Merge "Restrict adding managed profile in DO devices" into rvc-dev am: 9c5f79ef29 (9455b449) · Commits · e / os / android_frameworks_base

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+23 −0

Original line number	Diff line number	Diff line
		@@ -2691,6 +2691,27 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
		}
		}

		/**
		* If the device is in Device Owner mode, apply the restriction on adding
		* a managed profile.
		*/
		@GuardedBy("getLockObject()")
		void applyManagedProfileRestrictionIfDeviceOwnerLocked() {
		final int doUserId = mOwners.getDeviceOwnerUserId();
		if (doUserId == UserHandle.USER_NULL) {
		logIfVerbose("No DO found, skipping application of restriction.");
		return;
		}

		final UserHandle doUserHandle = UserHandle.of(doUserId);
		// Set the restriction if not set.
		if (!mUserManager.hasUserRestriction(
		UserManager.DISALLOW_ADD_MANAGED_PROFILE, doUserHandle)) {
		mUserManager.setUserRestriction(UserManager.DISALLOW_ADD_MANAGED_PROFILE, true,
		doUserHandle);
		}
		}

		/** Apply default restrictions that haven't been applied to profile owners yet. */
		private void maybeSetDefaultProfileOwnerUserRestrictions() {
		synchronized (getLockObject()) {
		@@ -3901,6 +3922,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
		maybeStartSecurityLogMonitorOnActivityManagerReady();
		synchronized (getLockObject()) {
		migrateToProfileOnOrganizationOwnedDeviceIfCompLocked();
		applyManagedProfileRestrictionIfDeviceOwnerLocked();
		}
		final int userId = getManagedUserId(UserHandle.USER_SYSTEM);
		if (userId >= 0) {
		@@ -8764,6 +8786,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
		mOwners.writeProfileOwner(userId);
		deleteTransferOwnershipBundleLocked(userId);
		toggleBackupServiceActive(userId, true);
		applyManagedProfileRestrictionIfDeviceOwnerLocked();
		}

		@Override