Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Enforce missing permission getCameraDisabled" into sc-v2-dev am: 60aed7329d

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/15934241

Change-Id: I26f7b3f70982b0c74ec43de8a85cb82451b2c0ea
This commit is contained in:
Ayush Sharma
2021-12-22 17:04:38 +00:00
committed by Automerger Merge Worker
parent 405a2f3ea0 60aed7329d
commit f4e3b530b9
2 changed files with 21 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -1995,13 +1995,12 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
final DevicePolicyData policy = getUserData(UserHandle.getUserId(callerUid));
ActiveAdmin admin = policy.mAdminMap.get(adminComponent);
if (admin == null) {
// Throwing combined exception message for both the cases here, because from different
// security exceptions it could be deduced if particular package is admin package.
if (admin == null || admin.getUid() != callerUid) {
throw new SecurityException(String.format(
"No active admin for %s", adminComponent));
}
if (admin.getUid() != callerUid) {
throw new SecurityException(String.format(
"Admin %s is not owned by uid %d", adminComponent, callerUid));
"Admin %s does not exist or is not owned by uid %d", adminComponent,
callerUid));
}
if (callerPackage != null) {
Preconditions.checkArgument(callerPackage.equals(adminComponent.getPackageName()));
@@ -8181,17 +8180,16 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
*/
@Override
public boolean getCameraDisabled(ComponentName who, int userHandle, boolean parent) {
return getCameraDisabled(who, userHandle, /* mergeDeviceOwnerRestriction= */ true, parent);
}
private boolean getCameraDisabled(ComponentName who, int userHandle,
boolean mergeDeviceOwnerRestriction, boolean parent) {
if (!mHasFeature) {
return false;
}
final CallerIdentity caller = getCallerIdentity(who);
Preconditions.checkCallAuthorization(hasFullCrossUsersPermission(caller, userHandle));
if (parent) {
Preconditions.checkCallAuthorization(
isProfileOwnerOfOrganizationOwnedDevice(getCallerIdentity().getUserId()));
isProfileOwnerOfOrganizationOwnedDevice(caller.getUserId()));
}
synchronized (getLockObject()) {
@@ -8200,17 +8198,15 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
return (admin != null) && admin.disableCamera;
}
// First, see if DO has set it. If so, it's device-wide.
if (mergeDeviceOwnerRestriction) {
final ActiveAdmin deviceOwner = getDeviceOwnerAdminLocked();
if (deviceOwner != null && deviceOwner.disableCamera) {
return true;
}
final ActiveAdmin deviceOwner = getDeviceOwnerAdminLocked();
if (deviceOwner != null && deviceOwner.disableCamera) {
return true;
}
final int affectedUserId = parent ? getProfileParentId(userHandle) : userHandle;
// Return the strictest policy across all participating admins.
List<ActiveAdmin> admins = getActiveAdminsForAffectedUserLocked(affectedUserId);
// Determine whether or not the device camera is disabled for any active admins.
for (ActiveAdmin admin: admins) {
for (ActiveAdmin admin : admins) {
if (admin.disableCamera) {
return true;
}

10
services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java
View File

@@ -102,6 +102,7 @@ import android.graphics.Color;
import android.hardware.usb.UsbManager;
import android.net.ConnectivityManager;
import android.net.Uri;
import android.os.Build;
import android.os.Build.VERSION_CODES;
import android.os.Bundle;
import android.os.Process;
@@ -2102,9 +2103,12 @@ public class DevicePolicyManagerTest extends DpmTestBase {
mContext.callerPermissions.add(permission.MANAGE_DEVICE_ADMINS);
mContext.callerPermissions.add(permission.INTERACT_ACROSS_USERS_FULL);
setUpPackageManagerForAdmin(admin1, DpmMockContext.CALLER_SYSTEM_USER_UID);
setUpPackageManagerForAdmin(admin1, DpmMockContext.CALLER_SYSTEM_USER_UID, null,
Build.VERSION_CODES.Q);
dpm.setActiveAdmin(admin1, /* replace =*/ false, UserHandle.USER_SYSTEM);
mContext.binder.callingUid = DpmMockContext.CALLER_SYSTEM_USER_UID;
boolean originalCameraDisabled = dpm.getCameraDisabled(admin1);
assertExpectException(SecurityException.class, /* messageRegex= */ null,
() -> dpm.setCameraDisabled(admin1, true));
@@ -2674,8 +2678,8 @@ public class DevicePolicyManagerTest extends DpmTestBase {
setUpPackageManagerForAdmin(admin1, DpmMockContext.CALLER_SYSTEM_USER_UID);
// Test 1. Caller doesn't have DO or DA.
assertExpectException(SecurityException.class, /* messageRegex= */ "No active admin",
() -> dpm.getWifiMacAddress(admin1));
assertExpectException(SecurityException.class, /* messageRegex= */
"does not exist or is not owned by uid", () -> dpm.getWifiMacAddress(admin1));
// DO needs to be an DA.
dpm.setActiveAdmin(admin1, /* replace =*/ false);