Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6f074ef3 authored by Alex Johnston's avatar Alex Johnston Committed by Automerger Merge Worker
Browse files

Merge "DPMS setProfileOwner access control" into sc-dev am: 24f078ee 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/14199185

Change-Id: Ib70e453027ad5550ee20d259e46d2950ffd64653
parents 4c6491d4 24f078ee

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+5 −9
Original line number Diff line number Diff line
@@ -8517,20 +8517,16 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { 
                    + " as profile owner for user " + userHandle);

            return false;

        }

        if (who == null

                || !isPackageInstalledForUser(who.getPackageName(), userHandle)) {

            throw new IllegalArgumentException("Component " + who

                    + " not installed for userId:" + userHandle);

        }

        Preconditions.checkArgument(who != null);















        final CallerIdentity caller = getCallerIdentity();















        synchronized (getLockObject()) {















            enforceCanSetProfileOwnerLocked(caller, who, userHandle);

























            Preconditions.checkArgument(isPackageInstalledForUser(who.getPackageName(), userHandle),













                    "Component " + who + " not installed for userId:" + userHandle);















            final ActiveAdmin admin = getActiveAdminUncheckedLocked(who, userHandle);













            if (admin == null || getUserData(userHandle).mRemovingAdmins.contains(who)) {













                throw new IllegalArgumentException("Not active admin: " + who);













            }













            Preconditions.checkArgument(admin != null && !getUserData(













                    userHandle).mRemovingAdmins.contains(who), "Not active admin: " + who);





























            final int parentUserId = getProfileParentId(userHandle);















            // When trying to set a profile owner on a new user, it may be that this user is

































services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java



+10
−0




























Original line number
Diff line number
Diff line








@@ -1551,6 +1551,16 @@ public class DevicePolicyManagerTest extends DpmTestBase {













    @Test















    public void testSetProfileOwner_failures() throws Exception {















        // TODO Test more failure cases.  Basically test all chacks in enforceCanSetProfileOwner().













        // Package doesn't exist and caller is not system













        assertExpectException(SecurityException.class,













                /* messageRegex= */ "Calling identity is not authorized",













                () -> dpm.setProfileOwner(admin1, "owner-name", UserHandle.USER_SYSTEM));



























        // Package exists, but caller is not system













        setUpPackageManagerForAdmin(admin1, DpmMockContext.CALLER_SYSTEM_USER_UID);













        assertExpectException(SecurityException.class,













                /* messageRegex= */ "Calling identity is not authorized",













                () -> dpm.setProfileOwner(admin1, "owner-name", UserHandle.USER_SYSTEM));















    }































    @Test