From bdd52cb48b4005b8cf99c7096769ad62a3567cb3 Mon Sep 17 00:00:00 2001 From: Eran Messeri Date: Tue, 3 Nov 2020 16:49:30 +0000 Subject: DO NOT MERGE: Introduce DPMS shim for active DO/PO check Introduce a shim into DevicePolicyManagerInternal & DevicePolicyManagerService so that NetworkStatsAccessTest would not diverge from internal development branches. The DevicePolicyManagerService refactoring on the internal branch removed isActiveAdminWithPolicy in favour of isActiveDeviceOwner and isActiveProfileOwner. These methods are being made available in AOSP for NetworkStatsAccessTest. Bug: 170459325 Test: atest NetworkStatsAccessTest Change-Id: Ic7e0898989fb8222aaba2b35436765c04eb3250c --- .../app/admin/DevicePolicyManagerInternal.java | 20 ++++++++++++++++++++ .../com/android/server/net/NetworkStatsAccess.java | 9 ++++----- .../devicepolicy/DevicePolicyManagerService.java | 16 ++++++++++++++++ .../android/server/net/NetworkStatsAccessTest.java | 7 ++----- 4 files changed, 42 insertions(+), 10 deletions(-) diff --git a/core/java/android/app/admin/DevicePolicyManagerInternal.java b/core/java/android/app/admin/DevicePolicyManagerInternal.java index 19242ba9bdb5..ffa537e0617e 100644 --- a/core/java/android/app/admin/DevicePolicyManagerInternal.java +++ b/core/java/android/app/admin/DevicePolicyManagerInternal.java @@ -87,6 +87,26 @@ public abstract class DevicePolicyManagerInternal { */ public abstract boolean isActiveAdminWithPolicy(int uid, int reqPolicy); + /** + * Checks if an app with given uid is an active device owner of its user. + * + *

This takes the DPMS lock. DO NOT call from PM/UM/AM with their lock held. + * + * @param uid App uid. + * @return true if the uid is an active device owner. + */ + public abstract boolean isActiveDeviceOwner(int uid); + + /** + * Checks if an app with given uid is an active profile owner of its user. + * + *

This takes the DPMS lock. DO NOT call from PM/UM/AM with their lock held. + * + * @param uid App uid. + * @return true if the uid is an active profile owner. + */ + public abstract boolean isActiveProfileOwner(int uid); + /** * Checks if an app with given uid is the active supervision admin. * diff --git a/services/core/java/com/android/server/net/NetworkStatsAccess.java b/services/core/java/com/android/server/net/NetworkStatsAccess.java index 72559b4825e7..ddc5ef2000a1 100644 --- a/services/core/java/com/android/server/net/NetworkStatsAccess.java +++ b/services/core/java/com/android/server/net/NetworkStatsAccess.java @@ -24,7 +24,6 @@ import static android.net.TrafficStats.UID_TETHERING; import android.Manifest; import android.annotation.IntDef; import android.app.AppOpsManager; -import android.app.admin.DeviceAdminInfo; import android.app.admin.DevicePolicyManagerInternal; import android.content.Context; import android.content.pm.PackageManager; @@ -112,8 +111,7 @@ public final class NetworkStatsAccess { boolean hasCarrierPrivileges = tm != null && tm.checkCarrierPrivilegesForPackageAnyPhone(callingPackage) == TelephonyManager.CARRIER_PRIVILEGE_STATUS_HAS_ACCESS; - boolean isDeviceOwner = dpmi != null && dpmi.isActiveAdminWithPolicy(callingUid, - DeviceAdminInfo.USES_POLICY_DEVICE_OWNER); + boolean isDeviceOwner = dpmi != null && dpmi.isActiveDeviceOwner(callingUid); final int appId = UserHandle.getAppId(callingUid); if (hasCarrierPrivileges || isDeviceOwner || appId == Process.SYSTEM_UID || appId == Process.NETWORK_STACK_UID) { @@ -128,8 +126,9 @@ public final class NetworkStatsAccess { return NetworkStatsAccess.Level.DEVICESUMMARY; } - boolean isProfileOwner = dpmi != null && dpmi.isActiveAdminWithPolicy(callingUid, - DeviceAdminInfo.USES_POLICY_PROFILE_OWNER); + //TODO(b/169395065) Figure out if this flow makes sense in Device Owner mode. + boolean isProfileOwner = dpmi != null && (dpmi.isActiveProfileOwner(callingUid) + || dpmi.isActiveDeviceOwner(callingUid)); if (isProfileOwner) { // Apps with the AppOps permission, profile owners, and apps with the privileged // permission can access data usage for all apps in this user/profile. diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index 0da47ca90f5e..faf3f06a3035 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -12473,6 +12473,22 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } } + @Override + public boolean isActiveDeviceOwner(int uid) { + synchronized (getLockObject()) { + return getActiveAdminWithPolicyForUidLocked( + null, DeviceAdminInfo.USES_POLICY_DEVICE_OWNER, uid) != null; + } + } + + @Override + public boolean isActiveProfileOwner(int uid) { + synchronized (getLockObject()) { + return getActiveAdminWithPolicyForUidLocked( + null, DeviceAdminInfo.USES_POLICY_PROFILE_OWNER, uid) != null; + } + } + @Override public boolean isActiveSupervisionApp(int uid) { synchronized (getLockObject()) { diff --git a/tests/net/java/com/android/server/net/NetworkStatsAccessTest.java b/tests/net/java/com/android/server/net/NetworkStatsAccessTest.java index 858358c74f80..8b730af76951 100644 --- a/tests/net/java/com/android/server/net/NetworkStatsAccessTest.java +++ b/tests/net/java/com/android/server/net/NetworkStatsAccessTest.java @@ -22,7 +22,6 @@ import static org.mockito.Mockito.when; import android.Manifest; import android.Manifest.permission; import android.app.AppOpsManager; -import android.app.admin.DeviceAdminInfo; import android.app.admin.DevicePolicyManagerInternal; import android.content.Context; import android.content.pm.PackageManager; @@ -167,13 +166,11 @@ public class NetworkStatsAccessTest { } private void setIsDeviceOwner(boolean isOwner) { - when(mDpmi.isActiveAdminWithPolicy(TEST_UID, DeviceAdminInfo.USES_POLICY_DEVICE_OWNER)) - .thenReturn(isOwner); + when(mDpmi.isActiveDeviceOwner(TEST_UID)).thenReturn(isOwner); } private void setIsProfileOwner(boolean isOwner) { - when(mDpmi.isActiveAdminWithPolicy(TEST_UID, DeviceAdminInfo.USES_POLICY_PROFILE_OWNER)) - .thenReturn(isOwner); + when(mDpmi.isActiveProfileOwner(TEST_UID)).thenReturn(isOwner); } private void setHasAppOpsPermission(int appOpsMode, boolean hasPermission) { -- cgit v1.2.3-59-g8ed1b