Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit af0aa258 authored by Alex Johnston's avatar Alex Johnston
Browse files

Modify DPM KEYGUARD_DISABLE_SECURE_CAMERA restriction 

* Introduced new logic that allows the profile owner of an
  organization-owned device (COPE PO) to set the restriction
  KEYGUARD_DISABLE_SECURE_CAMERA on the parent profile.
* Modified the API setKeyguardDisabledFeatures to be callable
  on the parent profile for restriction KEYGUARD_DISABLE_SECURE_CAMERA.

Bug: 148656201
Test: Manual testing with TestDPC
      atest com.android.cts.devicepolicy.OrgOwnedProfileOwnerTest#testSetKeyguardDisabledFeatures
      atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testSetKeyguardDisabledFeatures
      atest com.android.cts.devicepolicy.MixedManagedProfileOwnerTest#testSetKeyguardDisabledFeatures
      atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testSetKeyguardDisabledFeaturesLogged

Change-Id: I13984193e24b8745686e48c9c58ebee40a204fc7
parent 98a201dc

core/java/android/app/admin/DevicePolicyManager.java

+42 −8
Original line number Diff line number Diff line
@@ -4718,16 +4718,41 @@ public class DevicePolicyManager { 
    public static final int KEYGUARD_DISABLE_FEATURES_ALL = 0x7fffffff;















    /**













     * Keyguard features that when set on a managed profile that doesn't have its own challenge will













     * affect the profile's parent user. These can also be set on the managed profile's parent













     * {@link DevicePolicyManager} instance.













     * Keyguard features that when set on a non-organization-owned managed profile that doesn't













     * have its own challenge will affect the profile's parent user. These can also be set on the













     * managed profile's parent {@link DevicePolicyManager} instance to explicitly control the













     * parent user.













     *













     * <p>













     * Organization-owned managed profile supports disabling additional keyguard features on the













     * parent user as defined in {@link #ORG_OWNED_PROFILE_KEYGUARD_FEATURES_PARENT_ONLY}.















     *















     * @hide















     */













    public static final int PROFILE_KEYGUARD_FEATURES_AFFECT_OWNER =













    public static final int NON_ORG_OWNED_PROFILE_KEYGUARD_FEATURES_AFFECT_OWNER =















            DevicePolicyManager.KEYGUARD_DISABLE_TRUST_AGENTS















            | DevicePolicyManager.KEYGUARD_DISABLE_BIOMETRICS;



























    /**













     * Keyguard features that when set by the profile owner of an organization-owned managed













     * profile will affect the profile's parent user if set on the managed profile's parent













     * {@link DevicePolicyManager} instance.













     *













     * @hide













     */













    public static final int ORG_OWNED_PROFILE_KEYGUARD_FEATURES_PARENT_ONLY =













            KEYGUARD_DISABLE_SECURE_CAMERA;

























    /**













     * Keyguard features that when set on a normal or organization-owned managed profile, have













     * the potential to affect the profile's parent user.













     *













     * @hide













     */













    public static final int PROFILE_KEYGUARD_FEATURES_AFFECT_OWNER =













            DevicePolicyManager.NON_ORG_OWNED_PROFILE_KEYGUARD_FEATURES_AFFECT_OWNER













                    | DevicePolicyManager.ORG_OWNED_PROFILE_KEYGUARD_FEATURES_PARENT_ONLY;



























    /**















     * @deprecated This method does not actually modify the storage encryption of the device.















     * It has never affected the encryption status of a device.










@@ -6115,11 +6140,20 @@ public class DevicePolicyManager {













     * <li>{@link #KEYGUARD_DISABLE_UNREDACTED_NOTIFICATIONS} which affects notifications generated















     * by applications in the managed profile.















     * </ul>













     * <p>













     * From version {@link android.os.Build.VERSION_CODES#R} the profile owner of an













     * organization-owned managed profile can set:













     * <ul>













     * <li>{@link #KEYGUARD_DISABLE_SECURE_CAMERA} which affects the parent user when called on the













     * parent profile.













     * </ul>















     * {@link #KEYGUARD_DISABLE_TRUST_AGENTS}, {@link #KEYGUARD_DISABLE_FINGERPRINT},













     * {@link #KEYGUARD_DISABLE_FACE} and {@link #KEYGUARD_DISABLE_IRIS} can also be













     * set on the {@link DevicePolicyManager} instance returned by













     * {@link #getParentProfileInstance(ComponentName)} in order to set restrictions on the parent













     * profile.













     * {@link #KEYGUARD_DISABLE_FACE}, {@link #KEYGUARD_DISABLE_IRIS} and













     * {@link #KEYGUARD_DISABLE_SECURE_CAMERA} can also be set on the {@link DevicePolicyManager}













     * instance returned by {@link #getParentProfileInstance(ComponentName)} in order to set













     * restrictions on the parent profile. {@link #KEYGUARD_DISABLE_SECURE_CAMERA} can only be set













     * on the parent profile instance if the calling device admin is the profile owner of an













     * organization-owned managed profile.















     * <p>















     * Requests to disable other features on a managed profile will be ignored.















     * <p>

































services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java



+14
−8




























Original line number
Diff line number
Diff line








@@ -57,6 +57,7 @@ import static android.app.admin.DevicePolicyManager.LEAVE_ALL_SYSTEM_APPS_ENABLE













import static android.app.admin.DevicePolicyManager.LOCK_TASK_FEATURE_HOME;















import static android.app.admin.DevicePolicyManager.LOCK_TASK_FEATURE_NOTIFICATIONS;















import static android.app.admin.DevicePolicyManager.LOCK_TASK_FEATURE_OVERVIEW;













import static android.app.admin.DevicePolicyManager.NON_ORG_OWNED_PROFILE_KEYGUARD_FEATURES_AFFECT_OWNER;















import static android.app.admin.DevicePolicyManager.PASSWORD_COMPLEXITY_NONE;















import static android.app.admin.DevicePolicyManager.PASSWORD_QUALITY_ALPHABETIC;















import static android.app.admin.DevicePolicyManager.PASSWORD_QUALITY_ALPHANUMERIC;










@@ -522,7 +523,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {



























    /** Keyguard features that are allowed to be set on a managed profile */















    private static final int PROFILE_KEYGUARD_FEATURES =













            PROFILE_KEYGUARD_FEATURES_AFFECT_OWNER | PROFILE_KEYGUARD_FEATURES_PROFILE_ONLY;













            NON_ORG_OWNED_PROFILE_KEYGUARD_FEATURES_AFFECT_OWNER













                    | PROFILE_KEYGUARD_FEATURES_PROFILE_ONLY;





























    private static final int DEVICE_ADMIN_DEACTIVATE_TIMEOUT = 10000;
























@@ -8163,16 +8165,20 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {













        }















        Objects.requireNonNull(who, "ComponentName is null");















        final int userHandle = mInjector.userHandleGetCallingUserId();













        synchronized (getLockObject()) {













            ActiveAdmin ap = getActiveAdminForCallerLocked(













                    who, DeviceAdminInfo.USES_POLICY_DISABLE_KEYGUARD_FEATURES, parent);















            if (isManagedProfile(userHandle)) {















                if (parent) {













                    if (isProfileOwnerOfOrganizationOwnedDevice(ap)) {















                        which = which & PROFILE_KEYGUARD_FEATURES_AFFECT_OWNER;













                    } else {













                        which = which & NON_ORG_OWNED_PROFILE_KEYGUARD_FEATURES_AFFECT_OWNER;













                    }















                } else {















                    which = which & PROFILE_KEYGUARD_FEATURES;















                }















            }













        synchronized (getLockObject()) {













            ActiveAdmin ap = getActiveAdminForCallerLocked(













                    who, DeviceAdminInfo.USES_POLICY_DISABLE_KEYGUARD_FEATURES, parent);















            if (ap.disabledKeyguardFeatures != which) {















                ap.disabledKeyguardFeatures = which;















                saveSettingsLocked(userHandle);

































services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java



+36
−0




























Original line number
Diff line number
Diff line








@@ -2188,6 +2188,42 @@ public class DevicePolicyManagerTest extends DpmTestBase {













        assertThat(actualAccounts).containsExactlyElementsIn(expectedAccounts);















    }





























    public void testSetKeyguardDisabledFeaturesWithDO() throws Exception {













        mContext.binder.callingUid = DpmMockContext.CALLER_SYSTEM_USER_UID;













        setupDeviceOwner();



























        dpm.setKeyguardDisabledFeatures(admin1, DevicePolicyManager.KEYGUARD_DISABLE_SECURE_CAMERA);



























        assertThat(dpm.getKeyguardDisabledFeatures(admin1)).isEqualTo(













                DevicePolicyManager.KEYGUARD_DISABLE_SECURE_CAMERA);













    }



























    public void testSetKeyguardDisabledFeaturesWithPO() throws Exception {













        setupProfileOwner();



























        dpm.setKeyguardDisabledFeatures(admin1, DevicePolicyManager.KEYGUARD_DISABLE_FINGERPRINT);



























        assertThat(dpm.getKeyguardDisabledFeatures(admin1)).isEqualTo(













                DevicePolicyManager.KEYGUARD_DISABLE_FINGERPRINT);













    }



























    public void testSetKeyguardDisabledFeaturesWithPOOfOrganizationOwnedDevice()













            throws Exception {













        final int MANAGED_PROFILE_USER_ID = DpmMockContext.CALLER_USER_HANDLE;













        final int MANAGED_PROFILE_ADMIN_UID =













                UserHandle.getUid(MANAGED_PROFILE_USER_ID, DpmMockContext.SYSTEM_UID);













        mContext.binder.callingUid = MANAGED_PROFILE_ADMIN_UID;



























        addManagedProfile(admin1, MANAGED_PROFILE_ADMIN_UID, admin1);













        configureProfileOwnerOfOrgOwnedDevice(admin1, DpmMockContext.CALLER_USER_HANDLE);



























        parentDpm.setKeyguardDisabledFeatures(admin1,













                DevicePolicyManager.KEYGUARD_DISABLE_SECURE_CAMERA);



























        assertThat(parentDpm.getKeyguardDisabledFeatures(admin1)).isEqualTo(













                DevicePolicyManager.KEYGUARD_DISABLE_SECURE_CAMERA);













    }





























    public void testSetApplicationHiddenWithDO() throws Exception {















        mContext.binder.callingUid = DpmMockContext.CALLER_SYSTEM_USER_UID;















        setupDeviceOwner();