Skip to content

Commit e2a4a6f

Browse files
Nicolas PrevotRubin Xu
authored andcommitted
Don't always transfer device owner status to other users.
A device owner cannot use device or profile owner policies on other users unless it is profile owner there. Also limit device initializer to system apps only. Bug: 21800830 Change-Id: Ie1abbd891945b91b17ecdf7f73ba93aaa19819be
1 parent 7157c2c commit e2a4a6f

1 file changed

Lines changed: 15 additions & 2 deletions

File tree

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1277,11 +1277,13 @@ && getProfileOwner(userId).getPackageName()
12771277
&& !hasUserSetupCompleted(userId);
12781278

12791279
if (reqPolicy == DeviceAdminInfo.USES_POLICY_DEVICE_OWNER) {
1280-
if (ownsDevice || (userId == UserHandle.USER_OWNER && ownsInitialization)) {
1280+
if ((userId == UserHandle.USER_OWNER && (ownsDevice || ownsInitialization))
1281+
|| (ownsDevice && ownsProfile)) {
12811282
return true;
12821283
}
12831284
} else if (reqPolicy == DeviceAdminInfo.USES_POLICY_PROFILE_OWNER) {
1284-
if (ownsDevice || ownsProfile || ownsInitialization) {
1285+
if ((userId == UserHandle.USER_OWNER && ownsDevice) || ownsProfile
1286+
|| ownsInitialization) {
12851287
return true;
12861288
}
12871289
} else {
@@ -4236,6 +4238,17 @@ public boolean setDeviceInitializer(ComponentName who, ComponentName initializer
42364238
throw new IllegalArgumentException("Invalid component name " + initializer
42374239
+ " for device initializer");
42384240
}
4241+
boolean isInitializerSystemApp;
4242+
try {
4243+
isInitializerSystemApp = isSystemApp(AppGlobals.getPackageManager(),
4244+
initializer.getPackageName(), Binder.getCallingUserHandle().getIdentifier());
4245+
} catch (RemoteException | IllegalArgumentException e) {
4246+
isInitializerSystemApp = false;
4247+
Slog.e(LOG_TAG, "Fail to check if device initialzer is system app.", e);
4248+
}
4249+
if (!isInitializerSystemApp) {
4250+
throw new IllegalArgumentException("Only system app can be set as device initializer.");
4251+
}
42394252
synchronized (this) {
42404253
enforceCanSetDeviceInitializer(who);
42414254

0 commit comments

Comments
 (0)