Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 28939988 authored by Pavel Grafov's avatar Pavel Grafov
Browse files

Profile lock timeout. 

When a managed profile has separate lock (a.k.a work challenge)
and maximum screen off timeout set by admin, this timeout will
only cause the profile to get locked, not the whole device.

PowerManagerService now tracks some per-profile state for profiles
that have lock timeout set by admin and have separate lock:
1. timeout set by admin.
2. wake lock summary
3. last activity time
4. whether the profile is considered active
5. whether the profile got locked last time it went inactive.

Wake lock summaries and last activity times are updated at the
same time as global wake lock summary/user activity is updated.

Test: cts-tradefed run commandAndExit cts-dev -a armeabi-v7a -m CtsDevicePolicyManagerTestCases -t com.android.cts.devicepolicy.ManagedProfileTest
Test: runtest -c com.android.server.devicepolicy.DevicePolicyManagerTest frameworks-services
Bug: 63908311
Change-Id: Ief7be4e0bf12bdbedef94a129a13d07a9f98e75c
parent f5cf390e

core/java/android/app/admin/DevicePolicyManager.java

+0 −17
Original line number Diff line number Diff line
@@ -3048,23 +3048,6 @@ public class DevicePolicyManager { 
        return 0;

    }



    /**

     * Returns maximum time to lock that applied by all profiles in this user. We do this because we

     * do not have a separate timeout to lock for work challenge only.

     *

     * @hide

     */

    public long getMaximumTimeToLockForUserAndProfiles(int userHandle) {

        if (mService != null) {

            try {

                return mService.getMaximumTimeToLockForUserAndProfiles(userHandle);

            } catch (RemoteException e) {

                throw e.rethrowFromSystemServer();

            }

        }

        return 0;

    }



    /**

     * Called by a device/profile owner to set the timeout after which unlocking with secondary, non

     * strong auth (e.g. fingerprint, trust agents) times out, i.e. the user has to use a strong

core/java/android/app/admin/DevicePolicyManagerInternal.java

+8 −0
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ 


package android.app.admin;



import android.annotation.UserIdInt;

import android.content.Intent;



import java.util.List;
@@ -115,4 +116,11 @@ public abstract class DevicePolicyManagerInternal { 
     * device owner to be affiliated with.

     */

    public abstract boolean isUserAffiliatedWithDevice(int userId);



    /**

     * Reports that a profile has changed to use a unified or separate credential.

     *

     * @param userId User ID of the profile.

     */

    public abstract void reportSeparateProfileChallengeChanged(@UserIdInt int userId);

}

core/java/android/app/admin/IDevicePolicyManager.aidl

+0 −1
Original line number Diff line number Diff line
@@ -88,7 +88,6 @@ interface IDevicePolicyManager { 


    void setMaximumTimeToLock(in ComponentName who, long timeMs, boolean parent);

    long getMaximumTimeToLock(in ComponentName who, int userHandle, boolean parent);

    long getMaximumTimeToLockForUserAndProfiles(int userHandle);



    void setRequiredStrongAuthTimeout(in ComponentName who, long timeMs, boolean parent);

    long getRequiredStrongAuthTimeout(in ComponentName who, int userId, boolean parent);

core/java/android/os/PowerManagerInternal.java

+1 −1
Original line number Diff line number Diff line
@@ -110,7 +110,7 @@ public abstract class PowerManagerInternal { 
     *

     * This method must only be called by the device administration policy manager.

     */

    public abstract void setMaximumScreenOffTimeoutFromDeviceAdmin(int timeMs);

    public abstract void setMaximumScreenOffTimeoutFromDeviceAdmin(int userId, long timeMs);



    /**

     * Used by the dream manager to override certain properties while dozing.

packages/SettingsLib/src/com/android/settingslib/RestrictedLockUtils.java

+3 −47
Original line number Diff line number Diff line
@@ -432,53 +432,9 @@ public class RestrictedLockUtils { 
     * the admin component will be set to {@code null} and userId to {@link UserHandle#USER_NULL}

     */

    public static EnforcedAdmin checkIfMaximumTimeToLockIsSet(Context context) {

        final DevicePolicyManager dpm = (DevicePolicyManager) context.getSystemService(

                Context.DEVICE_POLICY_SERVICE);

        if (dpm == null) {

            return null;

        }

        EnforcedAdmin enforcedAdmin = null;

        final int userId = UserHandle.myUserId();

        final UserManager um = UserManager.get(context);

        final List<UserInfo> profiles = um.getProfiles(userId);

        final int profilesSize = profiles.size();

        // As we do not have a separate screen lock timeout settings for work challenge,

        // we need to combine all profiles maximum time to lock even work challenge is

        // enabled.

        for (int i = 0; i < profilesSize; i++) {

            final UserInfo userInfo = profiles.get(i);

            final List<ComponentName> admins = dpm.getActiveAdminsAsUser(userInfo.id);

            if (admins == null) {

                continue;

            }

            for (ComponentName admin : admins) {

                if (dpm.getMaximumTimeToLock(admin, userInfo.id) > 0) {

                    if (enforcedAdmin == null) {

                        enforcedAdmin = new EnforcedAdmin(admin, userInfo.id);

                    } else {

                        return EnforcedAdmin.MULTIPLE_ENFORCED_ADMIN;

                    }

                    // This same admins could have set policies both on the managed profile

                    // and on the parent. So, if the admin has set the policy on the

                    // managed profile here, we don't need to further check if that admin

                    // has set policy on the parent admin.

                    continue;

                }

                if (userInfo.isManagedProfile()) {

                    // If userInfo.id is a managed profile, we also need to look at

                    // the policies set on the parent.

                    DevicePolicyManager parentDpm = sProxy.getParentProfileInstance(dpm, userInfo);

                    if (parentDpm.getMaximumTimeToLock(admin, userInfo.id) > 0) {

                        if (enforcedAdmin == null) {

                            enforcedAdmin = new EnforcedAdmin(admin, userInfo.id);

                        } else {

                            return EnforcedAdmin.MULTIPLE_ENFORCED_ADMIN;

                        }

                    }

                }

            }

        }

        return enforcedAdmin;

        return checkForLockSetting(context, UserHandle.myUserId(),

                (DevicePolicyManager dpm, ComponentName admin, @UserIdInt int userId) ->

                        dpm.getMaximumTimeToLock(admin, userId) > 0);

    }



    private interface LockSettingCheck {