Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Grant cert installer access to installKeyPair()

Browse Source 
Bug: 20041977
Change-Id: Id0dc0bce8461c71d7220c1802dcca82933805996
This commit is contained in:
Rubin Xu
2015-04-02 12:40:20 +01:00
parent dff34599c2
commit acdc1839cf
2 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
core/java/android/app/admin/DevicePolicyManager.java
View File

@@ -2156,7 +2156,8 @@ public class DevicePolicyManager {
* Called by a device or profile owner to install a certificate and private key pair. The
* keypair will be visible to all apps within the profile.
*
* @param who Which {@link DeviceAdminReceiver} this request is associated with.
* @param who Which {@link DeviceAdminReceiver} this request is associated with. Use
* <code>null</code> if calling from a delegated certificate installer.
* @param privKey The private key to install.
* @param cert The certificate to install.
* @param alias The private key alias under which to install the certificate. If a certificate
@@ -2193,9 +2194,9 @@ public class DevicePolicyManager {
/**
* Called by a profile owner or device owner to grant access to privileged certificate
* manipulation APIs to a third-party CA certificate installer app. Granted APIs include
* manipulation APIs to a third-party certificate installer app. Granted APIs include
* {@link #getInstalledCaCerts}, {@link #hasCaCertInstalled}, {@link #installCaCert},
* {@link #uninstallCaCert} and {@link #uninstallAllUserCaCerts}.
* {@link #uninstallCaCert}, {@link #uninstallAllUserCaCerts} and {@link #installKeyPair}.
* <p>
* Delegated certificate installer is a per-user state. The delegated access is persistent until
* it is later cleared by calling this method with a null value or uninstallling the certificate

11
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -3016,9 +3016,14 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
@Override
public boolean installKeyPair(ComponentName who, byte[] privKey, byte[] cert, String alias) {
Preconditions.checkNotNull(who, "ComponentName is null");
synchronized (this) {
getActiveAdminForCallerLocked(who, DeviceAdminInfo.USES_POLICY_PROFILE_OWNER);
if (who == null) {
if (!isCallerDelegatedCertInstaller()) {
throw new SecurityException("who == null, but caller is not cert installer");
}
} else {
synchronized (this) {
getActiveAdminForCallerLocked(who, DeviceAdminInfo.USES_POLICY_PROFILE_OWNER);
}
}
final UserHandle userHandle = new UserHandle(UserHandle.getCallingUserId());
final long id = Binder.clearCallingIdentity();