Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 73c3e125 authored by Jonathan Scott's avatar Jonathan Scott
Browse files

Remove DevicePolicy from UserManagerInternal 

Fixes: 258186077
Test: atest com.android.server.locksettings
Test: atest FrameworksServicesTests:SyntheticPasswordTests
Test: atest android.devicepolicy.cts.ResetPasswordWithTokenTest
Change-Id: Icfd8a3770572fa3cc77677f3b38e4638c7b472b0
parent 04625c2c

core/java/android/app/admin/DevicePolicyCache.java

+0 −1
Original line number Diff line number Diff line
@@ -61,7 +61,6 @@ public abstract class DevicePolicyCache { 
     */

    public abstract boolean canAdminGrantSensorsPermissionsForUser(@UserIdInt int userHandle);





    /**

     * Empty implementation.

     */

core/java/android/app/admin/DevicePolicyManager.java

+6 −0
Original line number Diff line number Diff line
@@ -165,6 +165,12 @@ import java.util.function.Consumer; 
@SuppressLint("UseIcu")

public class DevicePolicyManager {













    /** @hide */













    public static final String DEPRECATE_USERMANAGERINTERNAL_DEVICEPOLICY_FLAG =













            "deprecate_usermanagerinternal_devicepolicy";













    /** @hide */













    public static final boolean DEPRECATE_USERMANAGERINTERNAL_DEVICEPOLICY_DEFAULT = false;



























    private static String TAG = "DevicePolicyManager";





























    private final Context mContext;

































core/java/android/app/admin/DevicePolicyManagerInternal.java



+5
−0




























Original line number
Diff line number
Diff line








@@ -274,4 +274,9 @@ public abstract class DevicePolicyManagerInternal {













     * Returns whether new "turn off work" behavior is enabled via feature flag.















     */















    public abstract boolean isKeepProfilesRunningEnabled();



























    /**













     * True if either the entire device or the user is organization managed.













     */













    public abstract boolean isUserOrganizationManaged(@UserIdInt int userId);















}
























core/java/android/app/admin/DeviceStateCache.java



+12
−0




























Original line number
Diff line number
Diff line








@@ -15,6 +15,8 @@













 */















package android.app.admin;





























import android.annotation.UserIdInt;





























import com.android.server.LocalServices;































/**










@@ -42,6 +44,11 @@ public abstract class DeviceStateCache {













     */















    public abstract boolean isDeviceProvisioned();





























    /**













     * True if either the entire device or the user is organization managed.













     */













    public abstract boolean isUserOrganizationManaged(@UserIdInt int userHandle);





























    /**















     * Empty implementation.















     */









@@ -52,5 +59,10 @@ public abstract class DeviceStateCache {













        public boolean isDeviceProvisioned() {















            return false;















        }



























        @Override













        public boolean isUserOrganizationManaged(int userHandle) {













            return false;













        }















    }















}
























services/core/java/com/android/server/locksettings/LockSettingsService.java



+29
−10




























Original line number
Diff line number
Diff line








@@ -21,6 +21,8 @@ import static android.Manifest.permission.MANAGE_BIOMETRIC;













import static android.Manifest.permission.READ_CONTACTS;















import static android.Manifest.permission.SET_AND_VERIFY_LOCKSCREEN_CREDENTIALS;















import static android.Manifest.permission.SET_INITIAL_LOCK;













import static android.app.admin.DevicePolicyManager.DEPRECATE_USERMANAGERINTERNAL_DEVICEPOLICY_DEFAULT;













import static android.app.admin.DevicePolicyManager.DEPRECATE_USERMANAGERINTERNAL_DEVICEPOLICY_FLAG;















import static android.app.admin.DevicePolicyResources.Strings.Core.PROFILE_ENCRYPTED_DETAIL;















import static android.app.admin.DevicePolicyResources.Strings.Core.PROFILE_ENCRYPTED_MESSAGE;















import static android.app.admin.DevicePolicyResources.Strings.Core.PROFILE_ENCRYPTED_TITLE;










@@ -91,6 +93,7 @@ import android.os.UserHandle;













import android.os.UserManager;















import android.os.storage.IStorageManager;















import android.os.storage.StorageManager;













import android.provider.DeviceConfig;















import android.provider.Settings;















import android.provider.Settings.Secure;















import android.security.AndroidKeyStoreMaintenance;










@@ -3183,6 +3186,18 @@ public class LockSettingsService extends ILockSettings.Stub {













     * if we are running an automotive build.















     */















    private void disableEscrowTokenOnNonManagedDevicesIfNeeded(int userId) {













        // TODO(b/258213147): Remove













        final long identity = Binder.clearCallingIdentity();













        try {













            if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_DEVICE_POLICY_MANAGER,













                    DEPRECATE_USERMANAGERINTERNAL_DEVICEPOLICY_FLAG,













                    DEPRECATE_USERMANAGERINTERNAL_DEVICEPOLICY_DEFAULT)) {



























                if (mInjector.getDeviceStateCache().isUserOrganizationManaged(userId)) {













                    Slog.i(TAG, "Organization managed users can have escrow token");













                    return;













                }













            } else {















                final UserManagerInternal userManagerInternal = mInjector.getUserManagerInternal();































                // Managed profile should have escrow enabled









@@ -3196,6 +3211,10 @@ public class LockSettingsService extends ILockSettings.Stub {













                    Slog.i(TAG, "Corp-owned device can have escrow token");















                    return;















                }













            }













        } finally {













            Binder.restoreCallingIdentity(identity);













        }































        // If the device is yet to be provisioned (still in SUW), there is still















        // a chance that Device Owner will be set on the device later, so postpone