Merge "Fix bug in screen capture and lock task migrations" into main (70f17ac5) · Commits · e / os / android_frameworks_base

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+72 −5

Original line number	Original line	Diff line number	Diff line
	@@ -3395,7 +3395,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
	if (shouldMigrateV1ToDevicePolicyEngine()) {		if (shouldMigrateV1ToDevicePolicyEngine()) {
	migrateV1PoliciesToDevicePolicyEngine();		migrateV1PoliciesToDevicePolicyEngine();
	}		}
			maybeMigratePoliciesPostUpgradeToDevicePolicyEngineLocked();
	migratePoliciesToPolicyEngineLocked();		migratePoliciesToPolicyEngineLocked();

	}		}
	maybeStartSecurityLogMonitorOnActivityManagerReady();		maybeStartSecurityLogMonitorOnActivityManagerReady();
	break;		break;
	@@ -23749,7 +23751,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
	if (!canForceMigration && !shouldMigrateV1ToDevicePolicyEngine()) {		if (!canForceMigration && !shouldMigrateV1ToDevicePolicyEngine()) {
	return false;		return false;
	}		}
	return migrateV1PoliciesToDevicePolicyEngine();		boolean migrated = migrateV1PoliciesToDevicePolicyEngine();
			migrated &= migratePoliciesPostUpgradeToDevicePolicyEngineLocked();
			return migrated;
	});		});
	}		}

	@@ -23778,6 +23782,30 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {

	/**		/**
	* Migrates the initial set of policies to use policy engine.		* Migrates the initial set of policies to use policy engine.
			* [b/318497672] Migrate policies that weren't migrated properly in the initial migration on
			* update from Android T to Android U
			*/
			private void maybeMigratePoliciesPostUpgradeToDevicePolicyEngineLocked() {
			if (!mOwners.isMigratedToPolicyEngine() \|\| mOwners.isMigratedPostUpdate()) {
			return;
			}
			migratePoliciesPostUpgradeToDevicePolicyEngineLocked();
			mOwners.markPostUpgradeMigration();
			}

			private boolean migratePoliciesPostUpgradeToDevicePolicyEngineLocked() {
			try {
			migrateScreenCapturePolicyLocked();
			migrateLockTaskPolicyLocked();
			return true;
			} catch (Exception e) {
			Slogf.e(LOG_TAG, e, "Error occurred during post upgrade migration to the device "
			+ "policy engine.");
			return false;
			}
			}

			/**
	* @return {@code true} if policies were migrated successfully, {@code false} otherwise.		* @return {@code true} if policies were migrated successfully, {@code false} otherwise.
	*/		*/
	private boolean migrateV1PoliciesToDevicePolicyEngine() {		private boolean migrateV1PoliciesToDevicePolicyEngine() {
	@@ -23790,7 +23818,6 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
	migrateAutoTimezonePolicy();		migrateAutoTimezonePolicy();
	migratePermissionGrantStatePolicies();		migratePermissionGrantStatePolicies();
	}		}
	migrateScreenCapturePolicyLocked();
	migratePermittedInputMethodsPolicyLocked();		migratePermittedInputMethodsPolicyLocked();
	migrateAccountManagementDisabledPolicyLocked();		migrateAccountManagementDisabledPolicyLocked();
	migrateUserControlDisabledPackagesLocked();		migrateUserControlDisabledPackagesLocked();
	@@ -23871,14 +23898,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {

	private void migrateScreenCapturePolicyLocked() {		private void migrateScreenCapturePolicyLocked() {
	Binder.withCleanCallingIdentity(() -> {		Binder.withCleanCallingIdentity(() -> {
	if (mPolicyCache.getScreenCaptureDisallowedUser() == UserHandle.USER_NULL) {
	return;
	}
	ActiveAdmin admin = getDeviceOwnerOrProfileOwnerOfOrganizationOwnedDeviceLocked();		ActiveAdmin admin = getDeviceOwnerOrProfileOwnerOfOrganizationOwnedDeviceLocked();
	if (admin != null		if (admin != null
	&& ((isDeviceOwner(admin) && admin.disableScreenCapture)		&& ((isDeviceOwner(admin) && admin.disableScreenCapture)
	\|\| (admin.getParentActiveAdmin() != null		\|\| (admin.getParentActiveAdmin() != null
	&& admin.getParentActiveAdmin().disableScreenCapture))) {		&& admin.getParentActiveAdmin().disableScreenCapture))) {

	EnforcingAdmin enforcingAdmin = EnforcingAdmin.createEnterpriseEnforcingAdmin(		EnforcingAdmin enforcingAdmin = EnforcingAdmin.createEnterpriseEnforcingAdmin(
	admin.info.getComponent(),		admin.info.getComponent(),
	admin.getUserHandle().getIdentifier(),		admin.getUserHandle().getIdentifier(),
	@@ -23907,6 +23932,48 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
	});		});
	}		}

			private void migrateLockTaskPolicyLocked() {
			Binder.withCleanCallingIdentity(() -> {
			ActiveAdmin deviceOwner = getDeviceOwnerAdminLocked();
			if (deviceOwner != null) {
			int doUserId = deviceOwner.getUserHandle().getIdentifier();
			DevicePolicyData policies = getUserData(doUserId);
			List<String> packages = policies.mLockTaskPackages;
			int features = policies.mLockTaskFeatures;
			// TODO: find out about persistent preferred activities
			if (!packages.isEmpty()) {
			setLockTaskPolicyInPolicyEngine(deviceOwner, doUserId, packages, features);
			}
			}

			for (int userId : mUserManagerInternal.getUserIds()) {
			ActiveAdmin profileOwner = getProfileOwnerLocked(userId);
			if (profileOwner != null && canDPCManagedUserUseLockTaskLocked(userId)) {
			DevicePolicyData policies = getUserData(userId);
			List<String> packages = policies.mLockTaskPackages;
			int features = policies.mLockTaskFeatures;
			if (!packages.isEmpty()) {
			setLockTaskPolicyInPolicyEngine(profileOwner, userId, packages, features);
			}
			}
			}
			});
			}

			private void setLockTaskPolicyInPolicyEngine(
			ActiveAdmin admin, int userId, List<String> packages, int features) {
			EnforcingAdmin enforcingAdmin =
			EnforcingAdmin.createEnterpriseEnforcingAdmin(
			admin.info.getComponent(),
			userId,
			admin);
			mDevicePolicyEngine.setLocalPolicy(
			PolicyDefinition.LOCK_TASK,
			enforcingAdmin,
			new LockTaskPolicy(new HashSet<>(packages), features),
			userId);
			}

	private void migratePermittedInputMethodsPolicyLocked() {		private void migratePermittedInputMethodsPolicyLocked() {
	Binder.withCleanCallingIdentity(() -> {		Binder.withCleanCallingIdentity(() -> {
	List<UserInfo> users = mUserManager.getUsers();		List<UserInfo> users = mUserManager.getUsers();

services/devicepolicy/java/com/android/server/devicepolicy/Owners.java

+13 −0

Original line number	Original line	Diff line number	Diff line
	@@ -623,12 +623,25 @@ class Owners {
	}		}
	}		}

			void markPostUpgradeMigration() {
			synchronized (mData) {
			mData.mPoliciesMigratedPostUpdate = true;
			mData.writeDeviceOwner();
			}
			}

	boolean isSecurityLoggingMigrated() {		boolean isSecurityLoggingMigrated() {
	synchronized (mData) {		synchronized (mData) {
	return mData.mSecurityLoggingMigrated;		return mData.mSecurityLoggingMigrated;
	}		}
	}		}

			boolean isMigratedPostUpdate() {
			synchronized (mData) {
			return mData.mPoliciesMigratedPostUpdate;
			}
			}

	@GuardedBy("mData")		@GuardedBy("mData")
	void pushToAppOpsLocked() {		void pushToAppOpsLocked() {
	if (!mSystemReady) {		if (!mSystemReady) {

services/devicepolicy/java/com/android/server/devicepolicy/OwnersData.java

+8 −0

Original line number	Original line	Diff line number	Diff line
	@@ -89,6 +89,8 @@ class OwnersData {
	private static final String ATTR_MIGRATED_TO_POLICY_ENGINE = "migratedToPolicyEngine";		private static final String ATTR_MIGRATED_TO_POLICY_ENGINE = "migratedToPolicyEngine";
	private static final String ATTR_SECURITY_LOG_MIGRATED = "securityLogMigrated";		private static final String ATTR_SECURITY_LOG_MIGRATED = "securityLogMigrated";

			private static final String ATTR_MIGRATED_POST_UPGRADE = "migratedPostUpgrade";

	// Internal state for the device owner package.		// Internal state for the device owner package.
	OwnerInfo mDeviceOwner;		OwnerInfo mDeviceOwner;
	int mDeviceOwnerUserId = UserHandle.USER_NULL;		int mDeviceOwnerUserId = UserHandle.USER_NULL;
	@@ -117,6 +119,8 @@ class OwnersData {
	boolean mMigratedToPolicyEngine = false;		boolean mMigratedToPolicyEngine = false;
	boolean mSecurityLoggingMigrated = false;		boolean mSecurityLoggingMigrated = false;

			boolean mPoliciesMigratedPostUpdate = false;

	OwnersData(PolicyPathProvider pathProvider) {		OwnersData(PolicyPathProvider pathProvider) {
	mPathProvider = pathProvider;		mPathProvider = pathProvider;
	}		}
	@@ -400,6 +404,7 @@ class OwnersData {

	out.startTag(null, TAG_POLICY_ENGINE_MIGRATION);		out.startTag(null, TAG_POLICY_ENGINE_MIGRATION);
	out.attributeBoolean(null, ATTR_MIGRATED_TO_POLICY_ENGINE, mMigratedToPolicyEngine);		out.attributeBoolean(null, ATTR_MIGRATED_TO_POLICY_ENGINE, mMigratedToPolicyEngine);
			out.attributeBoolean(null, ATTR_MIGRATED_POST_UPGRADE, mPoliciesMigratedPostUpdate);
	if (Flags.securityLogV2Enabled()) {		if (Flags.securityLogV2Enabled()) {
	out.attributeBoolean(null, ATTR_SECURITY_LOG_MIGRATED, mSecurityLoggingMigrated);		out.attributeBoolean(null, ATTR_SECURITY_LOG_MIGRATED, mSecurityLoggingMigrated);
	}		}
	@@ -463,8 +468,11 @@ class OwnersData {
	case TAG_POLICY_ENGINE_MIGRATION:		case TAG_POLICY_ENGINE_MIGRATION:
	mMigratedToPolicyEngine = parser.getAttributeBoolean(		mMigratedToPolicyEngine = parser.getAttributeBoolean(
	null, ATTR_MIGRATED_TO_POLICY_ENGINE, false);		null, ATTR_MIGRATED_TO_POLICY_ENGINE, false);
			mPoliciesMigratedPostUpdate = parser.getAttributeBoolean(
			null, ATTR_MIGRATED_POST_UPGRADE, false);
	mSecurityLoggingMigrated = Flags.securityLogV2Enabled()		mSecurityLoggingMigrated = Flags.securityLogV2Enabled()
	&& parser.getAttributeBoolean(null, ATTR_SECURITY_LOG_MIGRATED, false);		&& parser.getAttributeBoolean(null, ATTR_SECURITY_LOG_MIGRATED, false);

	break;		break;
	default:		default:
	Slog.e(TAG, "Unexpected tag: " + tag);		Slog.e(TAG, "Unexpected tag: " + tag);

services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerServiceMigrationTest.java

+3 −0

Original line number	Original line	Diff line number	Diff line
	@@ -145,6 +145,7 @@ public class DevicePolicyManagerServiceMigrationTest extends DpmTestBase {

	@SmallTest		@SmallTest
	@Test		@Test
			@Ignore("b/277916462")
	public void testCompMigrationUnAffiliated_skipped() throws Exception {		public void testCompMigrationUnAffiliated_skipped() throws Exception {
	prepareAdmin1AsDo();		prepareAdmin1AsDo();
	prepareAdminAnotherPackageAsPo(COPE_PROFILE_USER_ID);		prepareAdminAnotherPackageAsPo(COPE_PROFILE_USER_ID);
	@@ -216,6 +217,7 @@ public class DevicePolicyManagerServiceMigrationTest extends DpmTestBase {

	@SmallTest		@SmallTest
	@Test		@Test
			@Ignore("b/277916462")
	public void testCompMigration_keepSuspendedAppsWhenDpcIsRPlus() throws Exception {		public void testCompMigration_keepSuspendedAppsWhenDpcIsRPlus() throws Exception {
	prepareAdmin1AsDo();		prepareAdmin1AsDo();
	prepareAdmin1AsPo(COPE_PROFILE_USER_ID, Build.VERSION_CODES.R);		prepareAdmin1AsPo(COPE_PROFILE_USER_ID, Build.VERSION_CODES.R);
	@@ -249,6 +251,7 @@ public class DevicePolicyManagerServiceMigrationTest extends DpmTestBase {

	@SmallTest		@SmallTest
	@Test		@Test
			@Ignore("b/277916462")
	public void testCompMigration_unsuspendAppsWhenDpcNotRPlus() throws Exception {		public void testCompMigration_unsuspendAppsWhenDpcNotRPlus() throws Exception {
	prepareAdmin1AsDo();		prepareAdmin1AsDo();
	prepareAdmin1AsPo(COPE_PROFILE_USER_ID, Build.VERSION_CODES.Q);		prepareAdmin1AsPo(COPE_PROFILE_USER_ID, Build.VERSION_CODES.Q);