Merge "Disable Settings toggle if admin has set always-on VPN" (1ef019d3) · Commits · e / os / android_frameworks_base

core/java/android/app/admin/DevicePolicyManager.java

+40 −0

Original line number	Original line	Diff line number	Diff line
	@@ -33,6 +33,7 @@ import android.annotation.SuppressLint;
	import android.annotation.SystemApi;		import android.annotation.SystemApi;
	import android.annotation.SystemService;		import android.annotation.SystemService;
	import android.annotation.TestApi;		import android.annotation.TestApi;
			import android.annotation.UserHandleAware;
	import android.annotation.UserIdInt;		import android.annotation.UserIdInt;
	import android.annotation.WorkerThread;		import android.annotation.WorkerThread;
	import android.app.Activity;		import android.app.Activity;
	@@ -5739,6 +5740,25 @@ public class DevicePolicyManager {
	return false;		return false;
	}		}

			/**
			* Returns whether the admin has enabled always-on VPN lockdown for the current user.
			*
			* Only callable by the system.
			* @hide
			*/
			@UserHandleAware
			public boolean isAlwaysOnVpnLockdownEnabled() {
			throwIfParentInstance("isAlwaysOnVpnLockdownEnabled");
			if (mService != null) {
			try {
			return mService.isAlwaysOnVpnLockdownEnabledForUser(myUserId());
			} catch (RemoteException e) {
			throw e.rethrowFromSystemServer();
			}
			}
			return false;
			}

	/**		/**
	* Called by device or profile owner to query the set of packages that are allowed to access		* Called by device or profile owner to query the set of packages that are allowed to access
	* the network directly when always-on VPN is in lockdown mode but not connected. Returns		* the network directly when always-on VPN is in lockdown mode but not connected. Returns
	@@ -5785,6 +5805,26 @@ public class DevicePolicyManager {
	return null;		return null;
	}		}

			/**
			* Returns the VPN package name if the admin has enabled always-on VPN on the current user,
			* or {@code null} if none is set.
			*
			* Only callable by the system.
			* @hide
			*/
			@UserHandleAware
			public @Nullable String getAlwaysOnVpnPackage() {
			throwIfParentInstance("getAlwaysOnVpnPackage");
			if (mService != null) {
			try {
			return mService.getAlwaysOnVpnPackageForUser(myUserId());
			} catch (RemoteException e) {
			throw e.rethrowFromSystemServer();
			}
			}
			return null;
			}

	/**		/**
	* Called by an application that is administering the device to disable all cameras on the		* Called by an application that is administering the device to disable all cameras on the
	* device, for this user. After setting this, no applications running as this user will be able		* device, for this user. After setting this, no applications running as this user will be able

core/java/android/app/admin/IDevicePolicyManager.aidl

+2 −0

Original line number	Original line	Diff line number	Diff line
	@@ -196,7 +196,9 @@ interface IDevicePolicyManager {

	boolean setAlwaysOnVpnPackage(in ComponentName who, String vpnPackage, boolean lockdown, in List<String> lockdownWhitelist);		boolean setAlwaysOnVpnPackage(in ComponentName who, String vpnPackage, boolean lockdown, in List<String> lockdownWhitelist);
	String getAlwaysOnVpnPackage(in ComponentName who);		String getAlwaysOnVpnPackage(in ComponentName who);
			String getAlwaysOnVpnPackageForUser(int userHandle);
	boolean isAlwaysOnVpnLockdownEnabled(in ComponentName who);		boolean isAlwaysOnVpnLockdownEnabled(in ComponentName who);
			boolean isAlwaysOnVpnLockdownEnabledForUser(int userHandle);
	List<String> getAlwaysOnVpnLockdownWhitelist(in ComponentName who);		List<String> getAlwaysOnVpnLockdownWhitelist(in ComponentName who);

	void addPersistentPreferredActivity(in ComponentName admin, in IntentFilter filter, in ComponentName activity);		void addPersistentPreferredActivity(in ComponentName admin, in IntentFilter filter, in ComponentName activity);

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+64 −4

Original line number	Original line	Diff line number	Diff line
	@@ -1073,7 +1073,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
	private static final String TAG_SUSPEND_PERSONAL_APPS = "suspend-personal-apps";		private static final String TAG_SUSPEND_PERSONAL_APPS = "suspend-personal-apps";
	private static final String TAG_PROFILE_MAXIMUM_TIME_OFF = "profile-max-time-off";		private static final String TAG_PROFILE_MAXIMUM_TIME_OFF = "profile-max-time-off";
	private static final String TAG_PROFILE_OFF_DEADLINE = "profile-off-deadline";		private static final String TAG_PROFILE_OFF_DEADLINE = "profile-off-deadline";
			private static final String TAG_ALWAYS_ON_VPN_PACKAGE = "vpn-package";
			private static final String TAG_ALWAYS_ON_VPN_LOCKDOWN = "vpn-lockdown";
	DeviceAdminInfo info;		DeviceAdminInfo info;


	@@ -1202,6 +1203,9 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
	// Time by which the profile should be turned on according to System.currentTimeMillis().		// Time by which the profile should be turned on according to System.currentTimeMillis().
	long mProfileOffDeadline = 0;		long mProfileOffDeadline = 0;

			public String mAlwaysOnVpnPackage;
			public boolean mAlwaysOnVpnLockdown;


	ActiveAdmin(DeviceAdminInfo _info, boolean parent) {		ActiveAdmin(DeviceAdminInfo _info, boolean parent) {
	info = _info;		info = _info;
	@@ -1442,6 +1446,12 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
	if (mProfileMaximumTimeOff != 0) {		if (mProfileMaximumTimeOff != 0) {
	writeAttributeValueToXml(out, TAG_PROFILE_OFF_DEADLINE, mProfileOffDeadline);		writeAttributeValueToXml(out, TAG_PROFILE_OFF_DEADLINE, mProfileOffDeadline);
	}		}
			if (!TextUtils.isEmpty(mAlwaysOnVpnPackage)) {
			writeAttributeValueToXml(out, TAG_ALWAYS_ON_VPN_PACKAGE, mAlwaysOnVpnPackage);
			}
			if (mAlwaysOnVpnLockdown) {
			writeAttributeValueToXml(out, TAG_ALWAYS_ON_VPN_LOCKDOWN, mAlwaysOnVpnLockdown);
			}
	}		}

	void writeTextToXml(XmlSerializer out, String tag, String text) throws IOException {		void writeTextToXml(XmlSerializer out, String tag, String text) throws IOException {
	@@ -1687,6 +1697,11 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
	} else if (TAG_PROFILE_OFF_DEADLINE.equals(tag)) {		} else if (TAG_PROFILE_OFF_DEADLINE.equals(tag)) {
	mProfileOffDeadline =		mProfileOffDeadline =
	Long.parseLong(parser.getAttributeValue(null, ATTR_VALUE));		Long.parseLong(parser.getAttributeValue(null, ATTR_VALUE));
			} else if (TAG_ALWAYS_ON_VPN_PACKAGE.equals(tag)) {
			mAlwaysOnVpnPackage = parser.getAttributeValue(null, ATTR_VALUE);
			} else if (TAG_ALWAYS_ON_VPN_LOCKDOWN.equals(tag)) {
			mAlwaysOnVpnLockdown = Boolean.parseBoolean(
			parser.getAttributeValue(null, ATTR_VALUE));
	} else {		} else {
	Slog.w(LOG_TAG, "Unknown admin tag: " + tag);		Slog.w(LOG_TAG, "Unknown admin tag: " + tag);
	XmlUtils.skipCurrentTag(parser);		XmlUtils.skipCurrentTag(parser);
	@@ -1919,6 +1934,10 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
	pw.println(mProfileMaximumTimeOff);		pw.println(mProfileMaximumTimeOff);
	pw.print("mProfileOffDeadline=");		pw.print("mProfileOffDeadline=");
	pw.println(mProfileOffDeadline);		pw.println(mProfileOffDeadline);
			pw.print("mAlwaysOnVpnPackage=");
			pw.println(mAlwaysOnVpnPackage);
			pw.print("mAlwaysOnVpnLockdown=");
			pw.println(mAlwaysOnVpnLockdown);
	}		}
	}		}

	@@ -6781,10 +6800,10 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
	* @throws UnsupportedOperationException if the package does not support being set as always-on.		* @throws UnsupportedOperationException if the package does not support being set as always-on.
	*/		*/
	@Override		@Override
	public boolean setAlwaysOnVpnPackage(ComponentName admin, String vpnPackage, boolean lockdown,		public boolean setAlwaysOnVpnPackage(ComponentName who, String vpnPackage, boolean lockdown,
	List<String> lockdownWhitelist)		List<String> lockdownWhitelist)
	throws SecurityException {		throws SecurityException {
	enforceProfileOrDeviceOwner(admin);		enforceProfileOrDeviceOwner(who);

	final int userId = mInjector.userHandleGetCallingUserId();		final int userId = mInjector.userHandleGetCallingUserId();
	mInjector.binderWithCleanCallingIdentity(() -> {		mInjector.binderWithCleanCallingIdentity(() -> {
	@@ -6810,12 +6829,22 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
	}		}
	DevicePolicyEventLogger		DevicePolicyEventLogger
	.createEvent(DevicePolicyEnums.SET_ALWAYS_ON_VPN_PACKAGE)		.createEvent(DevicePolicyEnums.SET_ALWAYS_ON_VPN_PACKAGE)
	.setAdmin(admin)		.setAdmin(who)
	.setStrings(vpnPackage)		.setStrings(vpnPackage)
	.setBoolean(lockdown)		.setBoolean(lockdown)
	.setInt(lockdownWhitelist != null ? lockdownWhitelist.size() : 0)		.setInt(lockdownWhitelist != null ? lockdownWhitelist.size() : 0)
	.write();		.write();
	});		});
			synchronized (getLockObject()) {
			ActiveAdmin admin = getActiveAdminForCallerLocked(who,
			DeviceAdminInfo.USES_POLICY_PROFILE_OWNER);
			if (!TextUtils.equals(vpnPackage, admin.mAlwaysOnVpnPackage)
			\|\| lockdown != admin.mAlwaysOnVpnLockdown) {
			admin.mAlwaysOnVpnPackage = vpnPackage;
			admin.mAlwaysOnVpnLockdown = lockdown;
			saveSettingsLocked(userId);
			}
			}
	return true;		return true;
	}		}

	@@ -6828,6 +6857,15 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
	() -> mInjector.getConnectivityManager().getAlwaysOnVpnPackageForUser(userId));		() -> mInjector.getConnectivityManager().getAlwaysOnVpnPackageForUser(userId));
	}		}

			@Override
			public String getAlwaysOnVpnPackageForUser(int userHandle) {
			enforceSystemCaller("getAlwaysOnVpnPackageForUser");
			synchronized (getLockObject()) {
			ActiveAdmin admin = getDeviceOrProfileOwnerAdminLocked(userHandle);
			return admin != null ? admin.mAlwaysOnVpnPackage : null;
			}
			}

	@Override		@Override
	public boolean isAlwaysOnVpnLockdownEnabled(ComponentName admin) throws SecurityException {		public boolean isAlwaysOnVpnLockdownEnabled(ComponentName admin) throws SecurityException {
	enforceProfileOrDeviceOwner(admin);		enforceProfileOrDeviceOwner(admin);
	@@ -6837,6 +6875,15 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
	() -> mInjector.getConnectivityManager().isVpnLockdownEnabled(userId));		() -> mInjector.getConnectivityManager().isVpnLockdownEnabled(userId));
	}		}

			@Override
			public boolean isAlwaysOnVpnLockdownEnabledForUser(int userHandle) {
			enforceSystemCaller("isAlwaysOnVpnLockdownEnabledForUser");
			synchronized (getLockObject()) {
			ActiveAdmin admin = getDeviceOrProfileOwnerAdminLocked(userHandle);
			return admin != null ? admin.mAlwaysOnVpnLockdown : null;
			}
			}

	@Override		@Override
	public List<String> getAlwaysOnVpnLockdownWhitelist(ComponentName admin)		public List<String> getAlwaysOnVpnLockdownWhitelist(ComponentName admin)
	throws SecurityException {		throws SecurityException {
	@@ -8987,6 +9034,19 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
	return null;		return null;
	}		}

			/**
			* Returns the ActiveAdmin associated wit the PO or DO on the given user.
			* @param userHandle
			* @return
			*/
			private @Nullable ActiveAdmin getDeviceOrProfileOwnerAdminLocked(int userHandle) {
			ActiveAdmin admin = getProfileOwnerAdminLocked(userHandle);
			if (admin == null && getDeviceOwnerUserId() == userHandle) {
			admin = getDeviceOwnerAdminLocked();
			}
			return admin;
			}

	@GuardedBy("getLockObject()")		@GuardedBy("getLockObject()")
	ActiveAdmin getProfileOwnerOfOrganizationOwnedDeviceLocked(int userHandle) {		ActiveAdmin getProfileOwnerOfOrganizationOwnedDeviceLocked(int userHandle) {
	return mInjector.binderWithCleanCallingIdentity(() -> {		return mInjector.binderWithCleanCallingIdentity(() -> {