Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 023130fb authored by Kholoud Mohamed's avatar Kholoud Mohamed
Browse files

Add API to allow DMRH to set max policy storage limit per admin 

Bug: 325036682
Test: btest android.devicepolicy.cts.DevicePolicyManagerTest
Change-Id: I1e408fbf418abe9adc7a1de7d7e3030a97496f0e
parent b47b88de

core/api/system-current.txt

+2 −0
Original line number Diff line number Diff line
@@ -1307,6 +1307,7 @@ package android.app.admin { 
    method @Nullable @RequiresPermission(android.Manifest.permission.MANAGE_USERS) public android.os.UserHandle getDeviceOwnerUser();

    method @NonNull @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public android.app.admin.DevicePolicyState getDevicePolicyState();

    method @Nullable @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public String getFinancedDeviceKioskRoleHolder();

    method @FlaggedApi("android.app.admin.flags.device_policy_size_tracking_enabled") @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public int getMaxPolicyStorageLimit();

    method @Nullable @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.QUERY_ADMIN_POLICY}) public java.util.List<java.lang.String> getPermittedAccessibilityServices(int);

    method @Nullable @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.QUERY_ADMIN_POLICY}) public java.util.List<java.lang.String> getPermittedInputMethodsForCurrentUser();

    method @NonNull @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public java.util.List<android.os.UserHandle> getPolicyManagedProfiles(@NonNull android.os.UserHandle);
@@ -1329,6 +1330,7 @@ package android.app.admin { 
    method @RequiresPermission(android.Manifest.permission.MANAGE_DEVICE_POLICY_APP_EXEMPTIONS) public void setApplicationExemptions(@NonNull String, @NonNull java.util.Set<java.lang.Integer>) throws android.content.pm.PackageManager.NameNotFoundException;

    method @RequiresPermission(android.Manifest.permission.MANAGE_USERS) public void setDeviceProvisioningConfigApplied();

    method @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public void setDpcDownloaded(boolean);

    method @FlaggedApi("android.app.admin.flags.device_policy_size_tracking_enabled") @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public void setMaxPolicyStorageLimit(int);

    method @Deprecated @RequiresPermission(value=android.Manifest.permission.GRANT_PROFILE_OWNER_DEVICE_IDS_ACCESS, conditional=true) public void setProfileOwnerCanAccessDeviceIds(@NonNull android.content.ComponentName);

    method public void setSecondaryLockscreenEnabled(@NonNull android.content.ComponentName, boolean);

    method @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public void setUserProvisioningState(int, @NonNull android.os.UserHandle);

core/java/android/app/admin/DevicePolicyManager.java

+43 −0
Original line number Diff line number Diff line
@@ -52,6 +52,7 @@ import static android.Manifest.permission.REQUEST_PASSWORD_COMPLEXITY; 
import static android.Manifest.permission.SET_TIME;

import static android.Manifest.permission.SET_TIME_ZONE;

import static android.app.admin.flags.Flags.FLAG_ESIM_MANAGEMENT_ENABLED;

import static android.app.admin.flags.Flags.FLAG_DEVICE_POLICY_SIZE_TRACKING_ENABLED;

import static android.app.admin.flags.Flags.onboardingBugreportV2Enabled;

import static android.content.Intent.LOCAL_FLAG_FROM_SYSTEM;

import static android.net.NetworkCapabilities.NET_ENTERPRISE_ID_1;
@@ -17348,4 +17349,46 @@ public class DevicePolicyManager { 
        }

        return new HashSet<>();

    }













    /**













     * Controls the maximum storage size allowed for policies associated with an admin.













     * Setting a limit of -1 effectively removes any storage restrictions.













     *













     * @param storageLimit Maximum storage allowed in bytes. Use -1 to disable limits.













     *













     * @hide













     */













    @SystemApi













    @RequiresPermission(permission.MANAGE_PROFILE_AND_DEVICE_OWNERS)













    @FlaggedApi(FLAG_DEVICE_POLICY_SIZE_TRACKING_ENABLED)













    public void setMaxPolicyStorageLimit(int storageLimit) {













        if (mService != null) {













            try {













                mService.setMaxPolicyStorageLimit(mContext.getPackageName(), storageLimit);













            } catch (RemoteException e) {













                throw e.rethrowFromSystemServer();













            }













        }













    }

























    /**













     * Retrieves the current maximum storage limit for policies associated with an admin.













     *













     * @return The maximum storage limit in bytes, or -1 if no limit is enforced.













     *













     * @hide













     */













    @SystemApi













    @RequiresPermission(permission.MANAGE_PROFILE_AND_DEVICE_OWNERS)













    @FlaggedApi(FLAG_DEVICE_POLICY_SIZE_TRACKING_ENABLED)













    public int getMaxPolicyStorageLimit() {













        if (mService != null) {













            try {













                return mService.getMaxPolicyStorageLimit(mContext.getPackageName());













            } catch (RemoteException e) {













                throw e.rethrowFromSystemServer();













            }













        }













        return -1;













    }















}











 No newline at end of file
























core/java/android/app/admin/IDevicePolicyManager.aidl



+3
−0




























Original line number
Diff line number
Diff line








@@ -615,4 +615,7 @@ interface IDevicePolicyManager {













    int getContentProtectionPolicy(in ComponentName who, String callerPackageName);































    int[] getSubscriptionIds(String callerPackageName);



























    void setMaxPolicyStorageLimit(String packageName, int storageLimit);













    int getMaxPolicyStorageLimit(String packageName);















}
























services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java



+53
−3




























Original line number
Diff line number
Diff line








@@ -102,6 +102,9 @@ final class DevicePolicyEngine {













            DevicePolicyIdentifiers.getIdentifierForUserRestriction(















                    UserManager.DISALLOW_CELLULAR_2G);





























    //TODO(b/295504706) : Speak to security team to decide what to set Policy_Size_Limit













    private static final int DEFAULT_POLICY_SIZE_LIMIT = -1;





























    private final Context mContext;















    private final UserManager mUserManager;

























@@ -122,10 +125,11 @@ final class DevicePolicyEngine {













     * Map containing the current set of admins in each user with active policies.















     */















    private final SparseArray<Set<EnforcingAdmin>> mEnforcingAdmins;





























    private final SparseArray<HashMap<EnforcingAdmin, Integer>> mAdminPolicySize;





























    //TODO(b/295504706) : Speak to security team to decide what to set Policy_Size_Limit













    private static final int POLICY_SIZE_LIMIT = 99999;













    private int mPolicySizeLimit = DEFAULT_POLICY_SIZE_LIMIT;





























    private final DeviceAdminServiceController mDeviceAdminServiceController;































    DevicePolicyEngine(










@@ -1594,7 +1598,9 @@ final class DevicePolicyEngine {













            existingPolicySize = sizeOf(policyState.getPoliciesSetByAdmins().get(admin));















        }















        int policySize = sizeOf(value);













        if (currentAdminPoliciesSize + policySize - existingPolicySize < POLICY_SIZE_LIMIT) {













        // Policy size limit is disabled if mPolicySizeLimit is -1.













        if (mPolicySizeLimit == -1













                || currentAdminPoliciesSize + policySize - existingPolicySize < mPolicySizeLimit) {















            increasePolicySizeForAdmin(















                    admin, /* policySizeDiff = */ policySize - existingPolicySize);















            return true;










@@ -1642,6 +1648,26 @@ final class DevicePolicyEngine {













        }















    }





























    /**













     * Updates the max allowed size limit for policies per admin. Setting it to -1, disables













     * the limitation.













     */













    void setMaxPolicyStorageLimit(int storageLimit) {













        if (storageLimit < DEFAULT_POLICY_SIZE_LIMIT && storageLimit != -1) {













            throw new IllegalArgumentException("Can't set a size limit less than the minimum "













                    + "allowed size.");













        }













        mPolicySizeLimit = storageLimit;













    }



























    /**













     * Returns the max allowed size limit for policies per admin. -1 means the limitation is













     * disabled.













     */













    int getMaxPolicyStorageLimit() {













        return mPolicySizeLimit;













    }





























    public void dump(IndentingPrintWriter pw) {















        synchronized (mLock) {















            pw.println("Local Policies: ");










@@ -1761,6 +1787,7 @@ final class DevicePolicyEngine {













        private static final String TAG_ENFORCING_ADMIN_AND_SIZE = "enforcing-admin-and-size";















        private static final String TAG_ENFORCING_ADMIN = "enforcing-admin";















        private static final String TAG_POLICY_SUM_SIZE = "policy-sum-size";













        private static final String TAG_MAX_POLICY_SIZE_LIMIT = "max-policy-size-limit";















        private static final String ATTR_USER_ID = "user-id";















        private static final String ATTR_POLICY_SUM_SIZE = "size";


























@@ -1805,6 +1832,7 @@ final class DevicePolicyEngine {













            writeGlobalPoliciesInner(serializer);















            writeEnforcingAdminsInner(serializer);















            writeEnforcingAdminSizeInner(serializer);













            writeMaxPolicySizeInner(serializer);















        }































        private void writeLocalPoliciesInner(TypedXmlSerializer serializer) throws IOException {










@@ -1886,6 +1914,17 @@ final class DevicePolicyEngine {













            }















        }





























        private void writeMaxPolicySizeInner(TypedXmlSerializer serializer)













                throws IOException {













            if (!devicePolicySizeTrackingEnabled()) {













                return;













            }













            serializer.startTag(/* namespace= */ null, TAG_MAX_POLICY_SIZE_LIMIT);













            serializer.attributeInt(













                    /* namespace= */ null, ATTR_POLICY_SUM_SIZE, mPolicySizeLimit);













            serializer.endTag(/* namespace= */ null, TAG_MAX_POLICY_SIZE_LIMIT);













        }





























        void readFromFileLocked() {















            if (!mFile.exists()) {















                Log.d(TAG, "" + mFile + " doesn't exist");










@@ -1926,6 +1965,9 @@ final class DevicePolicyEngine {













                    case TAG_ENFORCING_ADMIN_AND_SIZE:















                        readEnforcingAdminAndSizeInner(parser);















                        break;













                    case TAG_MAX_POLICY_SIZE_LIMIT:













                        readMaxPolicySizeInner(parser);













                        break;















                    default:















                        Slogf.wtf(TAG, "Unknown tag " + tag);















                }










@@ -2036,5 +2078,13 @@ final class DevicePolicyEngine {













            }















            mAdminPolicySize.get(admin.getUserId()).put(admin, size);















        }



























        private void readMaxPolicySizeInner(TypedXmlPullParser parser)













                throws XmlPullParserException, IOException {













            if (!devicePolicySizeTrackingEnabled()) {













                return;













            }













            mPolicySizeLimit = parser.getAttributeInt(/* namespace= */ null, ATTR_POLICY_SUM_SIZE);













        }















    }















}
























services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java



+33
−4




























Original line number
Diff line number
Diff line








@@ -12042,9 +12042,11 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













        }





























        if (packageList != null) {













            if (!devicePolicySizeTrackingEnabled()) {















                for (String pkg : packageList) {















                    PolicySizeVerifier.enforceMaxPackageNameLength(pkg);















                }













            }





























            List<InputMethodInfo> enabledImes = mInjector.binderWithCleanCallingIdentity(() ->















                    InputMethodManagerInternal.get().getEnabledInputMethodListAsUser(userId));










@@ -14362,9 +14364,11 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













    public void setLockTaskPackages(ComponentName who, String callerPackageName, String[] packages)















            throws SecurityException {















        Objects.requireNonNull(packages, "packages is null");













        if (!devicePolicySizeTrackingEnabled()) {















            for (String pkg : packages) {















                PolicySizeVerifier.enforceMaxPackageNameLength(pkg);















            }













        }





























        CallerIdentity caller = getCallerIdentity(who, callerPackageName);















        checkCanExecuteOrThrowUnsafe(DevicePolicyManager.OPERATION_SET_LOCK_TASK_PACKAGES);










@@ -24075,5 +24079,30 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













            }















            return adminOwnedSubscriptions;















        });

























    }

























    @Override













    public void setMaxPolicyStorageLimit(String callerPackageName, int storageLimit) {













        if (!devicePolicySizeTrackingEnabled()) {













            return;













        }













        CallerIdentity caller = getCallerIdentity(callerPackageName);













        enforcePermission(MANAGE_PROFILE_AND_DEVICE_OWNERS, caller.getPackageName(),













                caller.getUserId());

























        mDevicePolicyEngine.setMaxPolicyStorageLimit(storageLimit);













    }

























    @Override













    public int getMaxPolicyStorageLimit(String callerPackageName) {













        if (!devicePolicySizeTrackingEnabled()) {













            return -1;













        }













        CallerIdentity caller = getCallerIdentity(callerPackageName);













        enforcePermission(MANAGE_PROFILE_AND_DEVICE_OWNERS, caller.getPackageName(),













                caller.getUserId());

























        return mDevicePolicyEngine.getMaxPolicyStorageLimit();















    }















}