Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8236d331 authored by Zimuzo's avatar Zimuzo
Browse files

Restrict MANAGE_DEVICE_ADMIN permissions to signature 

We want to prevent privileged apps from calling DevicePolicyManager#setActiveAdmin. After this, only apps signed with the platform certificate (e.g Settings / ManagedProvisioning) will be allowed to set Device Admins.

Leave @SystemApi so that it is clear that it 'was' a privileged permission, but add @removed to show that it is no longer a privileged permission.

Bug: 111153365
Test: atest PermissionsHostTest && atest CtsAdminTestCases
Change-Id: I688e87cf09ad206f4f517a7be960c2aa01af8fc4
parent be749520

api/system-current.txt

+0 −1
Original line number Diff line number Diff line
@@ -94,7 +94,6 @@ package android { 
    field public static final java.lang.String MANAGE_CONTENT_CAPTURE = "android.permission.MANAGE_CONTENT_CAPTURE";

    field public static final java.lang.String MANAGE_CONTENT_SUGGESTIONS = "android.permission.MANAGE_CONTENT_SUGGESTIONS";

    field public static final java.lang.String MANAGE_DEBUGGING = "android.permission.MANAGE_DEBUGGING";

    field public static final java.lang.String MANAGE_DEVICE_ADMINS = "android.permission.MANAGE_DEVICE_ADMINS";

    field public static final java.lang.String MANAGE_IPSEC_TUNNELS = "android.permission.MANAGE_IPSEC_TUNNELS";

    field public static final java.lang.String MANAGE_ROLE_HOLDERS = "android.permission.MANAGE_ROLE_HOLDERS";

    field public static final java.lang.String MANAGE_ROLLBACKS = "android.permission.MANAGE_ROLLBACKS";

api/system-removed.txt

+8 −0
Original line number Diff line number Diff line 
package android {



  public static final class Manifest.permission {

    field public static final java.lang.String MANAGE_DEVICE_ADMINS = "android.permission.MANAGE_DEVICE_ADMINS";

  }



}



package android.app {



  public class Notification implements android.os.Parcelable {

core/res/AndroidManifest.xml

+3 −2
Original line number Diff line number Diff line
@@ -3196,9 +3196,10 @@ 


    <!-- @SystemApi Required to add or remove another application as a device admin.

         <p>Not for use by third-party applications.

         @hide -->

         @hide

         @removed -->

    <permission android:name="android.permission.MANAGE_DEVICE_ADMINS"

        android:protectionLevel="signature|privileged" />

        android:protectionLevel="signature" />



    <!-- @SystemApi Allows an app to reset the device password.

         <p>Not for use by third-party applications.