Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Only call canUserCallLockTask when the caller is a DPC" into udc-dev am: 6daf38c0e5

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/23434561

Change-Id: I8e4079791b07592cfec0ffc0eb9d02aa6370993c
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Elis Elliott
2023-05-30 10:52:32 +00:00
committed by Automerger Merge Worker
parent 9d30e66516 6daf38c0e5
commit e8f897e0b2
1 changed files with 12 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -11113,7 +11113,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
|| hasCallingOrSelfPermission(permission.INTERACT_ACROSS_USERS);
}
private boolean canUserUseLockTaskLocked(int userId) {
private boolean canDPCManagedUserUseLockTaskLocked(int userId) {
if (isUserAffiliatedWithDeviceLocked(userId)) {
return true;
}
@@ -11122,19 +11122,16 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
if (mOwners.hasDeviceOwner()) {
return false;
}
if (!isPermissionCheckFlagEnabled() && !isPolicyEngineForFinanceFlagEnabled()) {
final ComponentName profileOwner = getProfileOwnerAsUser(userId);
if (profileOwner == null) {
return false;
}
final ComponentName profileOwner = getProfileOwnerAsUser(userId);
if (profileOwner == null) {
return false;
}
// Managed profiles are not allowed to use lock task
if (isManagedProfile(userId)) {
return false;
}
return true;
}
private void enforceCanQueryLockTaskLocked(ComponentName who, String callerPackageName) {
@@ -11142,7 +11139,8 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
final int userId = caller.getUserId();
enforceCanQuery(MANAGE_DEVICE_POLICY_LOCK_TASK, caller.getPackageName(), userId);
if (!canUserUseLockTaskLocked(userId)) {
if ((isDeviceOwner(caller) || isProfileOwner(caller))
&& !canDPCManagedUserUseLockTaskLocked(userId)) {
throw new SecurityException("User " + userId + " is not allowed to use lock task");
}
}
@@ -11158,7 +11156,8 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
caller.getPackageName(),
userId
);
if (!canUserUseLockTaskLocked(userId)) {
if ((isDeviceOwner(caller) || isProfileOwner(caller))
&& !canDPCManagedUserUseLockTaskLocked(userId)) {
throw new SecurityException("User " + userId + " is not allowed to use lock task");
}
return enforcingAdmin;
@@ -11169,7 +11168,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
|| isDefaultDeviceOwner(caller) || isFinancedDeviceOwner(caller));
final int userId = caller.getUserId();
if (!canUserUseLockTaskLocked(userId)) {
if (!canDPCManagedUserUseLockTaskLocked(userId)) {
throw new SecurityException("User " + userId + " is not allowed to use lock task");
}
}
@@ -15101,7 +15100,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
final List<UserInfo> userInfos = mUserManager.getAliveUsers();
for (int i = userInfos.size() - 1; i >= 0; i--) {
int userId = userInfos.get(i).id;
if (canUserUseLockTaskLocked(userId)) {
if (canDPCManagedUserUseLockTaskLocked(userId)) {
continue;
}