Enforce cross profile calendar policies in one place.
Instead of checking dpm policy in primary user and settings value
in managed profile user, we'd better check them all in primary user.
Calendar provider will need INTERACT_ACROSS_USER_FULL to access
settings provider and this permission is not granted to any app
in privapp-permissions-platform.xml. So I think it's safer to
change isPackageAllowedToAccessCalendar to check both
admin policy & settings value.
Bug: 123629973
Test: atest CalendarProvider2Test
Change-Id: I01bff1317916bac6de72a71a029a2f99dc8e9a0b
diff --git a/services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java b/services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java
index 535198b..9ac91dd 100644
--- a/services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java
+++ b/services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java
@@ -5278,6 +5278,35 @@
assertTrue(actual.containsAll(expected));
}
+ public void testIsPackageAllowedToAccessCalendar_adminNotAllowed() {
+ setAsProfileOwner(admin1);
+ dpm.setCrossProfileCalendarPackages(admin1, Collections.emptySet());
+ when(getServices().settings.settingsSecureGetIntForUser(
+ Settings.Secure.CROSS_PROFILE_CALENDAR_ENABLED,
+ 0, DpmMockContext.CALLER_USER_HANDLE)).thenReturn(1);
+ assertFalse(dpm.isPackageAllowedToAccessCalendar("TEST_PACKAGE"));
+ }
+
+ public void testIsPackageAllowedToAccessCalendar_settingOff() {
+ final String testPackage = "TEST_PACKAGE";
+ setAsProfileOwner(admin1);
+ dpm.setCrossProfileCalendarPackages(admin1, Collections.singleton(testPackage));
+ when(getServices().settings.settingsSecureGetIntForUser(
+ Settings.Secure.CROSS_PROFILE_CALENDAR_ENABLED,
+ 0, DpmMockContext.CALLER_USER_HANDLE)).thenReturn(0);
+ assertFalse(dpm.isPackageAllowedToAccessCalendar(testPackage));
+ }
+
+ public void testIsPackageAllowedToAccessCalendar_bothAllowed() {
+ final String testPackage = "TEST_PACKAGE";
+ setAsProfileOwner(admin1);
+ dpm.setCrossProfileCalendarPackages(admin1, null);
+ when(getServices().settings.settingsSecureGetIntForUser(
+ Settings.Secure.CROSS_PROFILE_CALENDAR_ENABLED,
+ 0, DpmMockContext.CALLER_USER_HANDLE)).thenReturn(1);
+ assertTrue(dpm.isPackageAllowedToAccessCalendar(testPackage));
+ }
+
private void configureProfileOwnerForDeviceIdAccess(ComponentName who, int userId) {
final long ident = mServiceContext.binder.clearCallingIdentity();
mServiceContext.binder.callingUid =