Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3c86c567 authored by Pavel Grafov's avatar Pavel Grafov Committed by Automerger Merge Worker
Browse files

DPM API to grant keys to Wifi am: bf528538 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/13415228

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Ibb1d23c9fbd9b913a94be180732b314041ba670a
parents 24ebae03 bf528538

core/api/current.txt

+3 −0
Original line number Diff line number Diff line
@@ -7121,6 +7121,7 @@ package android.app.admin { 
    method @NonNull public android.os.Bundle getUserRestrictions(@NonNull android.content.ComponentName);

    method @Nullable public String getWifiMacAddress(@NonNull android.content.ComponentName);

    method public boolean grantKeyPairToApp(@Nullable android.content.ComponentName, @NonNull String, @NonNull String);

    method public boolean grantKeyPairToWifiAuth(@NonNull String);

    method public boolean hasCaCertInstalled(@Nullable android.content.ComponentName, byte[]);

    method public boolean hasGrantedPolicy(@NonNull android.content.ComponentName, int);

    method public boolean hasKeyPair(@NonNull String);
@@ -7143,6 +7144,7 @@ package android.app.admin { 
    method public boolean isDeviceIdAttestationSupported();

    method public boolean isDeviceOwnerApp(String);

    method public boolean isEphemeralUser(@NonNull android.content.ComponentName);

    method public boolean isKeyPairGrantedToWifiAuth(@NonNull String);

    method public boolean isLockTaskPermitted(String);

    method public boolean isLogoutEnabled();

    method public boolean isManagedProfile(@NonNull android.content.ComponentName);
@@ -7178,6 +7180,7 @@ package android.app.admin { 
    method @Nullable public java.util.List<android.app.admin.SecurityLog.SecurityEvent> retrievePreRebootSecurityLogs(@NonNull android.content.ComponentName);

    method @Nullable public java.util.List<android.app.admin.SecurityLog.SecurityEvent> retrieveSecurityLogs(@NonNull android.content.ComponentName);

    method public boolean revokeKeyPairFromApp(@Nullable android.content.ComponentName, @NonNull String, @NonNull String);

    method public boolean revokeKeyPairFromWifiAuth(@NonNull String);

    method public void setAccountManagementDisabled(@NonNull android.content.ComponentName, String, boolean);

    method public void setAffiliationIds(@NonNull android.content.ComponentName, @NonNull java.util.Set<java.lang.String>);

    method public void setAlwaysOnVpnPackage(@NonNull android.content.ComponentName, @Nullable String, boolean) throws android.content.pm.PackageManager.NameNotFoundException;

core/java/android/app/admin/DevicePolicyManager.java

+68 −0
Original line number Diff line number Diff line
@@ -6437,6 +6437,74 @@ public class DevicePolicyManager { 
        return false;

    }









    /**









     * Called by a device or profile owner, or delegated certificate chooser (an app that has been









     * delegated the {@link #DELEGATION_CERT_SELECTION} privilege), to allow using a KeyChain key









     * pair for authentication to Wifi networks. The key can then be used in configurations passed









     * to {@link android.net.wifi.WifiManager#addNetwork}.









     *









     * @param alias The alias of the key pair.









     * @return {@code true} if the operation was set successfully, {@code false} otherwise.









     *









     * @throws SecurityException if the caller is not a device owner, a profile owner or









     *         delegated certificate chooser.









     * @see #revokeKeyPairFromWifiAuth









     */









    public boolean grantKeyPairToWifiAuth(@NonNull String alias) {









        throwIfParentInstance("grantKeyPairToWifiAuth");









        try {









            return mService.setKeyGrantToWifiAuth(mContext.getPackageName(), alias, true);









        } catch (RemoteException e) {









            e.rethrowFromSystemServer();









        }









        return false;









    }

















    /**









     * Called by a device or profile owner, or delegated certificate chooser (an app that has been









     * delegated the {@link #DELEGATION_CERT_SELECTION} privilege), to deny using a KeyChain key









     * pair for authentication to Wifi networks. Configured networks using this key won't be able to









     * authenticate.









     *









     * @param alias The alias of the key pair.









     * @return {@code true} if the operation was set successfully, {@code false} otherwise.









     *









     * @throws SecurityException if the caller is not a device owner, a profile owner or









     *         delegated certificate chooser.









     * @see #grantKeyPairToWifiAuth









     */









    public boolean revokeKeyPairFromWifiAuth(@NonNull String alias) {









        throwIfParentInstance("revokeKeyPairFromWifiAuth");









        try {









            return mService.setKeyGrantToWifiAuth(mContext.getPackageName(), alias, false);









        } catch (RemoteException e) {









            e.rethrowFromSystemServer();









        }









        return false;









    }

















    /**









     * Called by a device or profile owner, or delegated certificate chooser (an app that has been









     * delegated the {@link #DELEGATION_CERT_SELECTION} privilege), to query whether a KeyChain key









     * pair can be used for authentication to Wifi networks.









     *









     * @param alias The alias of the key pair.









     * @return {@code true} if the key pair can be used, {@code false} otherwise.









     *









     * @throws SecurityException if the caller is not a device owner, a profile owner or









     *         delegated certificate chooser.









     * @see #grantKeyPairToWifiAuth









     */









    public boolean isKeyPairGrantedToWifiAuth(@NonNull String alias) {









        throwIfParentInstance("isKeyPairGrantedToWifiAuth");









        try {









            return mService.isKeyPairGrantedToWifiAuth(mContext.getPackageName(), alias);









        } catch (RemoteException e) {









            e.rethrowFromSystemServer();









        }









        return false;









    }

















    /**









     * Returns {@code true} if the device supports attestation of device identifiers in addition









     * to key attestation. See
































core/java/android/app/admin/IDevicePolicyManager.aidl



+2
−0






























Original line number
Diff line number
Diff line







@@ -479,6 +479,8 @@ interface IDevicePolicyManager {

















    boolean setKeyGrantForApp(in ComponentName admin, String callerPackage, String alias, String packageName, boolean hasGrant);









    List<String> getKeyPairGrants(in String callerPackage, in String alias);









    boolean setKeyGrantToWifiAuth(String callerPackage, String alias, boolean hasGrant);









    boolean isKeyPairGrantedToWifiAuth(String callerPackage, String alias);



















    void setUserControlDisabledPackages(in ComponentName admin, in List<String> packages);










































services/devicepolicy/java/com/android/server/devicepolicy/BaseIDevicePolicyManager.java



+10
−0






























Original line number
Diff line number
Diff line







@@ -143,4 +143,14 @@ abstract class BaseIDevicePolicyManager extends IDevicePolicyManager.Stub {







    public boolean canAdminGrantSensorsPermissionsForUser(int userId) {









        return false;









    }



















    @Override









    public boolean setKeyGrantToWifiAuth(String callerPackage, String alias, boolean hasGrant) {









        return false;









    }



















    @Override









    public boolean isKeyPairGrantedToWifiAuth(String callerPackage, String alias) {









        return false;









    }









}
























services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java



+44
−6






























Original line number
Diff line number
Diff line







@@ -5460,6 +5460,42 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {







                || isCallerDelegate(caller, DELEGATION_CERT_INSTALL);









    }

















    @Override









    public boolean setKeyGrantToWifiAuth(String callerPackage, String alias, boolean hasGrant) {









        Preconditions.checkStringNotEmpty(alias, "Alias to grant cannot be empty");

















        final CallerIdentity caller = getCallerIdentity(callerPackage);









        Preconditions.checkCallAuthorization(canManageCertificates(caller));

















        return setKeyChainGrantInternal(alias, hasGrant, Process.WIFI_UID, caller.getUserHandle());









    }

















    @Override









    public boolean isKeyPairGrantedToWifiAuth(String callerPackage, String alias) {









        Preconditions.checkStringNotEmpty(alias, "Alias to check cannot be empty");

















        final CallerIdentity caller = getCallerIdentity(callerPackage);









        Preconditions.checkCallAuthorization(canManageCertificates(caller));

















        return mInjector.binderWithCleanCallingIdentity(() -> {









            try (KeyChainConnection keyChainConnection =









                         KeyChain.bindAsUser(mContext, caller.getUserHandle())) {









                final List<String> result = new ArrayList<>();









                final int[] granteeUids = keyChainConnection.getService().getGrants(alias);

















                for (final int uid : granteeUids) {









                    if (uid == Process.WIFI_UID) {









                        return true;









                    }









                }









                return false;









            } catch (RemoteException e) {









                Log.e(LOG_TAG, "Querying grant to wifi auth.    ", e);









                return false;









            }









        });









    }

















    @Override









    public boolean setKeyGrantForApp(ComponentName who, String callerPackage, String alias,









            String packageName, boolean hasGrant) {








@@ -5482,19 +5518,21 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {







            throw new IllegalStateException("Failure getting grantee uid", e);









        }

















        return setKeyChainGrantInternal(alias, hasGrant, granteeUid, caller.getUserHandle());









    }

















    private boolean setKeyChainGrantInternal(String alias, boolean hasGrant, int granteeUid,









            UserHandle userHandle) {









        final long id = mInjector.binderClearCallingIdentity();









        try {









            final KeyChainConnection keyChainConnection =









                    KeyChain.bindAsUser(mContext, caller.getUserHandle());









            try {









            try (KeyChainConnection keyChainConnection =









                         KeyChain.bindAsUser(mContext, userHandle)) {









                IKeyChainService keyChain = keyChainConnection.getService();









                keyChain.setGrant(granteeUid, alias, hasGrant);









                return true;









            } catch (RemoteException e) {









                Log.e(LOG_TAG, "Setting grant for package.", e);









                return false;









            } finally {









                keyChainConnection.close();









            }









        } catch (InterruptedException e) {









            Log.w(LOG_TAG, "Interrupted while setting key grant", e);