Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 50568294 authored by Kholoud Mohamed's avatar Kholoud Mohamed
Browse files

Add test API to trigger policy engine migration 

Also added logic for migrating permission grant state and auto timezone
enabled

Bug: 258811766
Bug: 232918480
Test: manual
Change-Id: Ie7e1e1d7da9119654637c9906e8335c790d53976
parent 9df8ff2f

core/api/test-current.txt

+1 −0
Original line number Diff line number Diff line
@@ -544,6 +544,7 @@ package android.app.admin { 
    method public void setDeviceOwnerType(@NonNull android.content.ComponentName, int);

    method @RequiresPermission(android.Manifest.permission.MANAGE_DEVICE_ADMINS) public void setNextOperationSafety(int, int);

    method @RequiresPermission(anyOf={android.Manifest.permission.MARK_DEVICE_ORGANIZATION_OWNED, android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS}, conditional=true) public void setProfileOwnerOnOrganizationOwnedDevice(@NonNull android.content.ComponentName, boolean);

    method @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public boolean triggerDevicePolicyEngineMigration(boolean);

    field public static final String ACTION_DATA_SHARING_RESTRICTION_APPLIED = "android.app.action.DATA_SHARING_RESTRICTION_APPLIED";

    field public static final String ACTION_DEVICE_POLICY_CONSTANTS_CHANGED = "android.app.action.DEVICE_POLICY_CONSTANTS_CHANGED";

    field public static final int DEVICE_OWNER_TYPE_DEFAULT = 0; // 0x0

core/java/android/app/admin/DevicePolicyManager.java

+23 −11
Original line number Diff line number Diff line
@@ -4021,18 +4021,8 @@ public class DevicePolicyManager { 
    /**

     * @hide

     */

    public static final String PERMISSION_GRANT_POLICY_KEY = "permissionGrant";

    public static final String PERMISSION_GRANT_POLICY = "permissionGrant";













    // TODO: Expose this as SystemAPI once we add the query API













    /**













     * @hide













     */













    public static String PERMISSION_GRANT_POLICY(













            @NonNull String packageName, @NonNull String permission) {













        Objects.requireNonNull(packageName);













        Objects.requireNonNull(permission);













        return PERMISSION_GRANT_POLICY_KEY + "_" + packageName + "_" + permission;













    }





























    // TODO: Expose this as SystemAPI once we add the query API















    /**










@@ -16334,4 +16324,26 @@ public class DevicePolicyManager {













        }















        return null;















    }

























    /**













     * Triggers the data migration of device policies for existing DPCs to the Device Policy Engine.













     * If {@code forceMigration} is set to {@code true} it skips the prerequisite checks before













     * triggering the migration.













     *













     * <p>Returns {@code true} if migration was completed successfully, {@code false} otherwise.













     *













     * @hide













     */













    @TestApi













    @RequiresPermission(permission.MANAGE_PROFILE_AND_DEVICE_OWNERS)













    public boolean triggerDevicePolicyEngineMigration(boolean forceMigration) {













        if (mService != null) {













            try {













                return mService.triggerDevicePolicyEngineMigration(forceMigration);













            } catch (RemoteException e) {













                throw e.rethrowFromSystemServer();













            }













        }













        return false;













    }















}

























core/java/android/app/admin/IDevicePolicyManager.aidl



+2
−0




























Original line number
Diff line number
Diff line








@@ -594,4 +594,6 @@ interface IDevicePolicyManager {













    ManagedSubscriptionsPolicy getManagedSubscriptionsPolicy();































    DevicePolicyState getDevicePolicyState();



























    boolean triggerDevicePolicyEngineMigration(boolean forceMigration);















}
























services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java



+90
−39




























Original line number
Diff line number
Diff line








@@ -113,17 +113,20 @@ final class DevicePolicyEngine {













        mEnforcingAdmins = new SparseArray<>();















    }





























    // TODO: add more documentation on broadcasts/callbacks to use to get current enforced values















    /**













     * Set the policy for the provided {@code policyDefinition}













     * (see {@link PolicyDefinition}) and {@code enforcingAdmin} to the provided {@code value}.













     * Set the policy for the provided {@code policyDefinition} (see {@link PolicyDefinition}) and













     * {@code enforcingAdmin} to the provided {@code value}.













     *













     * <p>If {@code skipEnforcePolicy} is true, it sets the policies in the internal data structure













     * but doesn't call the enforcing logic.













     *















     */















    <V> void setLocalPolicy(















            @NonNull PolicyDefinition<V> policyDefinition,















            @NonNull EnforcingAdmin enforcingAdmin,















            @NonNull PolicyValue<V> value,













            int userId) {



























            int userId,













            boolean skipEnforcePolicy) {















        Objects.requireNonNull(policyDefinition);















        Objects.requireNonNull(enforcingAdmin);















        Objects.requireNonNull(value);









@@ -143,10 +146,12 @@ final class DevicePolicyEngine {













                policyChanged = localPolicyState.addPolicy(enforcingAdmin, value);















            }





























            // No need to notify admins as no new policy is actually enforced, we're just filling in













            // the data structures.













            if (!skipEnforcePolicy) {















                if (policyChanged) {















                    onLocalPolicyChanged(policyDefinition, enforcingAdmin, userId);















                }





























                boolean policyEnforced = Objects.equals(















                        localPolicyState.getCurrentResolvedPolicy(), value);















                sendPolicyResultToAdmin(









@@ -155,6 +160,7 @@ final class DevicePolicyEngine {













                        // TODO: we're always sending this for now, should properly handle errors.















                        policyEnforced ? RESULT_SUCCESS : RESULT_FAILURE_CONFLICTING_ADMIN_POLICY,















                        userId);













            }































            updateDeviceAdminServiceOnPolicyAddLocked(enforcingAdmin);

























@@ -164,6 +170,20 @@ final class DevicePolicyEngine {













        }















    }





























    // TODO: add more documentation on broadcasts/callbacks to use to get current enforced values













    /**













     * Set the policy for the provided {@code policyDefinition}













     * (see {@link PolicyDefinition}) and {@code enforcingAdmin} to the provided {@code value}.













     */













    <V> void setLocalPolicy(













            @NonNull PolicyDefinition<V> policyDefinition,













            @NonNull EnforcingAdmin enforcingAdmin,













            @NonNull PolicyValue<V> value,













            int userId) {













        setLocalPolicy(













                policyDefinition, enforcingAdmin, value, userId, /* skipEnforcePolicy= */ false);













    }





























    // TODO: add more documentation on broadcasts/callbacks to use to get current enforced values















    /**















     * Removes any previously set policy for the provided {@code policyDefinition}










@@ -288,7 +308,7 @@ final class DevicePolicyEngine {













                    userId);















        }















    }













    // TODO: add more documentation on broadcasts/callbacks to use to get current enforced values





























    /**















     * Set the policy for the provided {@code policyDefinition}















     * (see {@link PolicyDefinition}) and {@code enforcingAdmin} to the provided {@code value}.









@@ -297,6 +317,19 @@ final class DevicePolicyEngine {













            @NonNull PolicyDefinition<V> policyDefinition,















            @NonNull EnforcingAdmin enforcingAdmin,















            @NonNull PolicyValue<V> value) {













        setGlobalPolicy(policyDefinition, enforcingAdmin, value, /* skipEnforcePolicy= */ false);













    }



























    // TODO: add more documentation on broadcasts/callbacks to use to get current enforced values













    /**













     * Set the policy for the provided {@code policyDefinition}













     * (see {@link PolicyDefinition}) and {@code enforcingAdmin} to the provided {@code value}.













     */













    <V> void setGlobalPolicy(













            @NonNull PolicyDefinition<V> policyDefinition,













            @NonNull EnforcingAdmin enforcingAdmin,













            @NonNull PolicyValue<V> value,













            boolean skipEnforcePolicy) {































        Objects.requireNonNull(policyDefinition);















        Objects.requireNonNull(enforcingAdmin);









@@ -306,22 +339,27 @@ final class DevicePolicyEngine {













            PolicyState<V> globalPolicyState = getGlobalPolicyStateLocked(policyDefinition);































            boolean policyChanged = globalPolicyState.addPolicy(enforcingAdmin, value);













            boolean policyAppliedOnAllUsers = applyGlobalPolicyOnUsersWithLocalPoliciesLocked(













                    policyDefinition, enforcingAdmin, value, skipEnforcePolicy);



























            // No need to notify admins as no new policy is actually enforced, we're just filling in













            // the data structures.













            if (!skipEnforcePolicy) {















                if (policyChanged) {















                    onGlobalPolicyChanged(policyDefinition, enforcingAdmin);















                }





























            boolean policyEnforcedOnAllUsers = enforceGlobalPolicyOnUsersWithLocalPoliciesLocked(













                    policyDefinition, enforcingAdmin, value);













            boolean policyEnforcedGlobally = Objects.equals(













                boolean policyAppliedGlobally = Objects.equals(















                        globalPolicyState.getCurrentResolvedPolicy(), value);













            boolean policyEnforced = policyEnforcedGlobally && policyEnforcedOnAllUsers;













                boolean policyApplied = policyAppliedGlobally && policyAppliedOnAllUsers;































                sendPolicyResultToAdmin(















                        enforcingAdmin,















                        policyDefinition,















                        // TODO: we're always sending this for now, should properly handle errors.













                    policyEnforced ? RESULT_SUCCESS : RESULT_FAILURE_CONFLICTING_ADMIN_POLICY,













                        policyApplied ? RESULT_SUCCESS : RESULT_FAILURE_CONFLICTING_ADMIN_POLICY,















                        UserHandle.USER_ALL);













            }































            updateDeviceAdminServiceOnPolicyAddLocked(enforcingAdmin);


























@@ -349,8 +387,8 @@ final class DevicePolicyEngine {













                onGlobalPolicyChanged(policyDefinition, enforcingAdmin);















            }





























            boolean policyEnforcedOnAllUsers = enforceGlobalPolicyOnUsersWithLocalPoliciesLocked(













                    policyDefinition, enforcingAdmin, /* value= */ null);













            boolean policyEnforcedOnAllUsers = applyGlobalPolicyOnUsersWithLocalPoliciesLocked(













                    policyDefinition, enforcingAdmin, /* value= */ null, /* enforcePolicy= */ true);















            // For a removePolicy to be enforced, it means no current policy exists















            boolean policyEnforcedGlobally = policyState.getCurrentResolvedPolicy() == null;















            boolean policyEnforced = policyEnforcedGlobally && policyEnforcedOnAllUsers;










@@ -400,15 +438,16 @@ final class DevicePolicyEngine {













     *















     * <p>Returns {@code true} if the policy is enforced successfully on all users.















     */













    private <V> boolean enforceGlobalPolicyOnUsersWithLocalPoliciesLocked(













    private <V> boolean applyGlobalPolicyOnUsersWithLocalPoliciesLocked(















            @NonNull PolicyDefinition<V> policyDefinition,















            @NonNull EnforcingAdmin enforcingAdmin,













            @Nullable PolicyValue<V> value) {













            @Nullable PolicyValue<V> value,













            boolean skipEnforcePolicy) {















        // Global only policies can't be applied locally, return early.















        if (policyDefinition.isGlobalOnlyPolicy()) {















            return true;















        }













        boolean isAdminPolicyEnforced = true;













        boolean isAdminPolicyApplied = true;















        for (int i = 0; i < mLocalPolicies.size(); i++) {















            int userId = mLocalPolicies.keyAt(i);















            if (!hasLocalPolicyLocked(policyDefinition, userId)) {









@@ -420,7 +459,7 @@ final class DevicePolicyEngine {





























            boolean policyChanged = localPolicyState.resolvePolicy(















                    globalPolicyState.getPoliciesSetByAdmins());













            if (policyChanged) {













            if (policyChanged && !skipEnforcePolicy) {















                enforcePolicy(















                        policyDefinition,















                        localPolicyState.getCurrentResolvedPolicy().getValue(),









@@ -434,10 +473,10 @@ final class DevicePolicyEngine {













                        userId);































            }













            isAdminPolicyEnforced &= Objects.equals(













            isAdminPolicyApplied &= Objects.equals(















                    value, localPolicyState.getCurrentResolvedPolicy());















        }













        return isAdminPolicyEnforced;













        return isAdminPolicyApplied;















    }































    /**










@@ -964,10 +1003,22 @@ final class DevicePolicyEngine {













        }















    }





























    /**













     * Clear all policies set in the policy engine.













     *













     * <p>Note that this doesn't clear any enforcements, it only clears the data structures.













     */













    void clearAllPolicies() {













        synchronized (mLock) {













            clear();













            write();













        }













    }















    private void clear() {















        synchronized (mLock) {















            mGlobalPolicies.clear();















            mLocalPolicies.clear();













            mEnforcingAdmins.clear();















        }















    }

















































services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java



+287
−36


























File changed.
Preview size limit exceeded, changes collapsed.