Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 066b7ca5 authored by Elis Elliott's avatar Elis Elliott Committed by Automerger Merge Worker
Browse files

Merge "Revert "Revert "A few permission fixes.""" into udc-dev am: a57f466e 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/22906777



Change-Id: Ia92d2b2d5c27f426fbcf92adeda6b7e94b022177
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 7f31c2a7 a57f466e

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+20 −14
Original line number Diff line number Diff line
@@ -39,6 +39,7 @@ import static android.Manifest.permission.MANAGE_DEVICE_POLICY_DEFAULT_SMS; 
import static android.Manifest.permission.MANAGE_DEVICE_POLICY_DISPLAY;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_FACTORY_RESET;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_FUN;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_INPUT_METHODS;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_INSTALL_UNKNOWN_SOURCES;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_KEYGUARD;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_LOCALE;
@@ -12195,7 +12196,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { 
        }















        CallerIdentity caller;













        if (isPermissionCheckFlagEnabled()) {













        if (isPolicyEngineForFinanceFlagEnabled()) {















            caller = getCallerIdentity(who, callerPackageName);















        } else {















            caller = getCallerIdentity(who);









@@ -12205,7 +12206,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













        int userId = getProfileParentUserIfRequested(















                caller.getUserId(), calledOnParentInstance);















        if (calledOnParentInstance) {













            if (!isPermissionCheckFlagEnabled()) {













            if (!isPolicyEngineForFinanceFlagEnabled()) {















                Preconditions.checkCallAuthorization(















                        isProfileOwnerOfOrganizationOwnedDevice(caller));















            }









@@ -12213,7 +12214,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













                    "Permitted input methods must allow all input methods or only "















                            + "system input methods when called on the parent instance of an "















                            + "organization-owned device");













        } else if (!isPermissionCheckFlagEnabled()) {













        } else if (!isPolicyEngineForFinanceFlagEnabled()) {















            Preconditions.checkCallAuthorization(















                    isDefaultDeviceOwner(caller) || isProfileOwner(caller));















        }










@@ -12241,7 +12242,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {



























        synchronized (getLockObject()) {















            if (isPolicyEngineForFinanceFlagEnabled()) {













                EnforcingAdmin admin = getEnforcingAdminForCaller(who, callerPackageName);













                EnforcingAdmin admin = enforcePermissionAndGetEnforcingAdmin(













                        who, MANAGE_DEVICE_POLICY_INPUT_METHODS,













                        caller.getPackageName(), userId);















                mDevicePolicyEngine.setLocalPolicy(















                        PolicyDefinition.PERMITTED_INPUT_METHODS,















                        admin,










@@ -13436,6 +13439,13 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













    public void setUserRestrictionGlobally(String callerPackage, String key) {















        final CallerIdentity caller = getCallerIdentity(callerPackage);



























        EnforcingAdmin admin = enforcePermissionForUserRestriction(













                /* who= */ null,













                key,













                caller.getPackageName(),













                UserHandle.USER_ALL













        );



























        checkCanExecuteOrThrowUnsafe(DevicePolicyManager.OPERATION_SET_USER_RESTRICTION);





























        if (!isPolicyEngineForFinanceFlagEnabled()) {









@@ -13452,13 +13462,6 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













            throw new IllegalArgumentException("Invalid restriction key: " + key);















        }



























        EnforcingAdmin admin = enforcePermissionForUserRestriction(













                /* who= */ null,













                key,













                caller.getPackageName(),













                UserHandle.USER_ALL













        );



























        setGlobalUserRestrictionInternal(admin, key, /* enabled= */ true);





























        logUserRestrictionCall(key, /* enabled= */ true, /* parent= */ false, caller);










@@ -22839,6 +22842,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













            MANAGE_DEVICE_POLICY_DISPLAY,















            MANAGE_DEVICE_POLICY_FACTORY_RESET,















            MANAGE_DEVICE_POLICY_FUN,













            MANAGE_DEVICE_POLICY_INPUT_METHODS,















            MANAGE_DEVICE_POLICY_INSTALL_UNKNOWN_SOURCES,















            MANAGE_DEVICE_POLICY_KEYGUARD,















            MANAGE_DEVICE_POLICY_LOCALE,










@@ -22914,9 +22918,11 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













                    MANAGE_DEVICE_POLICY_BLUETOOTH,















                    MANAGE_DEVICE_POLICY_CALLS,















                    MANAGE_DEVICE_POLICY_CAMERA,













                    MANAGE_DEVICE_POLICY_CERTIFICATES,















                    MANAGE_DEVICE_POLICY_DEBUGGING_FEATURES,















                    MANAGE_DEVICE_POLICY_DISPLAY,















                    MANAGE_DEVICE_POLICY_FACTORY_RESET,













                    MANAGE_DEVICE_POLICY_INPUT_METHODS,















                    MANAGE_DEVICE_POLICY_INSTALL_UNKNOWN_SOURCES,















                    MANAGE_DEVICE_POLICY_KEYGUARD,















                    MANAGE_DEVICE_POLICY_LOCALE,










@@ -22949,7 +22955,6 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













                    MANAGE_DEVICE_POLICY_ACROSS_USERS,















                    MANAGE_DEVICE_POLICY_AIRPLANE_MODE,















                    MANAGE_DEVICE_POLICY_APPS_CONTROL,













                    MANAGE_DEVICE_POLICY_CERTIFICATES,















                    MANAGE_DEVICE_POLICY_COMMON_CRITERIA_MODE,















                    MANAGE_DEVICE_POLICY_DEFAULT_SMS,















                    MANAGE_DEVICE_POLICY_LOCALE,










@@ -23074,11 +23079,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













    //Map of Permission to Delegate Scope.















    private static final HashMap<String, String> DELEGATE_SCOPES = new HashMap<>();















    {













        DELEGATE_SCOPES.put(MANAGE_DEVICE_POLICY_RUNTIME_PERMISSIONS, DELEGATION_PERMISSION_GRANT);















        DELEGATE_SCOPES.put(MANAGE_DEVICE_POLICY_APP_RESTRICTIONS, DELEGATION_APP_RESTRICTIONS);















        DELEGATE_SCOPES.put(MANAGE_DEVICE_POLICY_BLOCK_UNINSTALL, DELEGATION_BLOCK_UNINSTALL);













        DELEGATE_SCOPES.put(MANAGE_DEVICE_POLICY_SECURITY_LOGGING, DELEGATION_SECURITY_LOGGING);













        DELEGATE_SCOPES.put(MANAGE_DEVICE_POLICY_CERTIFICATES, DELEGATION_CERT_INSTALL);















        DELEGATE_SCOPES.put(MANAGE_DEVICE_POLICY_PACKAGE_STATE, DELEGATION_PACKAGE_ACCESS);













        DELEGATE_SCOPES.put(MANAGE_DEVICE_POLICY_RUNTIME_PERMISSIONS, DELEGATION_PERMISSION_GRANT);













        DELEGATE_SCOPES.put(MANAGE_DEVICE_POLICY_SECURITY_LOGGING, DELEGATION_SECURITY_LOGGING);















    }





























    private static final HashMap<String, String> CROSS_USER_PERMISSIONS =