Correct RequiresPermission for LockDevice
Bug: 323007025
Test: n/a
Change-Id: Ib5ba9c9bc4768c26d45ce5f070628e46dab9bd34
diff --git a/core/api/current.txt b/core/api/current.txt
index 9afd4ef..dba3bfa 100644
--- a/core/api/current.txt
+++ b/core/api/current.txt
@@ -8038,8 +8038,8 @@
method public boolean isUsbDataSignalingEnabled();
method public boolean isUsingUnifiedPassword(@NonNull android.content.ComponentName);
method @NonNull public java.util.List<android.os.UserHandle> listForegroundAffiliatedUsers();
- method @RequiresPermission(value=android.Manifest.permission.MANAGE_DEVICE_POLICY_LOCK, conditional=true) public void lockNow();
- method @RequiresPermission(value=android.Manifest.permission.MANAGE_DEVICE_POLICY_LOCK, conditional=true) public void lockNow(int);
+ method @RequiresPermission(value="android.permission.LOCK_DEVICE", conditional=true) public void lockNow();
+ method @RequiresPermission(value="android.permission.LOCK_DEVICE", conditional=true) public void lockNow(int);
method public int logoutUser(@NonNull android.content.ComponentName);
method public void reboot(@NonNull android.content.ComponentName);
method public void removeActiveAdmin(@NonNull android.content.ComponentName);
diff --git a/core/java/android/app/admin/DevicePolicyManager.java b/core/java/android/app/admin/DevicePolicyManager.java
index 5c42b0e..61979e0 100644
--- a/core/java/android/app/admin/DevicePolicyManager.java
+++ b/core/java/android/app/admin/DevicePolicyManager.java
@@ -18,6 +18,7 @@
import static android.Manifest.permission.INTERACT_ACROSS_USERS;
import static android.Manifest.permission.INTERACT_ACROSS_USERS_FULL;
+import static android.Manifest.permission.LOCK_DEVICE;
import static android.Manifest.permission.MANAGE_DEVICE_ADMINS;
import static android.Manifest.permission.MANAGE_DEVICE_POLICY_ACCOUNT_MANAGEMENT;
import static android.Manifest.permission.MANAGE_DEVICE_POLICY_APPS_CONTROL;
@@ -6305,10 +6306,10 @@
* (PIN, pattern, or password). This API is intended for use only by device admins.
* <p>
* From version {@link android.os.Build.VERSION_CODES#R} onwards, the caller must either have
- * the LOCK_DEVICE permission or the device must have the device admin feature; if neither is
- * true, then the method will return without completing any action. Before version
- * {@link android.os.Build.VERSION_CODES#R}, the device needed the device admin feature,
- * regardless of the caller's permissions.
+ * the LOCK_DEVICE permission or the device must have the
+ * device admin feature; if neither is true, then the method will return without completing
+ * any action. Before version {@link android.os.Build.VERSION_CODES#R},
+ * the device needed the device admin feature, regardless of the caller's permissions.
* <p>
* The calling device admin must have requested {@link DeviceAdminInfo#USES_POLICY_FORCE_LOCK}
* to be able to call this method; if it has not, a security exception will be thrown.
@@ -6328,7 +6329,8 @@
* @throws SecurityException if the calling application does not own an active administrator
* that uses {@link DeviceAdminInfo#USES_POLICY_FORCE_LOCK}
*/
- @RequiresPermission(value = MANAGE_DEVICE_POLICY_LOCK, conditional = true)
+ @SuppressLint("RequiresPermission")
+ @RequiresPermission(value = LOCK_DEVICE, conditional = true)
public void lockNow() {
lockNow(0);
}
@@ -6339,14 +6341,13 @@
* <p>
* This method secures the device in response to an urgent situation, such as a lost or stolen
* device. After this method is called, the device must be unlocked using strong authentication
- * (PIN, pattern, or password). This API is for use only by device admins and holders of the
- * {@link android.Manifest.permission#MANAGE_DEVICE_POLICY_LOCK} permission.
+ * (PIN, pattern, or password). This API is intended for use only by device admins.
* <p>
* From version {@link android.os.Build.VERSION_CODES#R} onwards, the caller must either have
- * the LOCK_DEVICE permission or the device must have the device admin feature; if neither is
- * true, then the method will return without completing any action. Before version
- * {@link android.os.Build.VERSION_CODES#R}, the device needed the device admin feature,
- * regardless of the caller's permissions.
+ * the LOCK_DEVICE permission or the device must have the
+ * device admin feature; if neither is true, then the method will return without completing any
+ * action. Before version {@link android.os.Build.VERSION_CODES#R}, the device needed the device
+ * admin feature, regardless of the caller's permissions.
* <p>
* A calling device admin must have requested {@link DeviceAdminInfo#USES_POLICY_FORCE_LOCK}
* to be able to call this method; if it has not, a security exception will be thrown.
@@ -6375,7 +6376,7 @@
* @param flags May be 0 or {@link #FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY}.
* @throws SecurityException if the calling application does not own an active administrator
* that uses {@link DeviceAdminInfo#USES_POLICY_FORCE_LOCK} and the does not hold
- * the {@link android.Manifest.permission#MANAGE_DEVICE_POLICY_LOCK} permission, or
+ * the {@link android.Manifest.permission#LOCK_DEVICE} permission, or
* the {@link #FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY} flag is passed by an
* application that is not a profile owner of a managed profile.
* @throws IllegalArgumentException if the {@link #FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY} flag is
@@ -6384,7 +6385,7 @@
* flag is passed when {@link #getStorageEncryptionStatus} does not return
* {@link #ENCRYPTION_STATUS_ACTIVE_PER_USER}.
*/
- @RequiresPermission(value = MANAGE_DEVICE_POLICY_LOCK, conditional = true)
+ @RequiresPermission(value = LOCK_DEVICE, conditional = true)
public void lockNow(@LockNowFlag int flags) {
if (mService != null) {
try {
diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index f288103..1b8d0e4 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -6010,10 +6010,10 @@
// Make sure the caller has any active admin with the right policy or
// the required permission.
if (isUnicornFlagEnabled()) {
- admin = enforcePermissionAndGetEnforcingAdmin(
+ admin = enforcePermissionsAndGetEnforcingAdmin(
/* admin= */ null,
- /* permission= */ MANAGE_DEVICE_POLICY_LOCK,
- USES_POLICY_FORCE_LOCK,
+ /* permissions= */ new String[]{MANAGE_DEVICE_POLICY_LOCK, LOCK_DEVICE},
+ /* deviceAdminPolicy= */ USES_POLICY_FORCE_LOCK,
caller.getPackageName(),
getAffectedUser(parent)
).getActiveAdmin();