Merge "Add escrow token API in DevicePolicyManager." (824b073f) · Commits · e / os / android_frameworks_base

api/current.txt

+4 −0

Original line number	Diff line number	Diff line
		@@ -6200,6 +6200,7 @@ package android.app.admin {
		method public void clearDeviceOwnerApp(java.lang.String);
		method public void clearPackagePersistentPreferredActivities(android.content.ComponentName, java.lang.String);
		method public void clearProfileOwner(android.content.ComponentName);
		method public boolean clearResetPasswordToken(android.content.ComponentName);
		method public void clearUserRestriction(android.content.ComponentName, java.lang.String);
		method public android.content.Intent createAdminSupportIntent(java.lang.String);
		method public android.os.UserHandle createAndManageUser(android.content.ComponentName, java.lang.String, android.content.ComponentName, android.os.PersistableBundle, int);
		@@ -6276,6 +6277,7 @@ package android.app.admin {
		method public boolean isPackageSuspended(android.content.ComponentName, java.lang.String) throws android.content.pm.PackageManager.NameNotFoundException;
		method public boolean isProfileOwnerApp(java.lang.String);
		method public boolean isProvisioningAllowed(java.lang.String);
		method public boolean isResetPasswordTokenActive(android.content.ComponentName);
		method public boolean isSecurityLoggingEnabled(android.content.ComponentName);
		method public boolean isUninstallBlocked(android.content.ComponentName, java.lang.String);
		method public void lockNow();
		@@ -6287,6 +6289,7 @@ package android.app.admin {
		method public boolean removeUser(android.content.ComponentName, android.os.UserHandle);
		method public boolean requestBugreport(android.content.ComponentName);
		method public boolean resetPassword(java.lang.String, int);
		method public boolean resetPasswordWithToken(android.content.ComponentName, java.lang.String, byte[], int);
		method public java.util.List<android.app.admin.NetworkEvent> retrieveNetworkLogs(android.content.ComponentName, long);
		method public java.util.List<android.app.admin.SecurityLog.SecurityEvent> retrievePreRebootSecurityLogs(android.content.ComponentName);
		method public java.util.List<android.app.admin.SecurityLog.SecurityEvent> retrieveSecurityLogs(android.content.ComponentName);
		@@ -6335,6 +6338,7 @@ package android.app.admin {
		method public void setProfileName(android.content.ComponentName, java.lang.String);
		method public void setRecommendedGlobalProxy(android.content.ComponentName, android.net.ProxyInfo);
		method public void setRequiredStrongAuthTimeout(android.content.ComponentName, long);
		method public boolean setResetPasswordToken(android.content.ComponentName, byte[]);
		method public void setRestrictionsProvider(android.content.ComponentName, android.content.ComponentName);
		method public void setScreenCaptureDisabled(android.content.ComponentName, boolean);
		method public void setSecureSetting(android.content.ComponentName, java.lang.String, java.lang.String);

api/system-current.txt

+4 −0

Original line number	Diff line number	Diff line
		@@ -6405,6 +6405,7 @@ package android.app.admin {
		method public void clearDeviceOwnerApp(java.lang.String);
		method public void clearPackagePersistentPreferredActivities(android.content.ComponentName, java.lang.String);
		method public void clearProfileOwner(android.content.ComponentName);
		method public boolean clearResetPasswordToken(android.content.ComponentName);
		method public void clearUserRestriction(android.content.ComponentName, java.lang.String);
		method public android.content.Intent createAdminSupportIntent(java.lang.String);
		method public android.os.UserHandle createAndManageUser(android.content.ComponentName, java.lang.String, android.content.ComponentName, android.os.PersistableBundle, int);
		@@ -6495,6 +6496,7 @@ package android.app.admin {
		method public boolean isPackageSuspended(android.content.ComponentName, java.lang.String) throws android.content.pm.PackageManager.NameNotFoundException;
		method public boolean isProfileOwnerApp(java.lang.String);
		method public boolean isProvisioningAllowed(java.lang.String);
		method public boolean isResetPasswordTokenActive(android.content.ComponentName);
		method public boolean isSecurityLoggingEnabled(android.content.ComponentName);
		method public boolean isUninstallBlocked(android.content.ComponentName, java.lang.String);
		method public void lockNow();
		@@ -6509,6 +6511,7 @@ package android.app.admin {
		method public boolean removeUser(android.content.ComponentName, android.os.UserHandle);
		method public boolean requestBugreport(android.content.ComponentName);
		method public boolean resetPassword(java.lang.String, int);
		method public boolean resetPasswordWithToken(android.content.ComponentName, java.lang.String, byte[], int);
		method public java.util.List<android.app.admin.NetworkEvent> retrieveNetworkLogs(android.content.ComponentName, long);
		method public java.util.List<android.app.admin.SecurityLog.SecurityEvent> retrievePreRebootSecurityLogs(android.content.ComponentName);
		method public java.util.List<android.app.admin.SecurityLog.SecurityEvent> retrieveSecurityLogs(android.content.ComponentName);
		@@ -6559,6 +6562,7 @@ package android.app.admin {
		method public void setProfileName(android.content.ComponentName, java.lang.String);
		method public void setRecommendedGlobalProxy(android.content.ComponentName, android.net.ProxyInfo);
		method public void setRequiredStrongAuthTimeout(android.content.ComponentName, long);
		method public boolean setResetPasswordToken(android.content.ComponentName, byte[]);
		method public void setRestrictionsProvider(android.content.ComponentName, android.content.ComponentName);
		method public void setScreenCaptureDisabled(android.content.ComponentName, boolean);
		method public void setSecureSetting(android.content.ComponentName, java.lang.String, java.lang.String);

api/test-current.txt

+4 −0

Original line number	Diff line number	Diff line
		@@ -6217,6 +6217,7 @@ package android.app.admin {
		method public void clearDeviceOwnerApp(java.lang.String);
		method public void clearPackagePersistentPreferredActivities(android.content.ComponentName, java.lang.String);
		method public void clearProfileOwner(android.content.ComponentName);
		method public boolean clearResetPasswordToken(android.content.ComponentName);
		method public void clearUserRestriction(android.content.ComponentName, java.lang.String);
		method public android.content.Intent createAdminSupportIntent(java.lang.String);
		method public android.os.UserHandle createAndManageUser(android.content.ComponentName, java.lang.String, android.content.ComponentName, android.os.PersistableBundle, int);
		@@ -6298,6 +6299,7 @@ package android.app.admin {
		method public boolean isPackageSuspended(android.content.ComponentName, java.lang.String) throws android.content.pm.PackageManager.NameNotFoundException;
		method public boolean isProfileOwnerApp(java.lang.String);
		method public boolean isProvisioningAllowed(java.lang.String);
		method public boolean isResetPasswordTokenActive(android.content.ComponentName);
		method public boolean isSecurityLoggingEnabled(android.content.ComponentName);
		method public boolean isUninstallBlocked(android.content.ComponentName, java.lang.String);
		method public void lockNow();
		@@ -6309,6 +6311,7 @@ package android.app.admin {
		method public boolean removeUser(android.content.ComponentName, android.os.UserHandle);
		method public boolean requestBugreport(android.content.ComponentName);
		method public boolean resetPassword(java.lang.String, int);
		method public boolean resetPasswordWithToken(android.content.ComponentName, java.lang.String, byte[], int);
		method public java.util.List<android.app.admin.NetworkEvent> retrieveNetworkLogs(android.content.ComponentName, long);
		method public java.util.List<android.app.admin.SecurityLog.SecurityEvent> retrievePreRebootSecurityLogs(android.content.ComponentName);
		method public java.util.List<android.app.admin.SecurityLog.SecurityEvent> retrieveSecurityLogs(android.content.ComponentName);
		@@ -6357,6 +6360,7 @@ package android.app.admin {
		method public void setProfileName(android.content.ComponentName, java.lang.String);
		method public void setRecommendedGlobalProxy(android.content.ComponentName, android.net.ProxyInfo);
		method public void setRequiredStrongAuthTimeout(android.content.ComponentName, long);
		method public boolean setResetPasswordToken(android.content.ComponentName, byte[]);
		method public void setRestrictionsProvider(android.content.ComponentName, android.content.ComponentName);
		method public void setScreenCaptureDisabled(android.content.ComponentName, boolean);
		method public void setSecureSetting(android.content.ComponentName, java.lang.String, java.lang.String);

core/java/android/app/admin/DevicePolicyManager.java

+127 −0

Original line number	Diff line number	Diff line
		@@ -28,6 +28,7 @@ import android.annotation.UserIdInt;
		import android.annotation.WorkerThread;
		import android.app.Activity;
		import android.app.IServiceConnection;
		import android.app.KeyguardManager;
		import android.app.admin.SecurityLog.SecurityEvent;
		import android.content.ComponentName;
		import android.content.Context;
		@@ -2694,6 +2695,11 @@ public class DevicePolicyManager {
		* Force a new device unlock password (the password needed to access the entire device, not for
		* individual accounts) on the user. This takes effect immediately.
		* <p>
		* <em>For device owner and profile owners targeting SDK level
		* {@link android.os.Build.VERSION_CODES#O} or above, this API is no longer available and will
		* throw {@link SecurityException}. Please use the new API {@link #resetPasswordWithToken}
		* instead. </em>
		* <p>
		* <em>Note: This API has been limited as of {@link android.os.Build.VERSION_CODES#N} for
		* device admins that are not device owner and not profile owner.
		* The password can now only be changed if there is currently no password set. Device owner
		@@ -2739,6 +2745,127 @@ public class DevicePolicyManager {
		return false;
		}

		/**
		* Called by a profile or device owner to provision a token which can later be used to reset the
		* device lockscreen password (if called by device owner), or work challenge (if called by
		* profile owner), via {@link #resetPasswordWithToken}.
		* <p>
		* If the user currently has a lockscreen password, the provisioned token will not be
		* immediately usable; it only becomes active after the user performs a confirm credential
		* operation, which can be triggered by {@link KeyguardManager#createConfirmDeviceCredentialIntent}.
		* If the user has no lockscreen password, the token is activated immediately. In all cases,
		* the active state of the current token can be checked by {@link #isResetPasswordTokenActive}.
		* For security reasons, un-activated tokens are only stored in memory and will be lost once
		* the device reboots. In this case a new token needs to be provisioned again.
		* <p>
		* Once provisioned and activated, the token will remain effective even if the user changes
		* or clears the lockscreen password.
		* <p>
		* <em>This token is highly sensitive and should be treated at the same level as user
		* credentials. In particular, NEVER store this token on device in plaintext, especially in
		* Device-Encrypted storage if the token will be used to reset password on FBE devices before
		* user unlocks.
		* </em>
		*
		* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
		* @param token a secure token a least 32-byte long, which must be generated by a
		* cryptographically strong random number generator.
		* @return true if the operation is successful, false otherwise.
		* @throws IllegalArgumentException if the supplied token is invalid.
		* @throws SecurityException
		*/
		public boolean setResetPasswordToken(ComponentName admin, byte[] token) {
		throwIfParentInstance("setResetPasswordToken");
		if (mService != null) {
		try {
		return mService.setResetPasswordToken(admin, token);
		} catch (RemoteException e) {
		throw e.rethrowFromSystemServer();
		}
		}
		return false;
		}

		/**
		* Called by a profile or device owner to revoke the current password reset token.
		*
		* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
		* @return true if the operation is successful, false otherwise.
		*/
		public boolean clearResetPasswordToken(ComponentName admin) {
		throwIfParentInstance("clearResetPasswordToken");
		if (mService != null) {
		try {
		return mService.clearResetPasswordToken(admin);
		} catch (RemoteException e) {
		throw e.rethrowFromSystemServer();
		}
		}
		return false;
		}

		/**
		* Called by a profile or device owner to check if the current reset password token is active.
		*
		* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
		* @return true if the token is active, false otherwise.
		* @throws IllegalStateException if no token has been set.
		*/
		public boolean isResetPasswordTokenActive(ComponentName admin) {
		throwIfParentInstance("isResetPasswordTokenActive");
		if (mService != null) {
		try {
		return mService.isResetPasswordTokenActive(admin);
		} catch (RemoteException e) {
		throw e.rethrowFromSystemServer();
		}
		}
		return false;
		}

		/**
		* Called by device or profile owner to force set a new device unlock password or a work profile
		* challenge on current user. This takes effect immediately.
		* <p>
		* Unlike {@link #resetPassword}, this API can change the password even before the user or
		* device is unlocked or decrypted. The supplied token must have been previously provisioned via
		* {@link #setResetPasswordToken}, and in active state {@link #isResetPasswordTokenActive}.
		* <p>
		* The given password must be sufficient for the current password quality and length constraints
		* as returned by {@link #getPasswordQuality(ComponentName)} and
		* {@link #getPasswordMinimumLength(ComponentName)}; if it does not meet these constraints, then
		* it will be rejected and false returned. Note that the password may be a stronger quality
		* (containing alphanumeric characters when the requested quality is only numeric), in which
		* case the currently active quality will be increased to match.
		* <p>
		* Calling with a null or empty password will clear any existing PIN, pattern or password if the
		* current password constraints allow it.
		*
		* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
		* @param password The new password for the user. Null or empty clears the password.
		* @param token the password reset token previously provisioned by #setResetPasswordToken.
		* @param flags May be 0 or combination of {@link #RESET_PASSWORD_REQUIRE_ENTRY} and
		* {@link #RESET_PASSWORD_DO_NOT_ASK_CREDENTIALS_ON_BOOT}.
		* @return Returns true if the password was applied, or false if it is not acceptable for the
		* current constraints.
		* @throws SecurityException if the calling application does not own an active administrator
		* that uses {@link DeviceAdminInfo#USES_POLICY_RESET_PASSWORD}
		* @throws IllegalStateException if the provided token is not valid.
		* @throws IllegalArgumentException if the password does not meet system requirements.
		*/
		public boolean resetPasswordWithToken(@NonNull ComponentName admin, String password,
		byte[] token, int flags) {
		throwIfParentInstance("resetPassword");
		if (mService != null) {
		try {
		return mService.resetPasswordWithToken(admin, password, token, flags);
		} catch (RemoteException e) {
		throw e.rethrowFromSystemServer();
		}
		}
		return false;
		}

		/**
		* Called by an application that is administering the device to set the maximum time for user
		* activity until the device will lock. This limits the length that the user can set. It takes

core/java/android/app/admin/IDevicePolicyManager.aidl

+5 −0

Original line number	Diff line number	Diff line
		@@ -342,4 +342,9 @@ interface IDevicePolicyManager {
		long getLastSecurityLogRetrievalTime();
		long getLastBugReportRequestTime();
		long getLastNetworkLogRetrievalTime();

		boolean setResetPasswordToken(in ComponentName admin, in byte[] token);
		boolean clearResetPasswordToken(in ComponentName admin);
		boolean isResetPasswordTokenActive(in ComponentName admin);
		boolean resetPasswordWithToken(in ComponentName admin, String password, in byte[] token, int flags);
		}