Merge changes If401164b,I84949081 (7bdc4fcf) · Commits · e / os / android_frameworks_base

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+204 −44

Original line number	Diff line number	Diff line
		@@ -4550,7 +4550,13 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		@Override
		public boolean addCrossProfileWidgetProvider(ComponentName admin, String callerPackageName,
		String packageName) {
		final CallerIdentity caller = getCallerIdentity(admin, callerPackageName);
		CallerIdentity caller;

		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(admin, callerPackageName);
		} else {
		caller = getCallerIdentity(admin);
		}
		ActiveAdmin activeAdmin;

		if (isPermissionCheckFlagEnabled()) {
		@@ -4598,7 +4604,13 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		@Override
		public boolean removeCrossProfileWidgetProvider(ComponentName admin, String callerPackageName,
		String packageName) {
		final CallerIdentity caller = getCallerIdentity(admin, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(admin, callerPackageName);
		} else {
		caller = getCallerIdentity(admin);
		}

		ActiveAdmin activeAdmin;

		if (isPermissionCheckFlagEnabled()) {
		@@ -4646,7 +4658,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		@Override
		public List<String> getCrossProfileWidgetProviders(ComponentName admin,
		String callerPackageName) {
		final CallerIdentity caller = getCallerIdentity(admin, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(admin, callerPackageName);
		} else {
		caller = getCallerIdentity(admin);
		}
		ActiveAdmin activeAdmin;

		if (isPermissionCheckFlagEnabled()) {
		@@ -7367,7 +7384,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		if (!mHasFeature && !hasCallingOrSelfPermission(permission.MASTER_CLEAR)) {
		return;
		}
		final CallerIdentity caller = getCallerIdentity(callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(callerPackageName);
		} else {
		caller = getCallerIdentity();
		}
		ActiveAdmin admin;

		boolean calledByProfileOwnerOnOrgOwnedDevice =
		@@ -8647,7 +8669,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		return;
		}

		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}

		if (isPermissionCheckFlagEnabled()) {
		// The effect of this policy is device-wide.
		@@ -8676,8 +8703,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		if (!mHasFeature) {
		return false;
		}

		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}

		if (isPermissionCheckFlagEnabled()) {
		enforceCanQuery(caller.getPackageName(), SET_TIME, UserHandle.USER_ALL);
		@@ -8701,7 +8732,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		return;
		}

		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}

		if (useDevicePolicyEngine(caller, /* delegateScope= */ null)) {
		// The effect of this policy is device-wide.
		@@ -8742,7 +8778,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		return false;
		}

		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}

		if (isPermissionCheckFlagEnabled()) {
		// The effect of this policy is device-wide.
		@@ -8966,7 +9007,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		if (!mHasFeature) {
		return false;
		}
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}
		if (isPermissionCheckFlagEnabled()) {
		Preconditions.checkCallAuthorization(
		hasFullCrossUsersPermission(caller, userHandle)
		@@ -10899,7 +10945,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		@Override
		public void addPersistentPreferredActivity(ComponentName who, String callerPackageName,
		IntentFilter filter, ComponentName activity) {
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}

		final int userId = caller.getUserId();
		if (useDevicePolicyEngine(caller, /* delegateScope= */ null)) {
		@@ -10949,7 +11000,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		@Override
		public void clearPackagePersistentPreferredActivities(ComponentName who,
		String callerPackageName, String packageName) {
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}
		final int userId = caller.getUserId();

		if (useDevicePolicyEngine(caller, /* delegateScope= */ null)) {
		@@ -11028,7 +11084,13 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		@Override
		public void setDefaultSmsApplication(ComponentName admin, String callerPackageName,
		String packageName, boolean parent) {
		final CallerIdentity caller = getCallerIdentity(admin, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(admin, callerPackageName);
		} else {
		caller = getCallerIdentity(admin);
		}

		final int userId;

		if (isPermissionCheckFlagEnabled()) {
		@@ -11341,7 +11403,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		@Override
		public void addCrossProfileIntentFilter(ComponentName who, String callerPackageName,
		IntentFilter filter, int flags) {
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}
		int callingUserId = caller.getUserId();

		if (isPermissionCheckFlagEnabled()) {
		@@ -11400,7 +11467,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {

		@Override
		public void clearCrossProfileIntentFilters(ComponentName who, String callerPackageName) {
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}
		int callingUserId = caller.getUserId();

		if (isPermissionCheckFlagEnabled()) {
		@@ -12712,7 +12784,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		ComponentName who, String callerPackage, String key, boolean enabledFromThisOwner,
		boolean parent) {

		final CallerIdentity caller = getCallerIdentity(who, callerPackage);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackage);
		} else {
		caller = getCallerIdentity(who);
		}
		int userId = caller.getUserId();

		if (!UserRestrictionsUtils.isValidRestriction(key)) {
		@@ -12928,8 +13005,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		if (!mHasFeature) {
		return null;
		}

		final CallerIdentity caller = getCallerIdentity(who, callerPackage);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackage);
		} else {
		caller = getCallerIdentity(who);
		}

		if (useDevicePolicyEngine(caller, /* delegateScope= */ null)) {
		EnforcingAdmin admin = getEnforcingAdminForCaller(who, callerPackage);
		@@ -13406,7 +13487,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		if (!mHasFeature) {
		return;
		}
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}
		synchronized (getLockObject()) {
		final ActiveAdmin ap;
		if (isPermissionCheckFlagEnabled()) {
		@@ -13456,13 +13542,20 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		if (!mHasFeature) {
		return null;
		}
		CallerIdentity caller;
		Preconditions.checkArgumentNonnegative(userId, "Invalid userId");
		final CallerIdentity caller = getCallerIdentity(callerPackageName);
		if (!hasPermission(MANAGE_DEVICE_POLICY_ACCOUNT_MANAGEMENT, caller.getPackageName(), userId)
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(callerPackageName);
		if (!hasPermission(MANAGE_DEVICE_POLICY_ACCOUNT_MANAGEMENT,
		caller.getPackageName(), userId)
		&& !hasFullCrossUsersPermission(caller, userId)) {
		throw new SecurityException("Caller does not have permission to call this on user: "
		+ userId);
		}
		} else {
		caller = getCallerIdentity();
		Preconditions.checkCallAuthorization(hasFullCrossUsersPermission(caller, userId));
		}

		synchronized (getLockObject()) {
		final ArraySet<String> resultSet = new ArraySet<>();
		@@ -14047,11 +14140,13 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		public void setLockTaskPackages(ComponentName who, String callerPackageName, String[] packages)
		throws SecurityException {
		Objects.requireNonNull(packages, "packages is null");
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		checkCanExecuteOrThrowUnsafe(DevicePolicyManager.OPERATION_SET_LOCK_TASK_PACKAGES);
		synchronized (getLockObject()) {
		enforceCanCallLockTaskLocked(caller);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}
		checkCanExecuteOrThrowUnsafe(DevicePolicyManager.OPERATION_SET_LOCK_TASK_PACKAGES);

		if (useDevicePolicyEngine(caller, /* delegateScope= */ null)) {
		EnforcingAdmin enforcingAdmin;
		@@ -14103,7 +14198,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {

		@Override
		public String[] getLockTaskPackages(ComponentName who, String callerPackageName) {
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}
		final int userHandle = caller.getUserId();

		if (useDevicePolicyEngine(caller, /* delegateScope= */ null)) {
		@@ -14165,9 +14265,16 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		Preconditions.checkArgument(hasHome \|\| !hasNotification,
		"Cannot use LOCK_TASK_FEATURE_NOTIFICATIONS without LOCK_TASK_FEATURE_HOME");

		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}
		final int userHandle = caller.getUserId();
		synchronized (getLockObject()) {
		checkCanExecuteOrThrowUnsafe(DevicePolicyManager.OPERATION_SET_LOCK_TASK_FEATURES);
		}

		if (useDevicePolicyEngine(caller, /* delegateScope= */ null)) {
		EnforcingAdmin enforcingAdmin;
		@@ -14211,7 +14318,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {

		@Override
		public int getLockTaskFeatures(ComponentName who, String callerPackageName) {
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}
		final int userHandle = caller.getUserId();

		if (useDevicePolicyEngine(caller, /* delegateScope= */ null)) {
		@@ -14506,11 +14618,13 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {

		@Override
		public boolean setTime(@Nullable ComponentName who, String callerPackageName, long millis) {
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		// This is a global action.
		enforcePermission(SET_TIME, caller.getPackageName(), UserHandle.USER_ALL);
		} else {
		caller = getCallerIdentity(who);
		Objects.requireNonNull(who, "ComponentName is null");
		Preconditions.checkCallAuthorization(
		isDefaultDeviceOwner(caller)
		@@ -14532,11 +14646,13 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		@Override
		public boolean setTimeZone(@Nullable ComponentName who, String callerPackageName,
		String timeZone) {
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		// This is a global action.
		enforcePermission(SET_TIME_ZONE, caller.getPackageName(), UserHandle.USER_ALL);
		} else {
		caller = getCallerIdentity(who);
		Objects.requireNonNull(who, "ComponentName is null");
		Preconditions.checkCallAuthorization(
		isDefaultDeviceOwner(caller)
		@@ -14745,7 +14861,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		@Override
		public boolean setStatusBarDisabled(ComponentName who, String callerPackageName,
		boolean disabled) {
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}
		if (isPermissionCheckFlagEnabled()) {
		enforcePermission(MANAGE_DEVICE_POLICY_STATUS_BAR, caller.getPackageName(),
		UserHandle.USER_ALL);
		@@ -16515,10 +16636,11 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		if (!mHasFeature) {
		return;
		}
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		ActiveAdmin admin;

		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		EnforcingAdmin enforcingAdmin = enforcePermissionAndGetEnforcingAdmin(
		who,
		MANAGE_DEVICE_POLICY_SUPPORT_MESSAGE,
		@@ -16526,6 +16648,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		caller.getUserId());
		admin = enforcingAdmin.getActiveAdmin();
		} else {
		caller = getCallerIdentity(who);
		Objects.requireNonNull(who, "ComponentName is null");
		synchronized (getLockObject()) {
		admin = getActiveAdminForUidLocked(who, caller.getUid());
		@@ -16550,10 +16673,11 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		if (!mHasFeature) {
		return null;
		}
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		ActiveAdmin admin;

		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		EnforcingAdmin enforcingAdmin = enforcePermissionAndGetEnforcingAdmin(
		who,
		MANAGE_DEVICE_POLICY_SUPPORT_MESSAGE,
		@@ -16561,6 +16685,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		caller.getUserId());
		admin = enforcingAdmin.getActiveAdmin();
		} else {
		caller = getCallerIdentity(who);
		Objects.requireNonNull(who, "ComponentName is null");
		synchronized (getLockObject()) {
		admin = getActiveAdminForUidLocked(who, caller.getUid());
		@@ -18157,7 +18282,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		if (token == null \|\| token.length < 32) {
		throw new IllegalArgumentException("token must be at least 32-byte long");
		}
		final CallerIdentity caller = getCallerIdentity(admin, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(admin, callerPackageName);
		} else {
		caller = getCallerIdentity(admin);
		}
		final int userId = caller.getUserId();

		if (useDevicePolicyEngine(caller, /* delegateScope= */ null)) {
		@@ -18215,7 +18345,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		if (!mHasFeature \|\| !mLockPatternUtils.hasSecureLockScreen()) {
		return false;
		}
		final CallerIdentity caller = getCallerIdentity(admin, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(admin, callerPackageName);
		} else {
		caller = getCallerIdentity(admin);
		}
		final int userId = caller.getUserId();
		boolean result = false;

		@@ -18257,7 +18392,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		if (!mHasFeature \|\| !mLockPatternUtils.hasSecureLockScreen()) {
		return false;
		}
		final CallerIdentity caller = getCallerIdentity(admin, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(admin, callerPackageName);
		} else {
		caller = getCallerIdentity(admin);
		}
		int userId = caller.getUserId();

		if (useDevicePolicyEngine(caller, /* delegateScope= */ null)) {
		@@ -18301,7 +18441,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		}
		Objects.requireNonNull(token);

		final CallerIdentity caller = getCallerIdentity(admin, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(admin, callerPackageName);
		} else {
		caller = getCallerIdentity(admin);
		}

		int userId = caller.getUserId();
		boolean result = false;
		@@ -19483,7 +19628,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		public void setUserControlDisabledPackages(ComponentName who, String callerPackageName,
		List<String> packages) {
		Objects.requireNonNull(packages, "packages is null");
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}
		checkCanExecuteOrThrowUnsafe(
		DevicePolicyManager.OPERATION_SET_USER_CONTROL_DISABLED_PACKAGES);

		@@ -19560,7 +19710,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		@Override
		public List<String> getUserControlDisabledPackages(ComponentName who,
		String callerPackageName) {
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}

		if (useDevicePolicyEngine(caller, /* delegateScope= */ null)) {
		enforceCanQuery(
		@@ -19588,7 +19743,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		@Override
		public void setCommonCriteriaModeEnabled(ComponentName who, String callerPackageName,
		boolean enabled) {
		final CallerIdentity caller = getCallerIdentity(who, callerPackageName);
		CallerIdentity caller;
		if (isPermissionCheckFlagEnabled()) {
		caller = getCallerIdentity(who, callerPackageName);
		} else {
		caller = getCallerIdentity(who);
		}
		final ActiveAdmin admin;

		if (isPermissionCheckFlagEnabled()) {