Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0e9e960e authored by Treehugger Robot's avatar Treehugger Robot Committed by Android (Google) Code Review
Browse files

Merge changes from topic "sl-api-feedback" into main 

* changes:
  Update result codes for Secure Lock Device
  Update SecureLockDeviceService to use enrollment status
  Rename isSecureLockDeviceAvailable and return type
parents 9301bb86 57e5251a

core/api/system-current.txt

+3 −3
Original line number Diff line number Diff line
@@ -13004,7 +13004,7 @@ package android.security.authenticationpolicy { 
  @FlaggedApi("android.security.secure_lockdown") public final class AuthenticationPolicyManager {

    method @FlaggedApi("android.security.secure_lockdown") @RequiresPermission(android.Manifest.permission.MANAGE_SECURE_LOCK_DEVICE) public int disableSecureLockDevice(@NonNull android.security.authenticationpolicy.DisableSecureLockDeviceParams);

    method @FlaggedApi("android.security.secure_lockdown") @RequiresPermission(android.Manifest.permission.MANAGE_SECURE_LOCK_DEVICE) public int enableSecureLockDevice(@NonNull android.security.authenticationpolicy.EnableSecureLockDeviceParams);

    method @FlaggedApi("android.security.secure_lock_device") @RequiresPermission(android.Manifest.permission.MANAGE_SECURE_LOCK_DEVICE) public int isSecureLockDeviceAvailable();

    method @FlaggedApi("android.security.secure_lock_device") @RequiresPermission(android.Manifest.permission.MANAGE_SECURE_LOCK_DEVICE) public int getSecureLockDeviceAvailability();

    method @FlaggedApi("android.security.secure_lock_device") @RequiresPermission(android.Manifest.permission.MANAGE_SECURE_LOCK_DEVICE) public boolean isSecureLockDeviceEnabled();

    method @FlaggedApi("android.security.secure_lock_device") @RequiresPermission(android.Manifest.permission.MANAGE_SECURE_LOCK_DEVICE) public void registerSecureLockDeviceStatusListener(@NonNull java.util.concurrent.Executor, @NonNull android.security.authenticationpolicy.AuthenticationPolicyManager.SecureLockDeviceStatusListener);

    method @FlaggedApi("android.security.secure_lock_device") @RequiresPermission(android.Manifest.permission.MANAGE_SECURE_LOCK_DEVICE) public void unregisterSecureLockDeviceStatusListener(@NonNull android.security.authenticationpolicy.AuthenticationPolicyManager.SecureLockDeviceStatusListener);
@@ -13013,9 +13013,9 @@ package android.security.authenticationpolicy { 
    field @FlaggedApi("android.security.secure_lockdown") public static final int ERROR_INVALID_PARAMS = 3; // 0x3

    field @FlaggedApi("android.security.secure_lockdown") public static final int ERROR_NOT_AUTHORIZED = 7; // 0x7

    field @FlaggedApi("android.security.secure_lockdown") public static final int ERROR_NO_BIOMETRICS_ENROLLED = 4; // 0x4

    field @FlaggedApi("android.security.secure_lockdown") public static final int ERROR_UNKNOWN = 0; // 0x0

    field @FlaggedApi("android.security.secure_lockdown") public static final int ERROR_UNKNOWN = 1; // 0x1

    field @FlaggedApi("android.security.secure_lockdown") public static final int ERROR_UNSUPPORTED = 2; // 0x2

    field @FlaggedApi("android.security.secure_lockdown") public static final int SUCCESS = 1; // 0x1

    field @FlaggedApi("android.security.secure_lockdown") public static final int SUCCESS = 0; // 0x0

  }















  @FlaggedApi("android.security.secure_lock_device") public static interface AuthenticationPolicyManager.SecureLockDeviceStatusListener {

























core/java/android/security/authenticationpolicy/AuthenticationPolicyManager.java



+26
−25




























Original line number
Diff line number
Diff line








@@ -63,7 +63,7 @@ import java.util.concurrent.Executor;













 *















 * <p>















 * To check if the device meets the requirements to enable secure lock, call













 * {@link #isSecureLockDeviceAvailable}. This will require the caller to have the













 * {@link #getSecureLockDeviceAvailability}. This will require the caller to have the















 * {@link android.Manifest.permission#MANAGE_SECURE_LOCK_DEVICE} permission.















 *















 * <p>










@@ -101,28 +101,26 @@ public final class AuthenticationPolicyManager {













            mSecureLockDeviceStatusListeners = new ConcurrentHashMap<>();































    /**













     * Error result code for {@link #enableSecureLockDevice} and {@link #disableSecureLockDevice}.













     * Success result code for {@link #enableSecureLockDevice} and {@link #disableSecureLockDevice}.















     *













     * Secure lock device request status unknown.













     * Secure lock device request successful.















     *















     * @hide















     */















    @SystemApi















    @FlaggedApi(FLAG_SECURE_LOCKDOWN)













    public static final int ERROR_UNKNOWN = 0;













    public static final int SUCCESS = 0;































    /**













     * Success result code for {@link #enableSecureLockDevice} and {@link #disableSecureLockDevice}.













     * Error result code for {@link #enableSecureLockDevice} and {@link #disableSecureLockDevice}.















     *













     * Secure lock device request successful.













     * Secure lock device request status unknown.















     *















     * @hide















     */















    @SystemApi















    @FlaggedApi(FLAG_SECURE_LOCKDOWN)













    public static final int SUCCESS = 1;









































    public static final int ERROR_UNKNOWN = 1;































    /**















     * Error result code for {@link #enableSecureLockDevice} and {@link #disableSecureLockDevice}.










@@ -198,8 +196,8 @@ public final class AuthenticationPolicyManager {













     * @hide















     */















    @IntDef(prefix = {"ENABLE_SECURE_LOCK_DEVICE_STATUS_"}, value = {













            ERROR_UNKNOWN,















            SUCCESS,













            ERROR_UNKNOWN,















            ERROR_UNSUPPORTED,















            ERROR_INVALID_PARAMS,















            ERROR_NO_BIOMETRICS_ENROLLED,









@@ -215,8 +213,8 @@ public final class AuthenticationPolicyManager {













     * @hide















     */















    @IntDef(prefix = {"DISABLE_SECURE_LOCK_DEVICE_STATUS_"}, value = {













            ERROR_UNKNOWN,















            SUCCESS,













            ERROR_UNKNOWN,















            ERROR_UNSUPPORTED,















            ERROR_INVALID_PARAMS,















            ERROR_NOT_AUTHORIZED









@@ -237,7 +235,7 @@ public final class AuthenticationPolicyManager {













            ERROR_INSUFFICIENT_BIOMETRICS,















    })















    @Retention(RetentionPolicy.SOURCE)













    public @interface IsSecureLockDeviceAvailableRequestStatus {}













    public @interface GetSecureLockDeviceAvailabilityRequestStatus {}































    /** @hide */















    public AuthenticationPolicyManager(@NonNull Context context,










@@ -266,12 +264,13 @@ public final class AuthenticationPolicyManager {













        /**















         * Called when the availability of secure lock device changes for the listening user.















         * @param available An int of type













         * {@link AuthenticationPolicyManager.IsSecureLockDeviceAvailableRequestStatus} that













         * {@link AuthenticationPolicyManager.GetSecureLockDeviceAvailabilityRequestStatus} that















         *                  indicates if the listening user has the necessary requirements to















         *                  enable secure lock device ({@link #SUCCESS} if the user can enable















         *                  secure lock device).















         */













        void onSecureLockDeviceAvailableStatusChanged(int available);













        void onSecureLockDeviceAvailableStatusChanged(













                @GetSecureLockDeviceAvailabilityRequestStatus int available);















    }































    /**










@@ -323,7 +322,8 @@ public final class AuthenticationPolicyManager {













            }































            @Override













            public void onSecureLockDeviceAvailableStatusChanged(int available) {













            public void onSecureLockDeviceAvailableStatusChanged(













                    @GetSecureLockDeviceAvailabilityRequestStatus int available) {















                if (!mSecureLockDeviceStatusListeners.containsKey(listener)) {















                    if (DEBUG) {















                        Log.d(TAG, "Listener " + listener + " no longer registered. Skipping "










@@ -398,22 +398,23 @@ public final class AuthenticationPolicyManager {













     * Called by a privileged component to indicate if secure lock device is available for the















     * calling user.















     *













     * @return {@link IsSecureLockDeviceAvailableRequestStatus} int indicating whether secure lock













     * device is available for the calling user. This will return {@link #SUCCESS} if the device













     * meets all requirements to enable secure lock device, {@link #ERROR_INSUFFICIENT_BIOMETRICS}













     * if the device is missing a strong biometric enrollment, {@link #ERROR_NO_BIOMETRICS_ENROLLED}













     * if the device has no biometric enrollments, or {@link #ERROR_UNSUPPORTED} if secure lock













     * @return {@link GetSecureLockDeviceAvailabilityRequestStatus} int indicating whether secure













     * lock device is available for the calling user. This will return {@link #SUCCESS} if the













     * device meets all requirements to enable secure lock device,













     * {@link #ERROR_INSUFFICIENT_BIOMETRICS} if the device does not have a biometric sensor of













     * sufficient strength, {@link #ERROR_NO_BIOMETRICS_ENROLLED} if the user does not have













     * enrollments on the strong biometric sensor, or {@link #ERROR_UNSUPPORTED} if secure lock















     * device is otherwise unsupported.















     *















     * @hide















     */













    @IsSecureLockDeviceAvailableRequestStatus













    @GetSecureLockDeviceAvailabilityRequestStatus















    @RequiresPermission(MANAGE_SECURE_LOCK_DEVICE)















    @SystemApi















    @FlaggedApi(FLAG_SECURE_LOCK_DEVICE)













    public int isSecureLockDeviceAvailable() {













    public int getSecureLockDeviceAvailability() {















        try {













            return mAuthenticationPolicyService.isSecureLockDeviceAvailable(mContext.getUser());













            return mAuthenticationPolicyService.getSecureLockDeviceAvailability(mContext.getUser());















        } catch (RemoteException e) {















            throw e.rethrowFromSystemServer();















        }









@@ -422,8 +423,8 @@ public final class AuthenticationPolicyManager {





























    /**















     * Called by a privileged component to remotely enable secure lock on the device across all













     * users. This operation will first check {@link #isSecureLockDeviceAvailable()} to see if the













     * calling user meets the requirements to enable secure lock device, including a strong













     * users. This operation will first check {@link #getSecureLockDeviceAvailability()} to see if













     * the calling user meets the requirements to enable secure lock device, including a strong















     * biometric enrollment, and will return an error if not.















     *















     * Secure lock is an enhanced security state that restricts access to sensitive data (app

































core/java/android/security/authenticationpolicy/IAuthenticationPolicyService.aidl



+1
−1




























Original line number
Diff line number
Diff line








@@ -34,7 +34,7 @@ interface IAuthenticationPolicyService {













    int disableSecureLockDevice(in UserHandle user, in DisableSecureLockDeviceParams params);































    @EnforcePermission("MANAGE_SECURE_LOCK_DEVICE")













    int isSecureLockDeviceAvailable(in UserHandle user);













    int getSecureLockDeviceAvailability(in UserHandle user);































    @EnforcePermission("MANAGE_SECURE_LOCK_DEVICE")















    boolean isSecureLockDeviceEnabled();

































core/java/android/security/authenticationpolicy/ISecureLockDeviceStatusListener.aidl



+1
−1




























Original line number
Diff line number
Diff line








@@ -30,7 +30,7 @@ oneway interface ISecureLockDeviceStatusListener {













    /**















     * Called when the availability of secure lock device changes for the listening user.















     * @param available An int of type













     * {@link AuthenticationPolicyManager.IsSecureLockDeviceAvailableRequestStatus} that













     * {@link AuthenticationPolicyManager.GetSecureLockDeviceAvailabilityRequestStatus} that















     *                  indicates if the listening user has the necessary requirements to















     *                  enable secure lock device ({@link #SUCCESS} if the user can enable















     *                  secure lock device).

































data/etc/privapp-permissions-platform.xml



+8
−0




























Original line number
Diff line number
Diff line








@@ -238,6 +238,14 @@ applications that come with the platform













        <permission name="android.permission.READ_COMPAT_CHANGE_CONFIG" />















    </privapp-permissions>





























    <privapp-permissions package="com.android.server.security.authenticationpolicy">













        <permission name="android.permission.INTERACT_ACROSS_USERS"/>













        <permission name="android.permission.MANAGE_SECURE_LOCK_DEVICE"/>













        <permission name="android.permission.SET_BIOMETRIC_DIALOG_ADVANCED"/>













        <permission name="android.permission.USE_BIOMETRIC"/>













        <permission name="android.permission.USE_BIOMETRIC_INTERNAL"/>













    </privapp-permissions>





























    <privapp-permissions package="com.android.server.telecom">















        <permission name="android.permission.BIND_CONNECTION_SERVICE"/>















        <permission name="android.permission.BIND_INCALL_SERVICE"/>