Remove the profile/device owner user restriction bypass. (401de178) · Commits · e / os / android_frameworks_base

core/java/com/android/internal/app/IAppOpsService.aidl

+0 −2

Original line number	Diff line number	Diff line
		@@ -40,8 +40,6 @@ interface IAppOpsService {
		int checkAudioOperation(int code, int usage, int uid, String packageName);
		void setAudioRestriction(int code, int usage, int uid, int mode, in String[] exceptionPackages);

		void setDeviceOwner(String packageName);
		void setProfileOwner(String packageName, int userHandle);
		void setUserRestrictions(in Bundle restrictions, int userHandle);
		void removeUser(int userHandle);

services/core/java/com/android/server/AppOpsService.java

+1 −44

Original line number	Diff line number	Diff line
		@@ -96,8 +96,6 @@ public class AppOpsService extends IAppOpsService.Stub {
		final SparseArray<HashMap<String, Ops>> mUidOps
		= new SparseArray<HashMap<String, Ops>>();

		private int mDeviceOwnerUid;
		private final SparseIntArray mProfileOwnerUids = new SparseIntArray();
		private final SparseArray<boolean[]> mOpRestrictions = new SparseArray<boolean[]>();

		public final static class Ops extends SparseArray<Op> {
		@@ -873,16 +871,8 @@ public class AppOpsService extends IAppOpsService.Stub {
		}
		}
		}
		if (userHandle == UserHandle.USER_OWNER) {
		if (uid != mDeviceOwnerUid) {
		return true;
		}
		} else {
		if (uid != mProfileOwnerUids.get(userHandle, -1)) {
		return true;
		}
		}
		}
		return false;
		}

		@@ -1255,35 +1245,6 @@ public class AppOpsService extends IAppOpsService.Stub {
		ArraySet<String> exceptionPackages = NO_EXCEPTIONS;
		}

		@Override
		public void setDeviceOwner(String packageName) throws RemoteException {
		checkSystemUid("setDeviceOwner");
		try {
		mDeviceOwnerUid = mContext.getPackageManager().getPackageUid(packageName,
		UserHandle.USER_OWNER);
		} catch (NameNotFoundException e) {
		Log.e(TAG, "Could not find Device Owner UID");
		mDeviceOwnerUid = -1;
		throw new IllegalArgumentException("Could not find device owner package "
		+ packageName);
		}
		}

		@Override
		public void setProfileOwner(String packageName, int userHandle) throws RemoteException {
		checkSystemUid("setProfileOwner");
		try {
		int uid = mContext.getPackageManager().getPackageUid(packageName,
		userHandle);
		mProfileOwnerUids.put(userHandle, uid);
		} catch (NameNotFoundException e) {
		Log.e(TAG, "Could not find Profile Owner UID");
		mProfileOwnerUids.put(userHandle, -1);
		throw new IllegalArgumentException("Could not find profile owner package "
		+ packageName);
		}
		}

		@Override
		public void setUserRestrictions(Bundle restrictions, int userHandle) throws RemoteException {
		checkSystemUid("setUserRestrictions");
		@@ -1306,10 +1267,6 @@ public class AppOpsService extends IAppOpsService.Stub {
		public void removeUser(int userHandle) throws RemoteException {
		checkSystemUid("removeUser");
		mOpRestrictions.remove(userHandle);
		final int index = mProfileOwnerUids.indexOfKey(userHandle);
		if (index >= 0) {
		mProfileOwnerUids.removeAt(index);
		}
		}

		private void checkSystemUid(String function) {

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+1 −36

Original line number	Diff line number	Diff line
		@@ -252,8 +252,6 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		}
		};

		private IAppOpsService mAppOpsService;

		static class ActiveAdmin {
		private static final String TAG_DISABLE_KEYGUARD_FEATURES = "disable-keyguard-features";
		private static final String TAG_DISABLE_CAMERA = "disable-camera";
		@@ -1288,24 +1286,6 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		getUserData(UserHandle.USER_OWNER);
		loadDeviceOwner();
		cleanUpOldUsers();
		mAppOpsService = IAppOpsService.Stub.asInterface(
		ServiceManager.getService(Context.APP_OPS_SERVICE));
		if (mDeviceOwner != null) {
		if (mDeviceOwner.hasDeviceOwner()) {
		try {
		mAppOpsService.setDeviceOwner(mDeviceOwner.getDeviceOwnerPackageName());
		} catch (RemoteException e) {
		Log.w(LOG_TAG, "Unable to notify AppOpsService of DeviceOwner", e);
		}
		}
		for (Integer i : mDeviceOwner.getProfileOwnerKeys()) {
		try {
		mAppOpsService.setProfileOwner(mDeviceOwner.getProfileOwnerPackageName(i), i);
		} catch (RemoteException e) {
		Log.w(LOG_TAG, "Unable to notify AppOpsService of ProfileOwner", e);
		}
		}
		}
		// Register an observer for watching for user setup complete.
		new SetupContentObserver(mHandler).register(mContext.getContentResolver());
		// Initialize the user setup state, to handle the upgrade case.
		@@ -3169,14 +3149,6 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		"Trying to set device owner but device owner is already set.");
		}

		long token = Binder.clearCallingIdentity();
		try {
		mAppOpsService.setDeviceOwner(packageName);
		} catch (RemoteException e) {
		Log.w(LOG_TAG, "Unable to notify AppOpsService of DeviceOwner", e);
		} finally {
		Binder.restoreCallingIdentity(token);
		}
		if (mDeviceOwner == null) {
		// Device owner is not set and does not exist, set it.
		mDeviceOwner = DeviceOwner.createWithDeviceOwner(packageName, ownerName);
		@@ -3284,14 +3256,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		throw new IllegalStateException(
		"Trying to set profile owner but user is already set-up.");
		}
		long token = Binder.clearCallingIdentity();
		try {
		mAppOpsService.setProfileOwner(packageName, userHandle);
		} catch (RemoteException e) {
		Log.w(LOG_TAG, "Unable to notify AppOpsService of ProfileOwner", e);
		} finally {
		Binder.restoreCallingIdentity(token);
		}

		if (mDeviceOwner == null) {
		// Device owner state does not exist, create it.
		mDeviceOwner = DeviceOwner.createWithProfileOwner(packageName, ownerName,