commit 3b2297d05f407839b36d3866987d708b80fc9763
author Sudheer Shanka <sudheersai@google.com> Mon Jun 20 10:44:30 2016 -0700
committer Sudheer Shanka <sudheersai@google.com> Mon Jun 20 18:11:26 2016 +0000
tree ea21cc6402568f1221c8368957448935afcfa0cb
parent 32d67fab83d96a9c05d03a44fcb44e0410bb61df

Allow call addSharedAccountsFromParentUser with CREATE_USERS permission.

Bug: 29189712
Bug: 29500492
Change-Id: I0fca4951d41c14aa1739e01ca15d674b86a15d7c

services/core/java/com/android/server/accounts/AccountManagerService.java

diff --git a/services/core/java/com/android/server/accounts/AccountManagerService.java b/services/core/java/com/android/server/accounts/AccountManagerService.java
index 0cf5172..f7bd04b 100644
--- a/services/core/java/com/android/server/accounts/AccountManagerService.java
+++ b/services/core/java/com/android/server/accounts/AccountManagerService.java
@@ -3538,7 +3538,7 @@
 
     @Override
     public void addSharedAccountsFromParentUser(int parentUserId, int userId) {
-        checkManageUsersPermission("addSharedAccountsFromParentUser");
+        checkManageOrCreateUsersPermission("addSharedAccountsFromParentUser");
         Account[] accounts = getAccountsAsUser(null, parentUserId, mContext.getOpPackageName());
         for (Account account : accounts) {
             addSharedAccountAsUser(account, userId);
@@ -5092,6 +5092,16 @@
         }
     }
 
+    private static void checkManageOrCreateUsersPermission(String message) {
+        if (ActivityManager.checkComponentPermission(android.Manifest.permission.MANAGE_USERS,
+                Binder.getCallingUid(), -1, true) != PackageManager.PERMISSION_GRANTED &&
+                ActivityManager.checkComponentPermission(android.Manifest.permission.CREATE_USERS,
+                        Binder.getCallingUid(), -1, true) != PackageManager.PERMISSION_GRANTED) {
+            throw new SecurityException("You need MANAGE_USERS or CREATE_USERS permission to: "
+                    + message);
+        }
+    }
+
     private boolean hasExplicitlyGrantedPermission(Account account, String authTokenType,
             int callerUid) {
         if (callerUid == Process.SYSTEM_UID) {