From 29ce85bab94a2d0dc98d9075ae86c8a282367117 Mon Sep 17 00:00:00 2001 From: Amith Yamasani Date: Wed, 3 Sep 2014 17:30:43 -0700 Subject: [PATCH] Don't allow guests to install from unknown sources Added a user restriction when creating a guest. Made sure that guests can't install profile owners that could undo the restriction. Bug: 17359648 Change-Id: Icdd919e8b1cbd79a69aacb76e573ec3449f18e4c --- core/java/android/os/UserManager.java | 1 + .../server/devicepolicy/DevicePolicyManagerService.java | 6 +++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/core/java/android/os/UserManager.java b/core/java/android/os/UserManager.java index 59220e1d0a373..374989227b8ff 100644 --- a/core/java/android/os/UserManager.java +++ b/core/java/android/os/UserManager.java @@ -660,6 +660,7 @@ public class UserManager { try { Bundle guestRestrictions = mService.getDefaultGuestRestrictions(); guestRestrictions.putBoolean(DISALLOW_SMS, true); + guestRestrictions.putBoolean(DISALLOW_INSTALL_UNKNOWN_SOURCES, true); mService.setUserRestrictions(guestRestrictions, guest.id); } catch (RemoteException re) { Log.w(TAG, "Could not update guest restrictions"); diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index cad2772007306..9b5a7cec8510b 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -3654,11 +3654,15 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { } mContext.enforceCallingOrSelfPermission(android.Manifest.permission.MANAGE_USERS, null); - if (mUserManager.getUserInfo(userHandle) == null) { + UserInfo info = mUserManager.getUserInfo(userHandle); + if (info == null) { // User doesn't exist. throw new IllegalArgumentException( "Attempted to set profile owner for invalid userId: " + userHandle); } + if (info.isGuest()) { + throw new IllegalStateException("Cannot set a profile owner on a guest"); + } if (who == null || !DeviceOwner.isInstalledForUser(who.getPackageName(), userHandle)) {