Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 81d4a1ff authored by Rubin Xu's avatar Rubin Xu
Browse files

Fix DPMS.isCredentialManagementApp() 

Call KeyChain.bindAsUser() with cleared binder identity.

Bug: 175032227
Test: atest MixedManagedProfileOwnerTest#testDelegation
Change-Id: I4c696519a630a81f9a2210d5ec07045298738f7b
parent a64af976

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+17 −16
Original line number Diff line number Diff line
@@ -5905,6 +5905,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { 
     * @return {@code true} if the calling process is the credential management app.

     */

    private boolean isCredentialManagementApp(CallerIdentity caller, String alias) {

        return mInjector.binderWithCleanCallingIdentity(() -> {

            // Should include alias in authentication policy

            try (KeyChainConnection connection = KeyChain.bindAsUser(mContext,

                    caller.getUserHandle())) {
@@ -5920,10 +5921,10 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { 
            }















            AppOpsManager appOpsManager = mInjector.getAppOpsManager();













        return appOpsManager != null













                ? appOpsManager.noteOpNoThrow(AppOpsManager.OP_MANAGE_CREDENTIALS, caller.getUid(),













                caller.getPackageName(), null, null) == AppOpsManager.MODE_ALLOWED













                : false;













            if (appOpsManager == null) return false;













            return appOpsManager.noteOpNoThrow(AppOpsManager.OP_MANAGE_CREDENTIALS, caller.getUid(),













                    caller.getPackageName(), null, null) == AppOpsManager.MODE_ALLOWED;













        });















    }





























    private static boolean containsAlias(AppUriAuthenticationPolicy policy, String alias) {