Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fead6f2d authored by Alex Johnston's avatar Alex Johnston Committed by Android Build Coastguard Worker
Browse files

DO NOT MERGE Stop managed profile owner granting READ_SMS 

Reason: There is only one telephony stack shared
between the personal and work profile.

This change is a partial cherry-pick of ag/15371816.
DPM.canAdminGrantSensorsPermissions did not exist pre-S. Pre-S,
the admin was always able to grant permissions incl sensor permissions. The change here will continue to allow granting of permissions unless the admin is on a managed profile and the permission is READ_SMS.

Bug: 194382185
Bug: 189942529
Test: manual testing with TestDPC
Change-Id: Icc1e59a18c4786635cbc651aefc2561fbbddfdb1
(cherry picked from commit 7cd8e7f00cf2d921a2d9b2999cfc85a148c781b9)
Merged-In: Icc1e59a18c4786635cbc651aefc2561fbbddfdb1
parent 033965a2

src/com/android/permissioncontroller/permission/service/PermissionControllerServiceImpl.java

+13 −3
Original line number Diff line number Diff line
@@ -36,6 +36,7 @@ import android.os.Handler; 
import android.os.Looper;

import android.os.Process;

import android.os.UserHandle;

import android.os.UserManager;

import android.permission.PermissionManager;

import android.permission.RuntimePermissionPresentationInfo;

import android.permission.RuntimePermissionUsageInfo;
@@ -56,6 +57,7 @@ import com.android.permissioncontroller.permission.model.livedatatypes.AppPermGr 
import com.android.permissioncontroller.permission.model.livedatatypes.AppPermGroupUiInfo.PermGrantState;

import com.android.permissioncontroller.permission.ui.AutoGrantPermissionsNotifier;

import com.android.permissioncontroller.permission.utils.ArrayUtils;

import com.android.permissioncontroller.permission.utils.AdminRestrictedPermissionsUtils;

import com.android.permissioncontroller.permission.utils.KotlinUtils;

import com.android.permissioncontroller.permission.utils.UserSensitiveFlagsUtils;

import com.android.permissioncontroller.permission.utils.Utils;
@@ -518,6 +520,8 @@ public final class PermissionControllerServiceImpl extends PermissionControllerL 
        AutoGrantPermissionsNotifier autoGrantPermissionsNotifier =

                new AutoGrantPermissionsNotifier(this, pkgInfo);



        final boolean isManagedProfile = getSystemService(UserManager.class).isManagedProfile();



        int numPerms = expandedPermissions.size();

        for (int i = 0; i < numPerms; i++) {

            String permName = expandedPermissions.get(i);
@@ -533,9 +537,15 @@ public final class PermissionControllerServiceImpl extends PermissionControllerL 


            switch (grantState) {

                case PERMISSION_GRANT_STATE_GRANTED:

                    if (AdminRestrictedPermissionsUtils.mayAdminGrantPermission(perm.getName(),

                            isManagedProfile)) {

                        perm.setPolicyFixed(true);

                        group.grantRuntimePermissions(false, false, new String[]{permName});

                        autoGrantPermissionsNotifier.onPermissionAutoGranted(permName);

                    } else {

                        // similar to PERMISSION_GRANT_STATE_DEFAULT

                        perm.setPolicyFixed(false);

                    }

                    break;

                case PERMISSION_GRANT_STATE_DENIED:

                    perm.setPolicyFixed(true);

src/com/android/permissioncontroller/permission/utils/AdminRestrictedPermissionsUtils.java

0 → 100644
+44 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2022 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



package com.android.permissioncontroller.permission.utils;



import android.Manifest;

import android.util.ArraySet;



/**

 * A class for dealing with permissions that the admin may not grant in certain configurations.

 */

public final class AdminRestrictedPermissionsUtils {



    /**

     * A set of permissions that the managed Profile Owner cannot grant.

     */

    private static final ArraySet<String> MANAGED_PROFILE_OWNER_RESTRICTED_PERMISSIONS =

            new ArraySet<>();



    static {

        MANAGED_PROFILE_OWNER_RESTRICTED_PERMISSIONS.add(Manifest.permission.READ_SMS);

    }



    /**

     * Returns true if the admin may grant this permission, false otherwise.

     */

    public static boolean mayAdminGrantPermission(String permission, boolean isManagedProfile) {

        return !isManagedProfile

                || !MANAGED_PROFILE_OWNER_RESTRICTED_PERMISSIONS.contains(permission);

    }

}