Add security check for clearDeviceInitializer in the service.

Bug: 19230954
Change-Id: I5c648492bef0d2b579b6f59b91afc890e3092d36

1 files changed, 10 insertions, 4 deletions

diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index aa9d8dd..fc9ff76 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -3940,15 +3940,21 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
     }
 
     @Override
-    public void clearDeviceInitializer(String packageName) {
+    public void clearDeviceInitializer(ComponentName who) {
         if (!mHasFeature) {
             return;
         }
-        if (packageName == null) {
-            throw new NullPointerException("packageName is null");
+        Preconditions.checkNotNull(who, "ComponentName is null");
+
+        ActiveAdmin admin = getActiveAdminUncheckedLocked(who, UserHandle.getCallingUserId());
+
+        if (admin.getUid() != Binder.getCallingUid()) {
+            throw new SecurityException("Admin " + who + " is not owned by uid "
+                    + Binder.getCallingUid());
         }
 
-        if (!isDeviceInitializer(packageName) && !isDeviceOwner(packageName)) {
+        if (!isDeviceInitializer(admin.info.getPackageName())
+                && !isDeviceOwner(admin.info.getPackageName())) {
             throw new SecurityException(
                     "clearDeviceInitializer can only be called by the device initializer/owner");
         }