) { + ActiveAdmin getProfileOwnerLocked(@UserIdInt int userId) { ensureLocked(); - final ComponentName poAdminComponent = mOwners.getProfileOwnerComponent(caller.getUserId()); - - Preconditions.checkState(poAdminComponent != null, - "No profile owner for user %d", caller.getUid()); - - ActiveAdmin poAdmin = getUserData(caller.getUserId()).mAdminMap.get(poAdminComponent); - Preconditions.checkState(poAdmin != null, - "No device profile owner for caller %d", caller.getUid()); - - Preconditions.checkCallAuthorization(poAdmin.getUid() == caller.getUid(), - "Admin %s is not owned by uid %d", poAdminComponent, - caller.getUid()); - - Preconditions.checkCallAuthorization( - !caller.hasAdminComponent() - || poAdmin.info.getComponent().equals(caller.getComponentName()), - "Caller component %s is not profile owner", - caller.getComponentName()); - + final ComponentName poAdminComponent = mOwners.getProfileOwnerComponent(userId); + ActiveAdmin poAdmin = getUserData(userId).mAdminMap.get(poAdminComponent); return poAdmin; } @NonNull ActiveAdmin getOrganizationOwnedProfileOwnerLocked(final CallerIdentity caller) { - final ActiveAdmin profileOwner = getProfileOwnerLocked(caller); - Preconditions.checkCallAuthorization( mOwners.isProfileOwnerOfOrganizationOwnedDevice(caller.getUserId()), - "Admin %s is not of an org-owned device", - profileOwner.info.getComponent()); + "Caller %s is not an admin of an org-owned device", + caller.getComponentName()); + final ActiveAdmin profileOwner = getProfileOwnerLocked(caller.getUserId()); return profileOwner; } - @NonNull ActiveAdmin getProfileOwnerOrDeviceOwnerLocked(final CallerIdentity caller) { + ActiveAdmin getProfileOwnerOrDeviceOwnerLocked(@UserIdInt int userId) { ensureLocked(); // Try to find an admin which can use reqPolicy - final ComponentName poAdminComponent = mOwners.getProfileOwnerComponent(caller.getUserId()); + final ComponentName poAdminComponent = mOwners.getProfileOwnerComponent(userId); final ComponentName doAdminComponent = mOwners.getDeviceOwnerComponent(); - if (poAdminComponent == null && doAdminComponent == null) { - throw new IllegalStateException( - String.format("No profile or device owner for user %d", caller.getUid())); - } - if (poAdminComponent != null) { - return getProfileOwnerLocked(caller); + return getProfileOwnerLocked(userId); } - return getDeviceOwnerLocked(caller); + return getDeviceOwnerLocked(userId); } @NonNull ActiveAdmin getParentOfAdminIfRequired(ActiveAdmin admin, boolean parent) { @@ -4132,7 +4090,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { List changedProviders = null; synchronized (getLockObject()) { - ActiveAdmin activeAdmin = getProfileOwnerLocked(caller); + ActiveAdmin activeAdmin = getProfileOwnerLocked(caller.getUserId()); if (activeAdmin.crossProfileWidgetProviders == null) { activeAdmin.crossProfileWidgetProviders = new ArrayList<>(); } @@ -4167,7 +4125,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { List changedProviders = null; synchronized (getLockObject()) { - ActiveAdmin activeAdmin = getProfileOwnerLocked(caller); + ActiveAdmin activeAdmin = getProfileOwnerLocked(caller.getUserId()); if (activeAdmin.crossProfileWidgetProviders == null || activeAdmin.crossProfileWidgetProviders.isEmpty()) { return false; @@ -4201,7 +4159,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { Preconditions.checkCallAuthorization(isProfileOwner(caller)); synchronized (getLockObject()) { - ActiveAdmin activeAdmin = getProfileOwnerLocked(caller); + ActiveAdmin activeAdmin = getProfileOwnerLocked(caller.getUserId()); if (activeAdmin.crossProfileWidgetProviders == null || activeAdmin.crossProfileWidgetProviders.isEmpty()) { return null; @@ -4721,7 +4679,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { synchronized (getLockObject()) { final ActiveAdmin admin = getParentOfAdminIfRequired( - getProfileOwnerOrDeviceOwnerLocked(caller), calledOnParent); + getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()), calledOnParent); if (admin.mPasswordComplexity != passwordComplexity) { // We require the caller to explicitly clear any password quality requirements set // on the parent DPM instance, to avoid the case where password requirements are @@ -4990,7 +4948,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { // If caller has PO (or DO) throw or fail silently depending on its target SDK level. if (isDefaultDeviceOwner(caller) || isProfileOwner(caller)) { synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); if (getTargetSdk(admin.info.getPackageName(), userHandle) < Build.VERSION_CODES.O) { Slogf.e(LOG_TAG, "DPC can no longer call resetPassword()"); return false; @@ -5249,8 +5207,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { final int userHandle = caller.getUserId(); boolean changed = false; synchronized (getLockObject()) { - ActiveAdmin ap = getParentOfAdminIfRequired(getProfileOwnerOrDeviceOwnerLocked(caller), - parent); + ActiveAdmin ap = getParentOfAdminIfRequired( + getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()), parent); if (ap.strongAuthUnlockTimeout != timeoutMs) { ap.strongAuthUnlockTimeout = timeoutMs; saveSettingsLocked(userHandle); @@ -6519,7 +6477,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { if (vpnPackage == null) { final String prevVpnPackage; synchronized (getLockObject()) { - prevVpnPackage = getProfileOwnerOrDeviceOwnerLocked(caller).mAlwaysOnVpnPackage; + prevVpnPackage = getProfileOwnerOrDeviceOwnerLocked( + caller.getUserId()).mAlwaysOnVpnPackage; // If the admin is clearing VPN package but hasn't configure any VPN previously, // ignore it so that it doesn't interfere with user-configured VPNs. if (TextUtils.isEmpty(prevVpnPackage)) { @@ -6560,7 +6519,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { .setInt(lockdownAllowlist != null ? lockdownAllowlist.size() : 0) .write(); synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); if (!TextUtils.equals(vpnPackage, admin.mAlwaysOnVpnPackage) || lockdown != admin.mAlwaysOnVpnLockdown) { admin.mAlwaysOnVpnPackage = vpnPackage; @@ -6947,7 +6906,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { final int frpManagementAgentUid = getFrpManagementAgentUidOrThrow(); synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); admin.mFactoryResetProtectionPolicy = policy; saveSettingsLocked(caller.getUserId()); } @@ -6992,7 +6951,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { Preconditions.checkCallAuthorization( isDefaultDeviceOwner(caller) || isProfileOwnerOfOrganizationOwnedDevice(caller)); - admin = getProfileOwnerOrDeviceOwnerLocked(caller); + admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); } } @@ -7635,11 +7594,14 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { final CallerIdentity caller = getCallerIdentity(who); if (parent) { Preconditions.checkCallAuthorization(isProfileOwnerOfOrganizationOwnedDevice(caller)); + } else { + Preconditions.checkCallAuthorization(isProfileOwner(caller) + || isDeviceOwner(caller)); } synchronized (getLockObject()) { - ActiveAdmin ap = getParentOfAdminIfRequired(getProfileOwnerOrDeviceOwnerLocked(caller), - parent); + ActiveAdmin ap = getParentOfAdminIfRequired( + getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()), parent); if (ap.disableScreenCapture != disabled) { ap.disableScreenCapture = disabled; saveSettingsLocked(caller.getUserId()); @@ -7725,7 +7687,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { isDefaultDeviceOwner(caller) || isProfileOwner(caller)); synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); if (admin.mNearbyNotificationStreamingPolicy != policy) { admin.mNearbyNotificationStreamingPolicy = policy; saveSettingsLocked(caller.getUserId()); @@ -7765,7 +7727,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { isDefaultDeviceOwner(caller) || isProfileOwner(caller)); synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); if (admin.mNearbyAppStreamingPolicy != policy) { admin.mNearbyAppStreamingPolicy = policy; saveSettingsLocked(caller.getUserId()); @@ -7804,12 +7766,14 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } Objects.requireNonNull(who, "ComponentName is null"); final CallerIdentity caller = getCallerIdentity(who); + Preconditions.checkCallAuthorization( + isDeviceOwner(caller) || isProfileOwner(caller)); boolean requireAutoTimeChanged = false; synchronized (getLockObject()) { Preconditions.checkCallAuthorization(!isManagedProfile(caller.getUserId()), "Managed profile cannot set auto time required"); - ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); if (admin.requireAutoTime != required) { admin.requireAutoTime = required; saveSettingsLocked(caller.getUserId()); @@ -8462,6 +8426,17 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } } + /** + * Returns {@code true} if the provided caller identity is of a device owner. + * @param caller identity of caller. + * @return true if {@code identity} is a device owner, false otherwise. + */ + public boolean isDeviceOwner(CallerIdentity caller) { + synchronized (getLockObject()) { + return isDeviceOwnerLocked(caller); + } + } + private boolean isDeviceOwnerLocked(CallerIdentity caller) { if (!mOwners.hasDeviceOwner() || mOwners.getDeviceOwnerUserId() != caller.getUserId()) { return false; @@ -8886,11 +8861,11 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { final CallerIdentity caller = getCallerIdentity(who); final int userId = caller.getUserId(); Preconditions.checkCallingUser(!isManagedProfile(userId)); + Preconditions.checkCallAuthorization(isProfileOwner(caller)); enforceUserUnlocked(userId); synchronized (getLockObject()) { - // Check if this is the profile owner who is calling - final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); mInjector.binderWithCleanCallingIdentity(() -> { clearProfileOwnerLocked(admin, userId); @@ -10265,6 +10240,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } Objects.requireNonNull(who, "ComponentName is null"); final CallerIdentity caller = getCallerIdentity(who); + Preconditions.checkCallAuthorization( + isDeviceOwner(caller) || isProfileOwner(caller)); if (packageList != null) { int userId = caller.getUserId(); @@ -10296,7 +10273,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); admin.permittedAccessiblityServices = packageList; saveSettingsLocked(UserHandle.getCallingUserId()); } @@ -10321,7 +10298,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { isDefaultDeviceOwner(caller) || isProfileOwner(caller)); synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); return admin.permittedAccessiblityServices; } } @@ -10454,7 +10431,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { synchronized (getLockObject()) { final ActiveAdmin admin = getParentOfAdminIfRequired( - getProfileOwnerOrDeviceOwnerLocked(caller), calledOnParentInstance); + getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()), calledOnParentInstance); admin.permittedInputMethods = packageList; saveSettingsLocked(caller.getUserId()); } @@ -10496,7 +10473,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { synchronized (getLockObject()) { final ActiveAdmin admin = getParentOfAdminIfRequired( - getProfileOwnerOrDeviceOwnerLocked(caller), calledOnParentInstance); + getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()), calledOnParentInstance); return admin.permittedInputMethods; } } @@ -10586,9 +10563,9 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { if (!isManagedProfile(caller.getUserId())) { return false; } - + Preconditions.checkCallAuthorization(isProfileOwner(caller)); synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); admin.permittedNotificationListeners = packageList; saveSettingsLocked(caller.getUserId()); } @@ -10602,11 +10579,13 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } Objects.requireNonNull(who, "ComponentName is null"); final CallerIdentity caller = getCallerIdentity(who); + Preconditions.checkCallAuthorization( + isDeviceOwner(caller) || isProfileOwner(caller)); synchronized (getLockObject()) { // API contract is to return null if there are no permitted cross-profile notification // listeners, including in Device Owner mode. - ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); return admin.permittedNotificationListeners; } } @@ -11379,10 +11358,16 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { return; } + if (parent) { + Preconditions.checkCallAuthorization(isProfileOwnerOfOrganizationOwnedDevice(caller)); + } else { + Preconditions.checkCallAuthorization(isDeviceOwner(caller) || isProfileOwner(caller)); + } + int userHandle = caller.getUserId(); synchronized (getLockObject()) { final ActiveAdmin activeAdmin = getParentOfAdminIfRequired( - getProfileOwnerOrDeviceOwnerLocked(caller), parent); + getProfileOwnerOrDeviceOwnerLocked(userHandle), parent); if (isDefaultDeviceOwner(caller)) { if (!UserRestrictionsUtils.canDeviceOwnerChange(key)) { @@ -11512,7 +11497,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { synchronized (getLockObject()) { final ActiveAdmin activeAdmin = getParentOfAdminIfRequired( - getProfileOwnerOrDeviceOwnerLocked(caller), parent); + getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()), parent); return activeAdmin.userRestrictions; } } @@ -11773,8 +11758,10 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { ap = getParentOfAdminIfRequired(getOrganizationOwnedProfileOwnerLocked(caller), parent); } else { - Preconditions.checkCallAuthorization(!isFinancedDeviceOwner(caller)); - ap = getParentOfAdminIfRequired(getProfileOwnerOrDeviceOwnerLocked(caller), parent); + Preconditions.checkCallAuthorization( + isDefaultDeviceOwner(caller) || isProfileOwner(caller)); + ap = getParentOfAdminIfRequired( + getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()), parent); } if (disabled) { @@ -11895,7 +11882,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { Preconditions.checkCallAuthorization(isProfileOwner(caller)); synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); if (admin.disableCallerId != disabled) { admin.disableCallerId = disabled; saveSettingsLocked(caller.getUserId()); @@ -11918,7 +11905,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { Preconditions.checkCallAuthorization(isProfileOwner(caller)); synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); return admin.disableCallerId; } } @@ -11946,7 +11933,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { Preconditions.checkCallAuthorization(isProfileOwner(caller)); synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); if (admin.disableContactsSearch != disabled) { admin.disableContactsSearch = disabled; saveSettingsLocked(caller.getUserId()); @@ -11969,7 +11956,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { Preconditions.checkCallAuthorization(isProfileOwner(caller)); synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); return admin.disableContactsSearch; } } @@ -12051,7 +12038,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { isDefaultDeviceOwner(caller) || isProfileOwner(caller)); synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); if (admin.disableBluetoothContactSharing != disabled) { admin.disableBluetoothContactSharing = disabled; saveSettingsLocked(caller.getUserId()); @@ -12076,7 +12063,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { isDefaultDeviceOwner(caller) || isProfileOwner(caller)); synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); return admin.disableBluetoothContactSharing; } } @@ -14406,9 +14393,10 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { final CallerIdentity caller = getCallerIdentity(who); Preconditions.checkCallingUser(isManagedProfile(caller.getUserId())); + Preconditions.checkCallAuthorization(isProfileOwner(caller)); synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); admin.organizationColor = color; saveSettingsLocked(caller.getUserId()); } @@ -14447,9 +14435,10 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { final CallerIdentity caller = getCallerIdentity(who); Preconditions.checkCallingUser(isManagedProfile(caller.getUserId())); + Preconditions.checkCallAuthorization(isProfileOwner(caller)); synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); return admin.organizationColor; } } @@ -14481,9 +14470,10 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } Objects.requireNonNull(who, "ComponentName is null"); final CallerIdentity caller = getCallerIdentity(who); + Preconditions.checkCallAuthorization(isDeviceOwner(caller) || isProfileOwner(caller)); synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); if (!TextUtils.equals(admin.organizationName, text)) { admin.organizationName = (text == null || text.length() == 0) ? null : text.toString(); @@ -14501,9 +14491,10 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { final CallerIdentity caller = getCallerIdentity(who); Preconditions.checkCallingUser(isManagedProfile(caller.getUserId())); + Preconditions.checkCallAuthorization(isDeviceOwner(caller) || isProfileOwner(caller)); synchronized (getLockObject()) { - ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); return admin.organizationName; } } @@ -14563,7 +14554,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { return packageNames; } synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); return mInjector.binderWithCleanCallingIdentity(() -> { final List excludedPkgs = removeInvalidPkgsForMeteredDataRestriction( caller.getUserId(), packageNames); @@ -14612,7 +14603,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { "Admin %s does not own the profile", caller.getComponentName()); synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); return admin.meteredDisabledPackages == null ? new ArrayList<>() : admin.meteredDisabledPackages; } @@ -16648,9 +16639,10 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } Objects.requireNonNull(who, "ComponentName is null"); final CallerIdentity caller = getCallerIdentity(who); + Preconditions.checkCallAuthorization(isProfileOwner(caller)); synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); admin.mCrossProfileCalendarPackages = packageNames; saveSettingsLocked(caller.getUserId()); } @@ -16669,9 +16661,10 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } Objects.requireNonNull(who, "ComponentName is null"); final CallerIdentity caller = getCallerIdentity(who); + Preconditions.checkCallAuthorization(isProfileOwner(caller)); synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); return admin.mCrossProfileCalendarPackages; } } @@ -16744,10 +16737,11 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { Objects.requireNonNull(who, "ComponentName is null"); Objects.requireNonNull(packageNames, "Package names is null"); final CallerIdentity caller = getCallerIdentity(who); + Preconditions.checkCallAuthorization(isProfileOwner(caller)); final List previousCrossProfilePackages; synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); previousCrossProfilePackages = admin.mCrossProfilePackages; if (packageNames.equals(previousCrossProfilePackages)) { return; @@ -16777,9 +16771,10 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } Objects.requireNonNull(who, "ComponentName is null"); final CallerIdentity caller = getCallerIdentity(who); + Preconditions.checkCallAuthorization(isProfileOwner(caller)); synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); return admin.mCrossProfilePackages; } } @@ -17034,7 +17029,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { "Common Criteria mode can only be controlled by a device owner or " + "a profile owner on an organization-owned device."); synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); admin.mCommonCriteriaMode = enabled; saveSettingsLocked(caller.getUserId()); } @@ -17055,7 +17050,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { + "a profile owner on an organization-owned device."); synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); return admin.mCommonCriteriaMode; } } @@ -17078,7 +17073,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { Preconditions.checkCallAuthorization(isProfileOwnerOfOrganizationOwnedDevice(caller)); synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); final long deadline = admin.mProfileOffDeadline; final int result = makeSuspensionReasons(admin.mSuspendPersonalApps, deadline != 0 && mInjector.systemCurrentTimeMillis() > deadline); @@ -17110,7 +17105,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { final int callingUserId = caller.getUserId(); synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerLocked(callingUserId); boolean shouldSaveSettings = false; if (admin.mSuspendPersonalApps != suspended) { admin.mSuspendPersonalApps = suspended; @@ -17402,7 +17397,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { final int userId = caller.getUserId(); synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerLocked(userId); // Ensure the timeout is long enough to avoid having bad user experience. if (timeoutMillis > 0 && timeoutMillis < MANAGED_PROFILE_MAXIMUM_TIME_OFF_THRESHOLD @@ -17446,7 +17441,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { Preconditions.checkCallAuthorization(isProfileOwnerOfOrganizationOwnedDevice(caller)); synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); return admin.mProfileMaximumTimeOffMillis; } } @@ -17458,7 +17453,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { enforceUserUnlocked(caller.getUserId()); synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); if (admin.mProfileOffDeadline > 0) { admin.mProfileOffDeadline = 0; saveSettingsLocked(caller.getUserId()); @@ -17473,7 +17468,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { enforceUserUnlocked(caller.getUserId()); synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerLocked(caller.getUserId()); return admin.mProfileOffDeadline != 0; } } @@ -18412,7 +18407,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { "USB data signaling cannot be disabled."); synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); if (admin.mUsbDataSignalingEnabled != enabled) { admin.mUsbDataSignalingEnabled = enabled; saveSettingsLocked(caller.getUserId()); @@ -18447,7 +18442,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { // If the caller is an admin, return the policy set by itself. Otherwise // return the device-wide policy. if (isDefaultDeviceOwner(caller) || isProfileOwnerOfOrganizationOwnedDevice(caller)) { - return getProfileOwnerOrDeviceOwnerLocked(caller).mUsbDataSignalingEnabled; + return getProfileOwnerOrDeviceOwnerLocked( + caller.getUserId()).mUsbDataSignalingEnabled; } else { return isUsbDataSignalingEnabledInternalLocked(); } @@ -18503,7 +18499,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { boolean valueChanged = false; synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); if (admin.mWifiMinimumSecurityLevel != level) { admin.mWifiMinimumSecurityLevel = level; saveSettingsLocked(caller.getUserId()); @@ -18549,7 +18545,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { boolean changed = false; synchronized (getLockObject()) { - final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller); + final ActiveAdmin admin = getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()); if (!Objects.equals(policy, admin.mWifiSsidPolicy)) { admin.mWifiSsidPolicy = policy; changed = true;