Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 26af4ae6 authored by Alex Johnston's avatar Alex Johnston
Browse files

Fix access control isAlwaysOnVpnLockdownEnabled 

* Let the caller who has PERMISSION_MAINLINE_NETWORK_STACK
  bypass the admin authentication check.
* Use getCallerIdentity variant that allows caller to not
  be an admin.
* If the caller is a device owner or profile owner, then
  the admin must be authenticated

Bug: 171407399
Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest
      atest com.android.cts.devicepolicy.MixedDeviceOwnerTest
Change-Id: Id7152425fd774fc79d511c2e95dbb78ca1e0fc01
parent 867119b5

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+3 −2
Original line number Original line Diff line number Diff line
@@ -5788,8 +5788,9 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { 
    public boolean isAlwaysOnVpnLockdownEnabled(ComponentName admin) throws SecurityException {

    public boolean isAlwaysOnVpnLockdownEnabled(ComponentName admin) throws SecurityException {

        Objects.requireNonNull(admin, "ComponentName is null");

        Objects.requireNonNull(admin, "ComponentName is null");

















        final CallerIdentity caller = getCallerIdentity(admin);







        final CallerIdentity caller = getNonPrivilegedOrAdminCallerIdentity(admin);











        Preconditions.checkCallAuthorization(isDeviceOwner(caller) || isProfileOwner(caller)







        Preconditions.checkCallAuthorization((caller.hasAdminComponent()














                && (isDeviceOwner(caller) || isProfileOwner(caller)))











                || hasCallingPermission(PERMISSION_MAINLINE_NETWORK_STACK));







                || hasCallingPermission(PERMISSION_MAINLINE_NETWORK_STACK));



























        return mInjector.binderWithCleanCallingIdentity(







        return mInjector.binderWithCleanCallingIdentity(