Commit: 7da57cb8b321c1d5a9c45fd3c0435b67e9ab5d15 - frameworks-base (git)

frameworks/base

Commit MetaInfo

• Révision: 7da57cb8b321c1d5a9c45fd3c0435b67e9ab5d15 (tree)
• l'heure: 2019-06-06 04:09:05
• Auteur: Pavel Grafov <pgrafov@goog...>
• Commiter: syphyr

Message de Log

Limit IsSeparateProfileChallengeAllowed to system callers

Fixes: 128599668
Test: build, set up separate challenge
Change-Id: I2fef9ab13614627c0f1bcca04759d0974fc6181a
(cherry picked from commit 1b6301cf2430f192c9842a05fc22984d782bade9)

Change Summary

• modified: services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

Modification

--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -3156,6 +3156,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
 
     @Override
     public boolean isSeparateProfileChallengeAllowed(int userHandle) {
+        if (!isCallerWithSystemUid()) {
+            throw new SecurityException("Caller must be system");
+        }
         ComponentName profileOwner = getProfileOwner(userHandle);
         // Profile challenge is supported on N or newer release.
         return profileOwner != null &&