Merge "Apply DISALLOW_ADD_USER to user0 in COPE" into main (0d04a607) · Commits · e / os / android_frameworks_base

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+19 −0

Original line number	Diff line number	Diff line
		@@ -928,6 +928,8 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {

		private static final int RETRY_COPY_ACCOUNT_ATTEMPTS = 3;

		private static final int BOOT_TO_HSU_FOR_PROVISIONED_DEVICE = 1;

		/**
		* For apps targeting U+
		* Enable multiple admins to coexist on the same device.
		@@ -4391,6 +4393,10 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		}
		mUserManager.setUserRestriction(
		UserManager.DISALLOW_ADD_USER, false, parentUserHandle);
		if (mInjector.userManagerIsHeadlessSystemUserMode() && isBootToUser0Enabled()) {
		mUserManager.setUserRestriction(UserManager.DISALLOW_ADD_USER,
		false, UserHandle.SYSTEM);
		}
		}

		private void clearDeviceOwnerUserRestriction(UserHandle userHandle) {
		@@ -17927,6 +17933,13 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		mUserManager.setUserRestriction(UserManager.DISALLOW_ADD_USER,
		isProfileOwnerOnOrganizationOwnedDevice,
		parentUser);
		if (mInjector.userManagerIsHeadlessSystemUserMode() && isBootToUser0Enabled()) {
		// Additionally set this restriction on user 0 to block adding new users from the
		// login screen on HSUM.
		mUserManager.setUserRestriction(UserManager.DISALLOW_ADD_USER,
		isProfileOwnerOnOrganizationOwnedDevice,
		UserHandle.SYSTEM);
		}
		});

		// setProfileOwnerOfOrganizationOwnedDevice will trigger writing of the profile owner
		@@ -17935,6 +17948,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		isProfileOwnerOnOrganizationOwnedDevice);
		}

		private boolean isBootToUser0Enabled() {
		final int bootStrategy = mContext.getResources()
		.getInteger(com.android.internal.R.integer.config_hsumBootStrategy);
		return bootStrategy == BOOT_TO_HSU_FOR_PROVISIONED_DEVICE;
		}

		private void pushMeteredDisabledPackages(int userId) {
		wtfIfInLock();
		mInjector.getNetworkPolicyManagerInternal().setMeteredRestrictedPackages(