Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

GET_ACCOUNTS_PRIVILEGED permission check for Account Discovery API.

Browse Source 
GET_ACCOUNTS_PRIVELEGED still works in Android O, but authenticators can
limit visibility for apps with the permission.
Bug: 34841115
Test: cts, manual tests.

Change-Id: Ibd87f6172969c550b6166f88176924e517393763
This commit is contained in:
Dmitry Dementyev
2017-02-03 18:17:59 -08:00
parent 3d6f51d18b
commit f794c8dc1b
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
services/core/java/com/android/server/accounts/AccountManagerService.java
View File

@@ -636,11 +636,10 @@ public class AccountManagerService
return visibility;
}
if (isPermittedForPackage(packageName, accounts.userId,
Manifest.permission.GET_ACCOUNTS_PRIVILEGED)) {
return AccountManager.VISIBILITY_VISIBLE;
}
// Profile owner gets visibility by default.
boolean isPrivileged = isPermittedForPackage(packageName, accounts.userId,
Manifest.permission.GET_ACCOUNTS_PRIVILEGED);
// Device/Profile owner gets visibility by default.
if (isProfileOwner(uid)) {
return AccountManager.VISIBILITY_VISIBLE;
}
@@ -650,7 +649,7 @@ public class AccountManagerService
boolean preO = isPreOApplication(packageName);
if ((signatureCheckResult != SIGNATURE_CHECK_MISMATCH)
|| (preO && checkGetAccountsPermission(packageName, accounts.userId))
|| canReadContacts) {
|| canReadContacts || isPrivileged) {
// Use legacy for preO apps with GET_ACCOUNTS permission or pre/postO with signature
// match.
visibility = getAccountVisibility(account,