Merge "Remove DevicePolicy from UserManagerInternal" (05c9464b) · Commits · e / os / android_frameworks_base

core/java/android/app/admin/DevicePolicyCache.java

+0 −1

Original line number	Diff line number	Diff line
		@@ -61,7 +61,6 @@ public abstract class DevicePolicyCache {
		*/
		public abstract boolean canAdminGrantSensorsPermissionsForUser(@UserIdInt int userHandle);


		/**
		* Empty implementation.
		*/

core/java/android/app/admin/DevicePolicyManager.java

+6 −0

Original line number	Diff line number	Diff line
		@@ -165,6 +165,12 @@ import java.util.function.Consumer;
		@SuppressLint("UseIcu")
		public class DevicePolicyManager {

		/** @hide */
		public static final String DEPRECATE_USERMANAGERINTERNAL_DEVICEPOLICY_FLAG =
		"deprecate_usermanagerinternal_devicepolicy";
		/** @hide */
		public static final boolean DEPRECATE_USERMANAGERINTERNAL_DEVICEPOLICY_DEFAULT = false;

		private static String TAG = "DevicePolicyManager";

		private final Context mContext;

core/java/android/app/admin/DevicePolicyManagerInternal.java

+5 −0

Original line number	Diff line number	Diff line
		@@ -274,4 +274,9 @@ public abstract class DevicePolicyManagerInternal {
		* Returns whether new "turn off work" behavior is enabled via feature flag.
		*/
		public abstract boolean isKeepProfilesRunningEnabled();

		/**
		* True if either the entire device or the user is organization managed.
		*/
		public abstract boolean isUserOrganizationManaged(@UserIdInt int userId);
		}

core/java/android/app/admin/DeviceStateCache.java

+12 −0

Original line number	Diff line number	Diff line
		@@ -15,6 +15,8 @@
		*/
		package android.app.admin;

		import android.annotation.UserIdInt;

		import com.android.server.LocalServices;

		/**
		@@ -42,6 +44,11 @@ public abstract class DeviceStateCache {
		*/
		public abstract boolean isDeviceProvisioned();

		/**
		* True if either the entire device or the user is organization managed.
		*/
		public abstract boolean isUserOrganizationManaged(@UserIdInt int userHandle);

		/**
		* Empty implementation.
		*/
		@@ -52,5 +59,10 @@ public abstract class DeviceStateCache {
		public boolean isDeviceProvisioned() {
		return false;
		}

		@Override
		public boolean isUserOrganizationManaged(int userHandle) {
		return false;
		}
		}
		}

services/core/java/com/android/server/locksettings/LockSettingsService.java

+29 −10

Original line number	Diff line number	Diff line
		@@ -21,6 +21,8 @@ import static android.Manifest.permission.MANAGE_BIOMETRIC;
		import static android.Manifest.permission.READ_CONTACTS;
		import static android.Manifest.permission.SET_AND_VERIFY_LOCKSCREEN_CREDENTIALS;
		import static android.Manifest.permission.SET_INITIAL_LOCK;
		import static android.app.admin.DevicePolicyManager.DEPRECATE_USERMANAGERINTERNAL_DEVICEPOLICY_DEFAULT;
		import static android.app.admin.DevicePolicyManager.DEPRECATE_USERMANAGERINTERNAL_DEVICEPOLICY_FLAG;
		import static android.app.admin.DevicePolicyResources.Strings.Core.PROFILE_ENCRYPTED_DETAIL;
		import static android.app.admin.DevicePolicyResources.Strings.Core.PROFILE_ENCRYPTED_MESSAGE;
		import static android.app.admin.DevicePolicyResources.Strings.Core.PROFILE_ENCRYPTED_TITLE;
		@@ -91,6 +93,7 @@ import android.os.UserHandle;
		import android.os.UserManager;
		import android.os.storage.IStorageManager;
		import android.os.storage.StorageManager;
		import android.provider.DeviceConfig;
		import android.provider.Settings;
		import android.provider.Settings.Secure;
		import android.security.AndroidKeyStoreMaintenance;
		@@ -3183,6 +3186,18 @@ public class LockSettingsService extends ILockSettings.Stub {
		* if we are running an automotive build.
		*/
		private void disableEscrowTokenOnNonManagedDevicesIfNeeded(int userId) {
		// TODO(b/258213147): Remove
		final long identity = Binder.clearCallingIdentity();
		try {
		if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_DEVICE_POLICY_MANAGER,
		DEPRECATE_USERMANAGERINTERNAL_DEVICEPOLICY_FLAG,
		DEPRECATE_USERMANAGERINTERNAL_DEVICEPOLICY_DEFAULT)) {

		if (mInjector.getDeviceStateCache().isUserOrganizationManaged(userId)) {
		Slog.i(TAG, "Organization managed users can have escrow token");
		return;
		}
		} else {
		final UserManagerInternal userManagerInternal = mInjector.getUserManagerInternal();

		// Managed profile should have escrow enabled
		@@ -3196,6 +3211,10 @@ public class LockSettingsService extends ILockSettings.Stub {
		Slog.i(TAG, "Corp-owned device can have escrow token");
		return;
		}
		}
		} finally {
		Binder.restoreCallingIdentity(identity);
		}

		// If the device is yet to be provisioned (still in SUW), there is still
		// a chance that Device Owner will be set on the device later, so postpone