commit b52f6dae9992b01a27c91407da19671981bc1fbf
author Alex Johnston <acjohnston@google.com> Fri Sep 09 14:19:32 2022 +0000
committer Alex Johnston <acjohnston@google.com> Fri Feb 17 10:13:01 2023 +0000
tree ca8913bd3f793d23bb9c7cf9d08f8c05166e9d3a
parent 7137d9165d25c7ddec6fe92e9d83a83ceceeafb0

Fix access control checks getOwnerInstalledCaCerts

Prevent the profile owner or device owner from reading
ca certs for another user

Bug: 235822598
Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest
Test: atest com.android.cts.devicepolicy.ProfileOwnerTest#testAdminActionBookkeeping
Test: atest com.android.cts.devicepolicy.MixedProfileOwnerTest#testDelegatedCertInstaller
Test: atest com.android.cts.devicepolicy.MixedManagedProfileOwnerTest#testDelegatedCertInstaller
Change-Id: I014fa1cfb4ddbbbdb86fbb0f948464dc4f5c069e

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 684ede3..d1f5fdd 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -18504,9 +18504,9 @@
     public StringParceledListSlice getOwnerInstalledCaCerts(@NonNull UserHandle user) {
         final int userId = user.getIdentifier();
         final CallerIdentity caller = getCallerIdentity();
-        Preconditions.checkCallAuthorization((userId == caller.getUserId())
-                || isProfileOwner(caller) || isDefaultDeviceOwner(caller)
-                || hasFullCrossUsersPermission(caller, userId));
+        Preconditions.checkCallAuthorization(
+                (isProfileOwner(caller) || isDefaultDeviceOwner(caller) || canQueryAdminPolicy(
+                        caller)) && hasFullCrossUsersPermission(caller, userId));
 
         synchronized (getLockObject()) {
             return new StringParceledListSlice(