commit f794c8dc1b62b3a54f3edcfc8031050d9486398a
author Dmitry Dementyev <dementyev@google.com> Fri Feb 03 18:17:59 2017 -0800
committer Dmitry Dementyev <dementyev@google.com> Tue Feb 07 13:39:11 2017 -0800
tree c5639b1da7f4f276bb58d3a574a08e1096ddd448
parent 3d6f51d18b82b5880bb1da65843863b105b0f41e

GET_ACCOUNTS_PRIVILEGED permission check for Account Discovery API.

GET_ACCOUNTS_PRIVELEGED still works in Android O, but authenticators can
limit visibility for apps with the permission.
Bug: 34841115
Test: cts, manual tests.

Change-Id: Ibd87f6172969c550b6166f88176924e517393763

services/core/java/com/android/server/accounts/AccountManagerService.java

diff --git a/services/core/java/com/android/server/accounts/AccountManagerService.java b/services/core/java/com/android/server/accounts/AccountManagerService.java
index fdd7cb1..fbc4440 100644
--- a/services/core/java/com/android/server/accounts/AccountManagerService.java
+++ b/services/core/java/com/android/server/accounts/AccountManagerService.java
@@ -636,11 +636,10 @@
             return visibility;
         }
 
-        if (isPermittedForPackage(packageName, accounts.userId,
-                Manifest.permission.GET_ACCOUNTS_PRIVILEGED)) {
-            return AccountManager.VISIBILITY_VISIBLE;
-        }
-        // Profile owner gets visibility by default.
+        boolean isPrivileged = isPermittedForPackage(packageName, accounts.userId,
+                Manifest.permission.GET_ACCOUNTS_PRIVILEGED);
+
+        // Device/Profile owner gets visibility by default.
         if (isProfileOwner(uid)) {
             return AccountManager.VISIBILITY_VISIBLE;
         }
@@ -650,7 +649,7 @@
         boolean preO = isPreOApplication(packageName);
         if ((signatureCheckResult != SIGNATURE_CHECK_MISMATCH)
                 || (preO && checkGetAccountsPermission(packageName, accounts.userId))
-                || canReadContacts) {
+                || canReadContacts || isPrivileged) {
             // Use legacy for preO apps with GET_ACCOUNTS permission or pre/postO with signature
             // match.
             visibility = getAccountVisibility(account,