Allow call addSharedAccountsFromParentUser with CREATE_USERS permission.
Bug: 29189712
Bug: 29500492
Change-Id: I0fca4951d41c14aa1739e01ca15d674b86a15d7c
diff --git a/services/core/java/com/android/server/accounts/AccountManagerService.java b/services/core/java/com/android/server/accounts/AccountManagerService.java
index 0cf5172..f7bd04b 100644
--- a/services/core/java/com/android/server/accounts/AccountManagerService.java
+++ b/services/core/java/com/android/server/accounts/AccountManagerService.java
@@ -3538,7 +3538,7 @@
@Override
public void addSharedAccountsFromParentUser(int parentUserId, int userId) {
- checkManageUsersPermission("addSharedAccountsFromParentUser");
+ checkManageOrCreateUsersPermission("addSharedAccountsFromParentUser");
Account[] accounts = getAccountsAsUser(null, parentUserId, mContext.getOpPackageName());
for (Account account : accounts) {
addSharedAccountAsUser(account, userId);
@@ -5092,6 +5092,16 @@
}
}
+ private static void checkManageOrCreateUsersPermission(String message) {
+ if (ActivityManager.checkComponentPermission(android.Manifest.permission.MANAGE_USERS,
+ Binder.getCallingUid(), -1, true) != PackageManager.PERMISSION_GRANTED &&
+ ActivityManager.checkComponentPermission(android.Manifest.permission.CREATE_USERS,
+ Binder.getCallingUid(), -1, true) != PackageManager.PERMISSION_GRANTED) {
+ throw new SecurityException("You need MANAGE_USERS or CREATE_USERS permission to: "
+ + message);
+ }
+ }
+
private boolean hasExplicitlyGrantedPermission(Account account, String authTokenType,
int callerUid) {
if (callerUid == Process.SYSTEM_UID) {