Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 14405c9a authored by Suprabh Shukla's avatar Suprabh Shukla
Browse files

Remove MANAGE_USERS from setPackagesSuspended 

MANAGE_USERS is a widely used permission and setPackagesSuspended is a
dangerous API. Also having a lot of apps which can use the api can lead
to complications like them suspending each other.

Test: Existing tests with SUSPEND_APPS pass:
atest com.android.server.pm.SuspendPackagesTest

Existing permission tests without SUSPEND_APPS pass:
atest GtsSuspendAppsPermissionTestCases

Bug: 79773970
Change-Id: I49d81c0254c6ba528c50ece960a0db277c0afd7f
parent 10f8ed0c

core/java/android/content/pm/PackageManager.java

+1 −2
Original line number Diff line number Diff line
@@ -5574,8 +5574,7 @@ public abstract class PackageManager { 
     * @hide

     */

    @SystemApi

    @RequiresPermission(anyOf = {Manifest.permission.SUSPEND_APPS,

            Manifest.permission.MANAGE_USERS})

    @RequiresPermission(Manifest.permission.SUSPEND_APPS)

    public String[] setPackagesSuspended(String[] packageNames, boolean suspended,

            @Nullable PersistableBundle appExtras, @Nullable PersistableBundle launcherExtras,

            String dialogMessage) {

services/core/java/com/android/server/pm/PackageManagerService.java

+3 −7
Original line number Diff line number Diff line
@@ -14090,13 +14090,9 @@ public class PackageManagerService extends IPackageManager.Stub 
    public String[] setPackagesSuspendedAsUser(String[] packageNames, boolean suspended,

            PersistableBundle appExtras, PersistableBundle launcherExtras, String dialogMessage,

            String callingPackage, int userId) {

        try {

            mContext.enforceCallingOrSelfPermission(android.Manifest.permission.SUSPEND_APPS, null);

        } catch (SecurityException e) {

            mContext.enforceCallingOrSelfPermission(Manifest.permission.MANAGE_USERS,

                    "Callers need to have either " + Manifest.permission.SUSPEND_APPS + " or "

                            + Manifest.permission.MANAGE_USERS);

        }

        mContext.enforceCallingOrSelfPermission(android.Manifest.permission.SUSPEND_APPS,

                "setPackagesSuspendedAsUser");















        final int callingUid = Binder.getCallingUid();















        if (callingUid != Process.ROOT_UID && callingUid != Process.SYSTEM_UID















                && getPackageUid(callingPackage, 0, userId) != callingUid) {