Merge "Block ADB from being able to remove COPE profile" into main (59106778) · Commits · e / os / android_frameworks_base

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+10 −0

Original line number	Diff line number	Diff line
		@@ -4250,6 +4250,10 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		private void clearOrgOwnedProfileOwnerUserRestrictions(UserHandle parentUserHandle) {
		mUserManager.setUserRestriction(
		UserManager.DISALLOW_REMOVE_MANAGED_PROFILE, false, parentUserHandle);
		if (mInjector.userManagerIsHeadlessSystemUserMode()) {
		mUserManager.setUserRestriction(UserManager.DISALLOW_REMOVE_MANAGED_PROFILE,
		false, UserHandle.SYSTEM);
		}
		mUserManager.setUserRestriction(
		UserManager.DISALLOW_ADD_USER, false, parentUserHandle);
		}
		@@ -18009,6 +18013,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
		mUserManager.setUserRestriction(UserManager.DISALLOW_REMOVE_MANAGED_PROFILE,
		isProfileOwnerOnOrganizationOwnedDevice,
		parentUser);
		if (mInjector.userManagerIsHeadlessSystemUserMode()) {
		// For HSUM, additionally set this on user 0 to block ADB from removing the profile.
		mUserManager.setUserRestriction(UserManager.DISALLOW_REMOVE_MANAGED_PROFILE,
		isProfileOwnerOnOrganizationOwnedDevice,
		UserHandle.SYSTEM);
		}
		mUserManager.setUserRestriction(UserManager.DISALLOW_ADD_USER,
		isProfileOwnerOnOrganizationOwnedDevice,
		parentUser);