Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9fbb74e0 authored by Eran Messeri's avatar Eran Messeri Committed by Automerger Merge Worker
Browse files

Merge "Document access to device identifiers on managed devices" into sc-dev am: 84b3b6fb 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/14251404

Change-Id: If7656df1f2dcecb055c6ab5f68297f434e765ae2
parents 9804b820 84b3b6fb

core/java/android/app/admin/DevicePolicyManager.java

+11 −1
Original line number Diff line number Diff line
@@ -1847,6 +1847,8 @@ public class DevicePolicyManager { 
     * Delegation of certificate installation and management. This scope grants access to the

     * {@link #getInstalledCaCerts}, {@link #hasCaCertInstalled}, {@link #installCaCert},

     * {@link #uninstallCaCert}, {@link #uninstallAllUserCaCerts} and {@link #installKeyPair} APIs.

     * This scope also grants the ability to read identifiers that the delegating device owner or

     * profile owner can obtain. See {@link #getEnrollmentSpecificId()}.

     */

    public static final String DELEGATION_CERT_INSTALL = "delegation-cert-install";










@@ -13620,12 +13622,20 @@ public class DevicePolicyManager {













     * It is available both in a work profile and on a fully-managed device.















     * The identifier would be consistent even if the work profile is removed and enrolled again















     * (to the same organization), or the device is factory reset and re-enrolled.

























     *















     * Can only be called by the Profile Owner or Device Owner, if the















     * {@link #setOrganizationId(String)} was previously called.















     * If {@link #setOrganizationId(String)} was not called, then the returned value will be an















     * empty string.















     *













     * <p>Note about access to device identifiers: a device owner, a profile owner of an













     * organization-owned device or the delegated certificate installer (holding the













     * {@link #DELEGATION_CERT_INSTALL} delegation) on such a device can still obtain hardware













     * identifiers by calling e.g. {@link android.os.Build#getSerial()}, in addition to using













     * this method. However, a profile owner on a personal (non organization-owned) device, or the













     * delegated certificate installer on such a device, cannot obtain hardware identifiers anymore













     * and must switch to using this method.













     *















     * @return A stable, enrollment-specific identifier.















     * @throws SecurityException if the caller is not a profile owner or device owner.















     */

























core/java/android/os/Build.java



+3
−5




























Original line number
Diff line number
Diff line








@@ -174,15 +174,13 @@ public class Build {













     * <ul>















     *     <li>If the calling app has been granted the READ_PRIVILEGED_PHONE_STATE permission; this















     *     is a privileged permission that can only be granted to apps preloaded on the device.













     *     <li>If the calling app is the device or profile owner and has been granted the













     *     {@link Manifest.permission#READ_PHONE_STATE} permission. The profile owner is an app that













     *     owns a managed profile on the device; for more details see <a













     *     href="https://developer.android.com/work/managed-profiles">Work profiles</a>.













     *     Profile owner access is deprecated and will be removed in a future release.















     *     <li>If the calling app has carrier privileges (see {@link















     *     android.telephony.TelephonyManager#hasCarrierPrivileges}) on any active subscription.















     *     <li>If the calling app is the default SMS role holder (see {@link















     *     android.app.role.RoleManager#isRoleHeld(String)}).













     *     <li>If the calling app is the device owner of a fully-managed device, a profile













     *     owner of an organization-owned device, or their delegates (see {@link













     *     android.app.admin.DevicePolicyManager#getEnrollmentSpecificId()}).















     * </ul>















     *















     * <p>If the calling app does not meet one of these requirements then this method will behave

































telephony/java/android/telephony/TelephonyManager.java



+30
−50




























Original line number
Diff line number
Diff line








@@ -1936,11 +1936,9 @@ public class TelephonyManager {













     * <ul>















     *     <li>If the calling app has been granted the READ_PRIVILEGED_PHONE_STATE permission; this















     *     is a privileged permission that can only be granted to apps preloaded on the device.













     *     <li>If the calling app is the device or profile owner and has been granted the













     *     {@link Manifest.permission#READ_PHONE_STATE} permission. The profile owner is an app that













     *     owns a managed profile on the device; for more details see <a













     *     href="https://developer.android.com/work/managed-profiles">Work profiles</a>.













     *     Profile owner access is deprecated and will be removed in a future release.













     *     <li>If the calling app is the device owner of a fully-managed device, a profile













     *     owner of an organization-owned device, or their delegates (see {@link













     *     android.app.admin.DevicePolicyManager#getEnrollmentSpecificId()}).















     *     <li>If the calling app has carrier privileges (see {@link #hasCarrierPrivileges}) on any















     *     active subscription.















     *     <li>If the calling app is the default SMS role holder (see {@link










@@ -1989,11 +1987,9 @@ public class TelephonyManager {













     * <ul>















     *     <li>If the calling app has been granted the READ_PRIVILEGED_PHONE_STATE permission; this















     *     is a privileged permission that can only be granted to apps preloaded on the device.













     *     <li>If the calling app is the device or profile owner and has been granted the













     *     {@link Manifest.permission#READ_PHONE_STATE} permission. The profile owner is an app that













     *     owns a managed profile on the device; for more details see <a













     *     href="https://developer.android.com/work/managed-profiles">Work profiles</a>.













     *     Profile owner access is deprecated and will be removed in a future release.













     *     <li>If the calling app is the device owner of a fully-managed device, a profile













     *     owner of an organization-owned device, or their delegates (see {@link













     *     android.app.admin.DevicePolicyManager#getEnrollmentSpecificId()}).















     *     <li>If the calling app has carrier privileges (see {@link #hasCarrierPrivileges}) on any















     *     active subscription.















     *     <li>If the calling app is the default SMS role holder (see {@link










@@ -2058,11 +2054,9 @@ public class TelephonyManager {













     * <ul>















     *     <li>If the calling app has been granted the READ_PRIVILEGED_PHONE_STATE permission; this















     *     is a privileged permission that can only be granted to apps preloaded on the device.













     *     <li>If the calling app is the device or profile owner and has been granted the













     *     {@link Manifest.permission#READ_PHONE_STATE} permission. The profile owner is an app that













     *     owns a managed profile on the device; for more details see <a













     *     href="https://developer.android.com/work/managed-profiles">Work profiles</a>.













     *     Profile owner access is deprecated and will be removed in a future release.













     *     <li>If the calling app is the device owner of a fully-managed device, a profile













     *     owner of an organization-owned device, or their delegates (see {@link













     *     android.app.admin.DevicePolicyManager#getEnrollmentSpecificId()}).















     *     <li>If the calling app has carrier privileges (see {@link #hasCarrierPrivileges}) on any















     *     active subscription.















     *     <li>If the calling app is the default SMS role holder (see {@link










@@ -2138,11 +2132,9 @@ public class TelephonyManager {













     * <ul>















     *     <li>If the calling app has been granted the READ_PRIVILEGED_PHONE_STATE permission; this















     *     is a privileged permission that can only be granted to apps preloaded on the device.













     *     <li>If the calling app is the device or profile owner and has been granted the













     *     {@link Manifest.permission#READ_PHONE_STATE} permission. The profile owner is an app that













     *     owns a managed profile on the device; for more details see <a













     *     href="https://developer.android.com/work/managed-profiles">Work profiles</a>.













     *     Profile owner access is deprecated and will be removed in a future release.













     *     <li>If the calling app is the device owner of a fully-managed device, a profile













     *     owner of an organization-owned device, or their delegates (see {@link













     *     android.app.admin.DevicePolicyManager#getEnrollmentSpecificId()}).















     *     <li>If the calling app has carrier privileges (see {@link #hasCarrierPrivileges}) on any















     *     active subscription.















     *     <li>If the calling app is the default SMS role holder (see {@link










@@ -2176,11 +2168,9 @@ public class TelephonyManager {













     * <ul>















     *     <li>If the calling app has been granted the READ_PRIVILEGED_PHONE_STATE permission; this















     *     is a privileged permission that can only be granted to apps preloaded on the device.













     *     <li>If the calling app is the device or profile owner and has been granted the













     *     {@link Manifest.permission#READ_PHONE_STATE} permission. The profile owner is an app that













     *     owns a managed profile on the device; for more details see <a













     *     href="https://developer.android.com/work/managed-profiles">Work profiles</a>.













     *     Profile owner access is deprecated and will be removed in a future release.













     *     <li>If the calling app is the device owner of a fully-managed device, a profile













     *     owner of an organization-owned device, or their delegates (see {@link













     *     android.app.admin.DevicePolicyManager#getEnrollmentSpecificId()}).















     *     <li>If the calling app has carrier privileges (see {@link #hasCarrierPrivileges}) on any















     *     active subscription.















     *     <li>If the calling app is the default SMS role holder (see {@link










@@ -2260,11 +2250,9 @@ public class TelephonyManager {













     * <ul>















     *     <li>If the calling app has been granted the READ_PRIVILEGED_PHONE_STATE permission; this















     *     is a privileged permission that can only be granted to apps preloaded on the device.













     *     <li>If the calling app is the device or profile owner and has been granted the













     *     {@link Manifest.permission#READ_PHONE_STATE} permission. The profile owner is an app that













     *     owns a managed profile on the device; for more details see <a













     *     href="https://developer.android.com/work/managed-profiles">Work profiles</a>.













     *     Profile owner access is deprecated and will be removed in a future release.













     *     <li>If the calling app is the device owner of a fully-managed device, a profile













     *     owner of an organization-owned device, or their delegates (see {@link













     *     android.app.admin.DevicePolicyManager#getEnrollmentSpecificId()}).















     *     <li>If the calling app has carrier privileges (see {@link #hasCarrierPrivileges}).















     *     <li>If the calling app is the default SMS role holder (see {@link















     *     RoleManager#isRoleHeld(String)}).










@@ -2297,11 +2285,9 @@ public class TelephonyManager {













     * <ul>















     *     <li>If the calling app has been granted the READ_PRIVILEGED_PHONE_STATE permission; this















     *     is a privileged permission that can only be granted to apps preloaded on the device.













     *     <li>If the calling app is the device or profile owner and has been granted the













     *     {@link Manifest.permission#READ_PHONE_STATE} permission. The profile owner is an app that













     *     owns a managed profile on the device; for more details see <a













     *     href="https://developer.android.com/work/managed-profiles">Work profiles</a>.













     *     Profile owner access is deprecated and will be removed in a future release.













     *     <li>If the calling app is the device owner of a fully-managed device, a profile













     *     owner of an organization-owned device, or their delegates (see {@link













     *     android.app.admin.DevicePolicyManager#getEnrollmentSpecificId()}).















     *     <li>If the calling app has carrier privileges (see {@link #hasCarrierPrivileges}).















     *     <li>If the calling app is the default SMS role holder (see {@link















     *     RoleManager#isRoleHeld(String)}).










@@ -3783,11 +3769,9 @@ public class TelephonyManager {













     * <ul>















     *     <li>If the calling app has been granted the READ_PRIVILEGED_PHONE_STATE permission; this















     *     is a privileged permission that can only be granted to apps preloaded on the device.













     *     <li>If the calling app is the device or profile owner and has been granted the













     *     {@link Manifest.permission#READ_PHONE_STATE} permission. The profile owner is an app that













     *     owns a managed profile on the device; for more details see <a













     *     href="https://developer.android.com/work/managed-profiles">Work profiles</a>.













     *     Profile owner access is deprecated and will be removed in a future release.













     *     <li>If the calling app is the device owner of a fully-managed device, a profile













     *     owner of an organization-owned device, or their delegates (see {@link













     *     android.app.admin.DevicePolicyManager#getEnrollmentSpecificId()}).















     *     <li>If the calling app has carrier privileges (see {@link #hasCarrierPrivileges}).















     *     <li>If the calling app is the default SMS role holder (see {@link















     *     RoleManager#isRoleHeld(String)}).










@@ -3821,11 +3805,9 @@ public class TelephonyManager {













     * <ul>















     *     <li>If the calling app has been granted the READ_PRIVILEGED_PHONE_STATE permission; this















     *     is a privileged permission that can only be granted to apps preloaded on the device.













     *     <li>If the calling app is the device or profile owner and has been granted the













     *     {@link Manifest.permission#READ_PHONE_STATE} permission. The profile owner is an app that













     *     owns a managed profile on the device; for more details see <a













     *     href="https://developer.android.com/work/managed-profiles">Work profiles</a>.













     *     Profile owner access is deprecated and will be removed in a future release.













     *     <li>If the calling app is the device owner of a fully-managed device, a profile













     *     owner of an organization-owned device, or their delegates (see {@link













     *     android.app.admin.DevicePolicyManager#getEnrollmentSpecificId()}).















     *     <li>If the calling app has carrier privileges (see {@link #hasCarrierPrivileges}).















     *     <li>If the calling app is the default SMS role holder (see {@link















     *     RoleManager#isRoleHeld(String)}).










@@ -4075,11 +4057,9 @@ public class TelephonyManager {













     * <ul>















     *     <li>If the calling app has been granted the READ_PRIVILEGED_PHONE_STATE permission; this















     *     is a privileged permission that can only be granted to apps preloaded on the device.













     *     <li>If the calling app is the device or profile owner and has been granted the













     *     {@link Manifest.permission#READ_PHONE_STATE} permission. The profile owner is an app that













     *     owns a managed profile on the device; for more details see <a













     *     href="https://developer.android.com/work/managed-profiles">Work profiles</a>.













     *     Profile owner access is deprecated and will be removed in a future release.













     *     <li>If the calling app is the device owner of a fully-managed device, a profile













     *     owner of an organization-owned device, or their delegates (see {@link













     *     android.app.admin.DevicePolicyManager#getEnrollmentSpecificId()}).















     *     <li>If the calling app has carrier privileges (see {@link #hasCarrierPrivileges}).















     *     <li>If the calling app is the default SMS role holder (see {@link















     *     RoleManager#isRoleHeld(String)}).