diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java index 1392d0232262a..e90100a09363f 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java @@ -27,6 +27,7 @@ import static android.content.pm.UserProperties.INHERIT_DEVICE_POLICY_FROM_PAREN import android.Manifest; import android.annotation.NonNull; import android.annotation.Nullable; +import android.app.AppGlobals; import android.app.BroadcastOptions; import android.app.admin.DevicePolicyIdentifiers; import android.app.admin.DevicePolicyManager; @@ -45,6 +46,7 @@ import android.content.pm.UserProperties; import android.os.Binder; import android.os.Bundle; import android.os.Environment; +import android.os.RemoteException; import android.os.UserHandle; import android.os.UserManager; import android.telephony.TelephonyManager; @@ -56,6 +58,7 @@ import android.util.Xml; import com.android.internal.util.XmlUtils; import com.android.modules.utils.TypedXmlPullParser; import com.android.modules.utils.TypedXmlSerializer; +import com.android.server.utils.Slogf; import libcore.io.IoUtils; @@ -1014,20 +1017,44 @@ final class DevicePolicyEngine { /** * Handles internal state related to packages getting updated. */ - void handlePackageChanged(@Nullable String updatedPackage, int userId, boolean packageRemoved) { - if (updatedPackage == null) { - return; - } - if (packageRemoved) { + void handlePackageChanged( + @Nullable String updatedPackage, int userId, @Nullable String removedDpcPackage) { + Binder.withCleanCallingIdentity(() -> { Set admins = getEnforcingAdminsOnUser(userId); - for (EnforcingAdmin admin : admins) { - if (admin.getPackageName().equals(updatedPackage)) { - // remove policies for the uninstalled package - removePoliciesForAdmin(admin); + if (removedDpcPackage != null) { + for (EnforcingAdmin admin : admins) { + if (removedDpcPackage.equals(admin.getPackageName())) { + removePoliciesForAdmin(admin); + return; + } } } - } else { - updateDeviceAdminServiceOnPackageChanged(updatedPackage, userId); + for (EnforcingAdmin admin : admins) { + if (updatedPackage == null || updatedPackage.equals(admin.getPackageName())) { + if (!isPackageInstalled(admin.getPackageName(), userId)) { + Slogf.i(TAG, String.format( + "Admin package %s not found for user %d, removing admin policies", + admin.getPackageName(), userId)); + // remove policies for the uninstalled package + removePoliciesForAdmin(admin); + return; + } + } + } + if (updatedPackage != null) { + updateDeviceAdminServiceOnPackageChanged(updatedPackage, userId); + } + }); + } + + private boolean isPackageInstalled(String packageName, int userId) { + try { + return AppGlobals.getPackageManager().getPackageInfo( + packageName, 0, userId) != null; + } catch (RemoteException re) { + // Shouldn't happen. + Slogf.wtf(TAG, "Error handling package changes", re); + return true; } } diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index 8d5a013cc6f75..a04849323bb65 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -446,7 +446,6 @@ import android.util.AtomicFile; import android.util.DebugUtils; import android.util.IndentingPrintWriter; import android.util.IntArray; -import android.util.Log; import android.util.Pair; import android.util.Slog; import android.util.SparseArray; @@ -1395,6 +1394,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { private void handlePackagesChanged(@Nullable String packageName, int userHandle) { boolean removedAdmin = false; + String removedAdminPackage = null; if (VERBOSE_LOG) { Slogf.d(LOG_TAG, "Handling package changes package " + packageName + " for user " + userHandle); @@ -1417,6 +1417,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { "Admin package %s not found for user %d, removing active admin", packageName, userHandle)); removedAdmin = true; + removedAdminPackage = adminPackage; policy.mAdminList.remove(i); policy.mAdminMap.remove(aa.info.getComponent()); pushActiveAdminPackagesLocked(userHandle); @@ -1450,7 +1451,8 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { startOwnerService(userHandle, "package-broadcast"); } if (isPolicyEngineForFinanceFlagEnabled() || isPermissionCheckFlagEnabled()) { - mDevicePolicyEngine.handlePackageChanged(packageName, userHandle, removedAdmin); + mDevicePolicyEngine.handlePackageChanged( + packageName, userHandle, removedAdminPackage); } // Persist updates if the removed package was an admin or delegate. if (removedAdmin || removedDelegate) { @@ -3549,7 +3551,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { deleteTransferOwnershipBundleLocked(metadata.userId); } updateSystemUpdateFreezePeriodsRecord(/* saveIfChanged */ true); - pushUserControlDisabledPackagesLocked(metadata.userId); + if (!isPolicyEngineForFinanceFlagEnabled()) { + pushUserControlDisabledPackagesLocked(metadata.userId); + } } private void maybeLogStart() { @@ -10111,7 +10115,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { clearUserPoliciesLocked(userId); clearOverrideApnUnchecked(); clearApplicationRestrictions(userId); - mInjector.getPackageManagerInternal().clearBlockUninstallForUser(userId); + if (!isPolicyEngineForFinanceFlagEnabled()) { + mInjector.getPackageManagerInternal().clearBlockUninstallForUser(userId); + } mOwners.clearDeviceOwner(); mOwners.writeDeviceOwner();