Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 518a01a2 authored by Eran Messeri's avatar Eran Messeri
Browse files

DPM API review: Remove "ForUser" method 

Replace the setProfileOwnerCanAccessDeviceIdsForUser with
setProfileOwnerCanAccessDeviceIds that takes the DPM's user ID.

Per automated API review, new methods that target a specific user (by
taking in a UserHandle) are discouraged.

Instead, the caller should get the user-specific service from the user
context.

Bug: 126700461
Bug: 126699845
Test: Manually, flashed a device and set-up TestDPC on it straight to
work profile, then verified it can do Device ID attestation.
Test: atest FrameworksServicesTests:DevicePolicyManagerTest

Change-Id: I13f20f4a434394f266a3dc2373152cb1b9ea2d2b
parent c7f498fe

api/system-current.txt

+1 −1
Original line number Diff line number Diff line
@@ -680,7 +680,7 @@ package android.app.admin { 
    method @RequiresPermission(android.Manifest.permission.INTERACT_ACROSS_USERS_FULL) public boolean packageHasActiveAdmins(String);

    method @Deprecated @RequiresPermission("android.permission.MANAGE_DEVICE_ADMINS") public boolean setActiveProfileOwner(@NonNull android.content.ComponentName, String) throws java.lang.IllegalArgumentException;

    method @RequiresPermission(android.Manifest.permission.MANAGE_USERS) public void setDeviceProvisioningConfigApplied();

    method @RequiresPermission(value=android.Manifest.permission.GRANT_PROFILE_OWNER_DEVICE_IDS_ACCESS, conditional=true) public void setProfileOwnerCanAccessDeviceIdsForUser(@NonNull android.content.ComponentName, @NonNull android.os.UserHandle);

    method @RequiresPermission(value=android.Manifest.permission.GRANT_PROFILE_OWNER_DEVICE_IDS_ACCESS, conditional=true) public void setProfileOwnerCanAccessDeviceIds(@NonNull android.content.ComponentName);

    field public static final String ACCOUNT_FEATURE_DEVICE_OR_PROFILE_OWNER_ALLOWED = "android.account.DEVICE_OR_PROFILE_OWNER_ALLOWED";

    field public static final String ACCOUNT_FEATURE_DEVICE_OR_PROFILE_OWNER_DISALLOWED = "android.account.DEVICE_OR_PROFILE_OWNER_DISALLOWED";

    field public static final String ACTION_PROVISION_FINALIZATION = "android.app.action.PROVISION_FINALIZATION";

core/java/android/app/admin/DevicePolicyManager.java

+2 −3
Original line number Diff line number Diff line
@@ -10661,13 +10661,12 @@ public class DevicePolicyManager { 
    @SystemApi

    @RequiresPermission(value = android.Manifest.permission.GRANT_PROFILE_OWNER_DEVICE_IDS_ACCESS,

            conditional = true)

    public void setProfileOwnerCanAccessDeviceIdsForUser(

            @NonNull ComponentName who, @NonNull UserHandle userHandle) {

    public void setProfileOwnerCanAccessDeviceIds(@NonNull ComponentName who) {

        if (mService == null) {

            return;

        }

        try {

            mService.grantDeviceIdsAccessToProfileOwner(who, userHandle.getIdentifier());

            mService.grantDeviceIdsAccessToProfileOwner(who, myUserId());

        } catch (RemoteException re) {

            throw re.rethrowFromSystemServer();

        }

services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java

+4 −7
Original line number Diff line number Diff line
@@ -5021,8 +5021,7 @@ public class DevicePolicyManagerTest extends DpmTestBase { 
        configureContextForAccess(mContext, false);



        assertExpectException(SecurityException.class, /* messageRegex= */ null,

                () -> dpm.setProfileOwnerCanAccessDeviceIdsForUser(admin2,

                        UserHandle.of(DpmMockContext.CALLER_UID)));

                () -> dpm.setProfileOwnerCanAccessDeviceIds(admin2));

    }



    public void testGrantDeviceIdsAccess_notByAuthorizedCaller() throws Exception {
@@ -5030,8 +5029,7 @@ public class DevicePolicyManagerTest extends DpmTestBase { 
        configureContextForAccess(mContext, false);



        assertExpectException(SecurityException.class, /* messageRegex= */ null,

                () -> dpm.setProfileOwnerCanAccessDeviceIdsForUser(admin1,

                        UserHandle.of(DpmMockContext.CALLER_UID)));

                () -> dpm.setProfileOwnerCanAccessDeviceIds(admin1));

    }



    public void testGrantDeviceIdsAccess_byAuthorizedSystemCaller() throws Exception {
@@ -5060,8 +5058,7 @@ public class DevicePolicyManagerTest extends DpmTestBase { 
                        DpmMockContext.CALLER_MANAGED_PROVISIONING_UID);

        try {

            runAsCaller(mServiceContext, dpms, dpm -> {

                dpm.setProfileOwnerCanAccessDeviceIdsForUser(admin1,

                        UserHandle.of(DpmMockContext.CALLER_USER_HANDLE));

                dpm.setProfileOwnerCanAccessDeviceIds(admin1);

            });

        } finally {

            mServiceContext.binder.restoreCallingIdentity(ident);
@@ -5314,7 +5311,7 @@ public class DevicePolicyManagerTest extends DpmTestBase { 
        mServiceContext.binder.callingUid =

                UserHandle.getUid(DpmMockContext.CALLER_USER_HANDLE, DpmMockContext.SYSTEM_UID);

        runAsCaller(mServiceContext, dpms, dpm -> {

            dpm.setProfileOwnerCanAccessDeviceIdsForUser(who, UserHandle.of(userId));

            dpm.setProfileOwnerCanAccessDeviceIds(who);

        });

        mServiceContext.binder.restoreCallingIdentity(ident);

    }