From 1b7f98457f6903a52c394f830d457781eec05b13 Mon Sep 17 00:00:00 2001
From: Felipe Leme <felipeal@google.com>
Date: Fri, 24 Sep 2021 11:33:45 -0700
Subject: [PATCH] Fixed DPMS.setDeviceOwner() permission check.

It was not clearing the caller's identity before calling
manageUserUnchecked().

Test: atest com.android.bedstead.nene.devicepolicy.DevicePolicyTest#setDeviceOwner_deviceOwnerIsAlreadySet_throwsException

Fixes: 200810234

Change-Id: I3f96e1bf477f310d0c8eee935839cf401df44e02
---
 .../devicepolicy/DevicePolicyManagerService.java     | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 6b4b0c94f657e..c283ef07dce6f 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -8414,17 +8414,19 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
             mDeviceAdminServiceController.startServiceForOwner(
                     admin.getPackageName(), userId, "set-device-owner");
 
-            Slogf.i(LOG_TAG, "Device owner set: " + admin + " on user " + userId);
+            Slogf.i(LOG_TAG, "Device owner set: %s on user %d", admin.flattenToShortString(),
+                    userId);
 
             if (mInjector.userManagerIsHeadlessSystemUserMode()) {
                 int currentForegroundUser = getCurrentForegroundUserId();
-                Slogf.i(LOG_TAG, "setDeviceOwner(): setting " + admin
-                        + " as profile owner on user " + currentForegroundUser);
+                Slogf.i(LOG_TAG, "setDeviceOwner(): setting %s as profile owner on user %d",
+                        admin.flattenToShortString(), currentForegroundUser);
                 // Sets profile owner on current foreground user since
                 // the human user will complete the DO setup workflow from there.
-                manageUserUnchecked(/* deviceOwner= */ admin, /* profileOwner= */ admin,
+                mInjector.binderWithCleanCallingIdentity(() -> manageUserUnchecked(
+                        /* deviceOwner= */ admin, /* profileOwner= */ admin,
                         /* managedUser= */ currentForegroundUser, /* adminExtras= */ null,
-                        /* showDisclaimer= */ false);
+                        /* showDisclaimer= */ false));
             }
             return true;
         }