Merge "Correct RequiresPermission for LockDevice" into main
diff --git a/core/api/current.txt b/core/api/current.txt
index bca15bd..ddc7e02 100644
--- a/core/api/current.txt
+++ b/core/api/current.txt
@@ -8070,8 +8070,8 @@
method public boolean isUsbDataSignalingEnabled();
method public boolean isUsingUnifiedPassword(@NonNull android.content.ComponentName);
method @NonNull public java.util.List<android.os.UserHandle> listForegroundAffiliatedUsers();
- method @RequiresPermission(value=android.Manifest.permission.MANAGE_DEVICE_POLICY_LOCK, conditional=true) public void lockNow();
- method @RequiresPermission(value=android.Manifest.permission.MANAGE_DEVICE_POLICY_LOCK, conditional=true) public void lockNow(int);
+ method @RequiresPermission(value="android.permission.LOCK_DEVICE", conditional=true) public void lockNow();
+ method @RequiresPermission(value="android.permission.LOCK_DEVICE", conditional=true) public void lockNow(int);
method public int logoutUser(@NonNull android.content.ComponentName);
method public void reboot(@NonNull android.content.ComponentName);
method public void removeActiveAdmin(@NonNull android.content.ComponentName);
diff --git a/core/java/android/app/admin/DevicePolicyManager.java b/core/java/android/app/admin/DevicePolicyManager.java
index 1ef4346..c8762c6 100644
--- a/core/java/android/app/admin/DevicePolicyManager.java
+++ b/core/java/android/app/admin/DevicePolicyManager.java
@@ -18,6 +18,7 @@
import static android.Manifest.permission.INTERACT_ACROSS_USERS;
import static android.Manifest.permission.INTERACT_ACROSS_USERS_FULL;
+import static android.Manifest.permission.LOCK_DEVICE;
import static android.Manifest.permission.MANAGE_DEVICE_ADMINS;
import static android.Manifest.permission.MANAGE_DEVICE_POLICY_ACCOUNT_MANAGEMENT;
import static android.Manifest.permission.MANAGE_DEVICE_POLICY_APPS_CONTROL;
@@ -6415,10 +6416,10 @@
* (PIN, pattern, or password). This API is intended for use only by device admins.
* <p>
* From version {@link android.os.Build.VERSION_CODES#R} onwards, the caller must either have
- * the LOCK_DEVICE permission or the device must have the device admin feature; if neither is
- * true, then the method will return without completing any action. Before version
- * {@link android.os.Build.VERSION_CODES#R}, the device needed the device admin feature,
- * regardless of the caller's permissions.
+ * the LOCK_DEVICE permission or the device must have the
+ * device admin feature; if neither is true, then the method will return without completing
+ * any action. Before version {@link android.os.Build.VERSION_CODES#R},
+ * the device needed the device admin feature, regardless of the caller's permissions.
* <p>
* The calling device admin must have requested {@link DeviceAdminInfo#USES_POLICY_FORCE_LOCK}
* to be able to call this method; if it has not, a security exception will be thrown.
@@ -6438,7 +6439,8 @@
* @throws SecurityException if the calling application does not own an active administrator
* that uses {@link DeviceAdminInfo#USES_POLICY_FORCE_LOCK}
*/
- @RequiresPermission(value = MANAGE_DEVICE_POLICY_LOCK, conditional = true)
+ @SuppressLint("RequiresPermission")
+ @RequiresPermission(value = LOCK_DEVICE, conditional = true)
public void lockNow() {
lockNow(0);
}
@@ -6449,14 +6451,13 @@
* <p>
* This method secures the device in response to an urgent situation, such as a lost or stolen
* device. After this method is called, the device must be unlocked using strong authentication
- * (PIN, pattern, or password). This API is for use only by device admins and holders of the
- * {@link android.Manifest.permission#MANAGE_DEVICE_POLICY_LOCK} permission.
+ * (PIN, pattern, or password). This API is intended for use only by device admins.
* <p>
* From version {@link android.os.Build.VERSION_CODES#R} onwards, the caller must either have
- * the LOCK_DEVICE permission or the device must have the device admin feature; if neither is
- * true, then the method will return without completing any action. Before version
- * {@link android.os.Build.VERSION_CODES#R}, the device needed the device admin feature,
- * regardless of the caller's permissions.
+ * the LOCK_DEVICE permission or the device must have the
+ * device admin feature; if neither is true, then the method will return without completing any
+ * action. Before version {@link android.os.Build.VERSION_CODES#R}, the device needed the device
+ * admin feature, regardless of the caller's permissions.
* <p>
* A calling device admin must have requested {@link DeviceAdminInfo#USES_POLICY_FORCE_LOCK}
* to be able to call this method; if it has not, a security exception will be thrown.
@@ -6485,7 +6486,7 @@
* @param flags May be 0 or {@link #FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY}.
* @throws SecurityException if the calling application does not own an active administrator
* that uses {@link DeviceAdminInfo#USES_POLICY_FORCE_LOCK} and the does not hold
- * the {@link android.Manifest.permission#MANAGE_DEVICE_POLICY_LOCK} permission, or
+ * the {@link android.Manifest.permission#LOCK_DEVICE} permission, or
* the {@link #FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY} flag is passed by an
* application that is not a profile owner of a managed profile.
* @throws IllegalArgumentException if the {@link #FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY} flag is
@@ -6494,7 +6495,7 @@
* flag is passed when {@link #getStorageEncryptionStatus} does not return
* {@link #ENCRYPTION_STATUS_ACTIVE_PER_USER}.
*/
- @RequiresPermission(value = MANAGE_DEVICE_POLICY_LOCK, conditional = true)
+ @RequiresPermission(value = LOCK_DEVICE, conditional = true)
public void lockNow(@LockNowFlag int flags) {
if (mService != null) {
try {
diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 6f0985a..f87fd8d 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -6016,10 +6016,10 @@
// Make sure the caller has any active admin with the right policy or
// the required permission.
if (isUnicornFlagEnabled()) {
- admin = enforcePermissionAndGetEnforcingAdmin(
+ admin = enforcePermissionsAndGetEnforcingAdmin(
/* admin= */ null,
- /* permission= */ MANAGE_DEVICE_POLICY_LOCK,
- USES_POLICY_FORCE_LOCK,
+ /* permissions= */ new String[]{MANAGE_DEVICE_POLICY_LOCK, LOCK_DEVICE},
+ /* deviceAdminPolicy= */ USES_POLICY_FORCE_LOCK,
caller.getPackageName(),
getAffectedUser(parent)
).getActiveAdmin();