Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4dd85d5f authored by Tony Mak's avatar Tony Mak
Browse files

DPC should not be allowed to grant development permission 

Test: cts-tradefed run cts-dev --module CtsDevicePolicyManagerTestCases --t  com.android.cts.devicepolicy.MixedDeviceOwnerTest#testPermissionGrant_developmentPermission
Test: cts-tradefed run cts-dev --module CtsDevicePolicyManagerTestCases --t  com.android.cts.devicepolicy.MixedProfileOwnerTest#testPermissionGrant_developmentPermission
Test: cts-tradefed run cts-dev --module CtsDevicePolicyManagerTestCases --t  com.android.cts.devicepolicy.MixedDeviceOwnerTest#testPermissionGrant
Test: cts-tradefed run cts-dev --module CtsDevicePolicyManagerTestCases --t  com.android.cts.devicepolicy.MixedProfileOwnerTest#testPermissionGrant
Test: Run "Permissions lockdown" test in CtsVerifier

Bug: 62623498

Change-Id: If83d8edd0eea99145421e967ae47fdc264a5cf7c
parent 0a869e85

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+13 −0
Original line number Original line Diff line number Diff line
@@ -99,6 +99,7 @@ import android.content.pm.PackageManager; 
import android.content.pm.PackageManager.NameNotFoundException;

import android.content.pm.PackageManager.NameNotFoundException;

import android.content.pm.PackageManagerInternal;

import android.content.pm.PackageManagerInternal;

import android.content.pm.ParceledListSlice;

import android.content.pm.ParceledListSlice;

import android.content.pm.PermissionInfo;

import android.content.pm.ResolveInfo;

import android.content.pm.ResolveInfo;

import android.content.pm.ServiceInfo;

import android.content.pm.ServiceInfo;

import android.content.pm.StringParceledListSlice;

import android.content.pm.StringParceledListSlice;
@@ -9587,6 +9588,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { 
                        < android.os.Build.VERSION_CODES.M) {

                        < android.os.Build.VERSION_CODES.M) {

                    return false;

                    return false;

                }

                }

                if (!isRuntimePermission(permission)) {

                    return false;

                }

                final PackageManager packageManager = mInjector.getPackageManager();

                final PackageManager packageManager = mInjector.getPackageManager();

                switch (grantState) {

                switch (grantState) {

                    case DevicePolicyManager.PERMISSION_GRANT_STATE_GRANTED: {

                    case DevicePolicyManager.PERMISSION_GRANT_STATE_GRANTED: {
@@ -9613,6 +9617,8 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { 
                return true;

                return true;

            } catch (SecurityException se) {

            } catch (SecurityException se) {

                return false;

                return false;

            } catch (NameNotFoundException e) {

                return false;

            } finally {

            } finally {

                mInjector.binderRestoreCallingIdentity(ident);

                mInjector.binderRestoreCallingIdentity(ident);

            }

            }
@@ -9662,6 +9668,13 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { 
        }

        }

    }

    }





    public boolean isRuntimePermission(String permissionName) throws NameNotFoundException {

        final PackageManager packageManager = mInjector.getPackageManager();

        PermissionInfo permissionInfo = packageManager.getPermissionInfo(permissionName, 0);

        return (permissionInfo.protectionLevel & PermissionInfo.PROTECTION_MASK_BASE)

                == PermissionInfo.PROTECTION_DANGEROUS;

    }



    @Override

    @Override

    public boolean isProvisioningAllowed(String action, String packageName) {

    public boolean isProvisioningAllowed(String action, String packageName) {

        Preconditions.checkNotNull(packageName);

        Preconditions.checkNotNull(packageName);